Projetos/rpi-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/linenoise: add CPE

Browse Source 
The CPE 'cpe:2.3🅰️antirez:linenoise:1.0:*:*:*:*:*:*:*' is valid for the
package linenoise [1].

Since the latest version is '1.0' since 2015 the CPE_ID_VERSION is set
to that version.

The CVE that applies on version 1.0 were checked with the 'cve-check'
script:

```
echo '{"components": [{"bom-ref": "linenoise", "name": "linenoise", "version": "1.0", "cpe": "cpe:2.3🅰️antirez:linenoise:1.0:-:*:*:*:*:*:*"}]}' | support/scripts/cve-check | jq -r '.vulnerabilities[].id'
```

Only the CVE-2025-9810 exists and that was fixed in [2].

[1] https://nvd.nist.gov/products/cpe/detail/10423C23-6AAA-439E-B723-1FCDEB3A769F
[2] 3c7cbf97d7 package/linenoise: security bump to version e26268de5e

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2668d121e5add1f999206b5c43fa325587de81b7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2025-12-27 14:06:10 +01:00
parent d943f82156
commit 79b670f497
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
package/linenoise/linenoise.mk
View File

@@ -8,10 +8,15 @@ LINENOISE_VERSION = e26268de5e56bfaad773786471844578fe9f7f4b
LINENOISE_SITE = $(call github,antirez,linenoise,$(LINENOISE_VERSION))
LINENOISE_LICENSE = BSD-2-Clause
LINENOISE_LICENSE_FILES = LICENSE
LINENOISE_CPE_ID_VENDOR = antirez
LINENOISE_CPE_ID_VERSION = 1.0
LINENOISE_INSTALL_STAGING = YES
# Static library only, nothing to install on target
LINENOISE_INSTALL_TARGET = NO
# Fixed in https://github.com/antirez/linenoise/commit/880b94130ffa5f8236392392b447ff2234b11983
LINENOISE_IGNORE_CVES += CVE-2025-9810
define LINENOISE_BUILD_CMDS
cd $(@D); $(TARGET_CC) $(TARGET_CFLAGS) -c linenoise.c
cd $(@D); $(TARGET_AR) rcu liblinenoise.a linenoise.o