From 07a578d49ca07aa2f09d67afa7581e54878e3c06 Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Sat, 29 Jul 2023 23:24:28 +0200 Subject: [PATCH] podman: ignore CVE-2022-2989 and CVE-2023-0778 NVD shows only redhat links and does not mention fixed-in release se these CVEs will show-up in reports indefinitely. They are already fixed in current version, so ignore them. CVE-2022-2989 * https://github.com/advisories/GHSA-4wjj-jwc9-2x96 * https://github.com/containers/podman/pull/15618 * commit d82a41687e614d9ac8b2d169dee47fe226835e4c Add container GID to additional groups CVE-2023-0778 * https://github.com/advisories/GHSA-qwqv-rqgf-8qh8 * https://github.com/containers/podman/pull/17528 * commit 6ca857feb07a5fdc96fd947afef03916291673d8 volume,container: chroot to source before exporting content Signed-off-by: Peter Marko --- recipes-containers/podman/podman_git.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb index cda2e949..4f728210 100644 --- a/recipes-containers/podman/podman_git.bb +++ b/recipes-containers/podman/podman_git.bb @@ -34,6 +34,9 @@ S = "${WORKDIR}/git" PV = "4.5.1+git${SRCPV}" +CVE_STATUS[CVE-2022-2989] = "fixed-version: fixed since v4.3.0" +CVE_STATUS[CVE-2023-0778] = "fixed-version: fixed since v4.5.0" + PACKAGES =+ "${PN}-contrib" PODMAN_PKG = "github.com/containers/libpod"