> I have spent some time validating the status of all the issues and I > think we're nearly there. I've suggested changes to the commit > messages, comments and CVE_STATUS wordings, with those addressed I > think 8/9 of these will be ready to merge.
Will send v4 with those eight using your wordings, with one deviation: for CVE-2023-6238 the fix was backed out by the nvme maintainer rather than withdrawn by its author, so the status reads "Proposed fix was not merged" to match the comment above it. > CVE-2022-0400 still bothers me. There was clearly something reported, > there's a non-public Red Hat bugzilla entry referenced by Debian [1]. > It looks like it was closed by Red Hat, SUSE and Debian as they don't > build the affected code, not because it was an invalid report. We > should ask Red Hat to release more details. Agreed - dropped from v4; with no CVE_STATUS entry it stays visible as Unpatched in cve-check reports. I've asked on the public bug 2044575 and via [email protected] for bug 2040604 to be opened or the affected files named, and will follow up here when Red Hat responds. All other comments will be addressed in v4 as suggested. Thanks a lot for your time and help.
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243718): https://lists.openembedded.org/g/openembedded-core/message/243718 Mute This Topic: https://lists.openembedded.org/mt/120714046/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
