CaROS/meta-openembedded
3
1
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-01-01 13:58:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

minio: ignore irrelevant CVEs

Browse Source 
The minio umbrella covers multiple projects. The recipe itself builds
"minio client", which is a set of basic tools to query data from
"minio server" - like ls, mv, find...

The CVEs were files against minio server. Looking at the go mod list,
this recipe doesn't use minio server even as a build dependency - so ignore
the CVEs.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit df462075be)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Gyorgy Sarvari 2025-12-22 21:27:29 +01:00 committed by Anuj Mittal
parent 3a59d89765
commit fe9360051e
No known key found for this signature in database
GPG Key ID: 4340AEFE69F5085C
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
meta-oe/recipes-extended/minio/minio_git.bb
View File

@ -164,3 +164,9 @@ do_install() {
install -d ${D}/${sbindir}
install ${S}/src/${GO_IMPORT}/mc ${D}/${sbindir}/mc
}
CVE_STATUS_GROUPS += "CVE_STATUS_WRONG_CPE"
CVE_STATUS_WRONG_CPE[status] = "cpe-incorrect: The vulnerability is in minio server, not in minio client-tools"
CVE_STATUS_WRONG_CPE = "CVE-2018-1000538 CVE-2020-11012 CVE-2021-21287 CVE-2021-21362 \
CVE-2021-21390 CVE-2021-43858 CVE-2022-35919 CVE-2023-28433 \
CVE-2023-28434 CVE-2024-36107"