On 29 Jan 2023, at 12:03, Steve Sakoman via lists.yoctoproject.org <[email protected]> wrote: > Full list: Found 9 unpatched CVEs > CVE-2022-23521 (CVSS3: 9.8 CRITICAL): git > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23521 * > CVE-2022-41903 (CVSS3: 9.8 CRITICAL): git > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-41903 * > CVE-2022-41953 (CVSS3: 7.8 HIGH): git > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-41953 *
Patches sent (upgrade and ignore). > CVE-2022-3550 (CVSS3: 8.8 HIGH): xserver-xorg > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3550 * > CVE-2022-3551 (CVSS3: 6.5 MEDIUM): xserver-xorg > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3551 * > CVE-2022-46457 (CVSS3: 5.5 MEDIUM): nasm:nasm-native > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-46457 * NIST haven’t taken the CPE fixes I sent, re-sent. > CVE-2022-3996 (CVSS3: 7.5 HIGH): openssl:openssl-native > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3996 * This was fixed by a patch on the list that was incorrectly labelled as langdale, I’ve reposted it. > CVE-2022-4055 (CVSS3: 7.4 HIGH): xdg-utils > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4055 * > CVE-2022-46456 (CVSS3: 6.1 MEDIUM): nasm:nasm-native > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-46456 * Both still open upstream. Ross
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#176497): https://lists.openembedded.org/g/openembedded-core/message/176497 Mute This Topic: https://lists.openembedded.org/mt/96631913/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
