Re: [OE-core] [dunfell][PATCH] curl: Fix CVE-2021-22946 and CVE-22947, whitelist CVE-2021-22945

2021-09-18 Thread Steve Sakoman
On Sat, Sep 18, 2021 at 2:58 AM Mike Crowe via lists.openembedded.org wrote: > > Of course, the subject line ought to say CVE-2021-22947 rather than > CVE-22947. :( No worries, I'll fix that :-) Steve > > Mike. > > On Friday 17 September 2021 at 17:14:33 +0100, Mike Crowe via > lists.openembed

Re: [OE-core] [dunfell][PATCH] curl: Fix CVE-2021-22946 and CVE-22947, whitelist CVE-2021-22945

2021-09-18 Thread Mike Crowe via lists.openembedded.org
Of course, the subject line ought to say CVE-2021-22947 rather than CVE-22947. :( Mike. On Friday 17 September 2021 at 17:14:33 +0100, Mike Crowe via lists.openembedded.org wrote: > curl v7.79.0 contained fixes for three CVEs: > > The description of CVE-2021-22945[1] contains: > > This flaw was

[OE-core] [dunfell][PATCH] curl: Fix CVE-2021-22946 and CVE-22947, whitelist CVE-2021-22945

2021-09-17 Thread Mike Crowe via lists.openembedded.org
curl v7.79.0 contained fixes for three CVEs: The description of CVE-2021-22945[1] contains: > This flaw was introduced in commit 2522903b79 but since MQTT support > was marked 'experimental' then and not enabled in the build by default > until curl 7.73.0 (October 14, 2020) we count that as the fi