From f0bbacca4691aa76939e93e5028138095a23bf5c Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Tue, 14 Oct 2025 23:34:23 +0200 Subject: [PATCH] gnupg: mark CVE-2025-30258 as patched Per NVD report [1] this CVE is fixed by [2]. This commit was backported to 2.4.8 via [3]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-30258 [2] https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158 [3] https://gitlab.com/freepg/gnupg/-/commit/da0164efc7f32013bc24d97b9afa9f8d67c318bb (From OE-Core rev: 88fe1eaa4bcd7c838902d8cdc067276c5f32624d) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- meta/recipes-support/gnupg/gnupg_2.4.8.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/gnupg/gnupg_2.4.8.bb b/meta/recipes-support/gnupg/gnupg_2.4.8.bb index 9c5de263c5..a6e777abf8 100644 --- a/meta/recipes-support/gnupg/gnupg_2.4.8.bb +++ b/meta/recipes-support/gnupg/gnupg_2.4.8.bb @@ -82,3 +82,4 @@ BBCLASSEXTEND = "native nativesdk" lcl_maybe_fortify:mipsarch = "" CVE_STATUS[CVE-2022-3219] = "upstream-wontfix: Upstream doesn't seem to be keen on merging the proposed commit - https://dev.gnupg.org/T5993" +CVE_STATUS[CVE-2025-30258] = "cpe-stable-backport: fir for this CVE was backported to version 2.4.8"