]> code.ossystems Code Review - openembedded-core.git/commit
shadow: whitelist CVE-2013-4235
authorPurushottam Choudhary <Purushottam.Choudhary@kpit.com>
Wed, 3 Mar 2021 10:50:38 +0000 (16:20 +0530)
committerSteve Sakoman <steve@sakoman.com>
Tue, 9 Mar 2021 16:22:09 +0000 (06:22 -1000)
commit8836a56a9f17f238908b7d0e286a6d386f7be290
tree0ae03eb4bc4c150722c6c43849fd4aed41526d3b
parentc65a671d7af64a19bebd45b1c4d02fdf124a1c5a
shadow: whitelist CVE-2013-4235

This CVE is about TOCTOU (time-of-check time-of-use)
race condition when copying and removing directory trees
which had very low severity problem and marked as closed
and won't fix. Therefore whitelisted CVE-2013-4235.
Master, gatesgarth and dunfell all have shadow version 4.81.
Hence, this is applicable for master, gatesgarth and dunfell.
Link: https://bugzilla.redhat.com/show_bug.cgi?id=884658
Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b1c6cd87bee6b019619dc5728fd6c36bc87ed696)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
meta/recipes-extended/shadow/shadow_4.8.1.bb