From: Hetvi Thakar <[email protected]> CVE-2026-34191 affects only the apr_dbd_oracle provider [1]. The apr-util recipe does not enable --with-oracle, so configure keeps apu_have_oracle=0 [2]. Hence mark the CVE not applicable to this build.
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-34191 [2] https://github.com/apache/apr-util/blob/1.6.3/build/dbd.m4 Signed-off-by: Hetvi Thakar <[email protected]> --- meta/recipes-support/apr/apr-util_1.6.3.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb index e3d6a23fcb..3051a08eaf 100644 --- a/meta/recipes-support/apr/apr-util_1.6.3.bb +++ b/meta/recipes-support/apr/apr-util_1.6.3.bb @@ -102,3 +102,5 @@ do_install_ptest() { # Add CVE_PRODUCT to match the NVD CPE product name CVE_PRODUCT = "apache:apr-util apache:portable_runtime_utility" + +CVE_STATUS[CVE-2026-34191] = "not-applicable-config: apr_dbd_oracle is not built because --with-oracle is not enabled" -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244296): https://lists.openembedded.org/g/openembedded-core/message/244296 Mute This Topic: https://lists.openembedded.org/mt/120933009/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
