CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

libmicrohttpd: disable experimental code by default

Browse Source 
Introduce new packageconfig to explicitly avoid compilation of
experimental code. Note that the code was not compiled by default also
before this patch, this now makes it explicit and makes it possible to
check for the flags in cve-check code.

This is less intrusive change than a patch removing the code which was
rejected in patch review.

This will solve CVE-2025-59777 and CVE-2025-62689 as the vulnerable code
is not compiled by default.
Set appropriate CVE status for these CVEs based on new packageconfig.

(From OE-Core rev: 9e3c0ae261afb7b9ff9528dbc147fb6c89d5a624)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko 2025-12-08 12:27:14 +01:00 committed by Steve Sakoman
parent cc239ca412
commit f0d2110a32
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
meta/recipes-support/libmicrohttpd/libmicrohttpd_1.0.1.bb
View File

@ -19,9 +19,13 @@ PACKAGECONFIG ?= "curl https"
PACKAGECONFIG[curl] = "--enable-curl,--disable-curl,curl,"
PACKAGECONFIG[https] = "--enable-https,--disable-https,libgcrypt gnutls,"
PACKAGECONFIG[experimental] = "--enable-experimental,--disable-experimental,"
do_compile:append() {
sed -i s:-L${STAGING_LIBDIR}::g libmicrohttpd.pc
}
BBCLASSEXTEND = "native nativesdk"
CVE_STATUS[CVE-2025-59777] = "${@bb.utils.contains('PACKAGECONFIG', 'experimental', 'unpatched', 'not-applicable-config: experimental code not compiled', d)}"
CVE_STATUS[CVE-2025-62689] = "${@bb.utils.contains('PACKAGECONFIG', 'experimental', 'unpatched', 'not-applicable-config: experimental code not compiled', d)}"