From: Richard Purdie <richard.purdie@linuxfoundation.org>
Date: Mon, 10 May 2021 15:40:11 +0000 (+0100)
Subject: logrotate: Exclude CVE-2011-1548,1549,1550 from cve-check
X-Git-Tag: yocto-3.3.2~122
X-Git-Url: https://code.ossystems.io/gitweb?a=commitdiff_plain;h=55b53c501e911df04bdff6fca54b11c3e54770c9;p=openembedded-core.git

logrotate: Exclude CVE-2011-1548,1549,1550 from cve-check

These CVEs apply to the way logrotate was installed on Gentoo, Debian
and SUSE, exclude from cve-check as they don't apply to OE.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---

diff --git a/meta/recipes-extended/logrotate/logrotate_3.18.0.bb b/meta/recipes-extended/logrotate/logrotate_3.18.0.bb
index 55684ac9fb..c2115e7142 100644
--- a/meta/recipes-extended/logrotate/logrotate_3.18.0.bb
+++ b/meta/recipes-extended/logrotate/logrotate_3.18.0.bb
@@ -21,6 +21,9 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.xz
 
 SRC_URI[sha256sum] = "841f81bf09d0014e4a2e11af166bb33fcd8429cc0c2d4a7d3d9ceb3858cfccc5"
 
+# These CVEs are debian, gentoo or SUSE specific on the way logrotate was installed/used
+CVE_CHECK_WHITELIST += "CVE-2011-1548 CVE-2011-1549 CVE-2011-1550"
+
 PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'acl selinux', d)}"
 
 PACKAGECONFIG[acl] = ",,acl"