package/dovecot: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with versions using '-'. These IGNORE_CVES entry introduced in [2] is then no longer matched to the dovecot package. For more information, see the explanation in commit [1]. [1]35f376d88esupport/scripts/cve.py: fix CPE matching [2]948e71689apackage/dovecot: ignore CVE-2016-4983 Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> (cherry picked from commit 9dbd14df2291b5c6566d7fcd73c3934b931aed1a) Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
@@ -21,12 +21,7 @@ DOVECOT_DEPENDENCIES = \
|
||||
$(if $(BR2_PACKAGE_LIBICONV),libiconv) \
|
||||
openssl
|
||||
|
||||
# CVE-2016-4983 is an issue in a postinstall script in the dovecot rpm, which
|
||||
# is part of the Red Hat packaging and not part of upstream dovecot
|
||||
DOVECOT_IGNORE_CVES += CVE-2016-4983
|
||||
|
||||
# 0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch
|
||||
|
||||
# Note: this ignore CVE entry is reported as stale by pkg-stats, but
|
||||
# the NVD database is incorrect:
|
||||
# https://lore.kernel.org/buildroot/20250517181815.02ce0393@windsurf/
|
||||
|
||||
Reference in New Issue
Block a user