Projetos/rpi-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/mender: ignore mender CVE because it doesn't affect the client package

Browse Source 
CVE-2024-46948 only affects the device management and update server part
of Mender, and not the client running on the devices

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f16475f3773dbb910356c1b9dbb8a663266a55b0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2025-05-06 16:52:36 +02:00
committed by Thomas Perale
parent 81b7bd41a0
commit 9621d10204
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/mender/mender.mk
View File

@@ -8,6 +8,8 @@ MENDER_VERSION = 3.5.3
MENDER_SITE = $(call github,mendersoftware,mender,$(MENDER_VERSION))
MENDER_LICENSE = Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MIT, OLDAP-2.8
MENDER_CPE_ID_VENDOR = northern.tech
# CVE-2024-46948 only affects mender-server
MENDER_IGNORE_CVES = CVE-2024-46948
# Vendor license paths generated with:
# awk '{print $2}' LIC_FILES_CHKSUM.sha256 | grep vendor