diff mbox series

package/mender: ignore mender CVE because it doesn't affect the client package

Message ID 20250506145236.895150-1-titouan.christophe@mind.be
State New
Headers show
Series package/mender: ignore mender CVE because it doesn't affect the client package | expand

Commit Message

Titouan Christophe May 6, 2025, 2:52 p.m. UTC 
CVE-2024-46948 only affects the device management and update server part
of Mender, and not the client running on the devices

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
 package/mender/mender.mk | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/package/mender/mender.mk b/package/mender/mender.mk
index 146e6b2b73..1050277db1 100644
--- a/package/mender/mender.mk
+++ b/package/mender/mender.mk
@@ -8,6 +8,8 @@  MENDER_VERSION = 3.5.3
 MENDER_SITE = $(call github,mendersoftware,mender,$(MENDER_VERSION))
 MENDER_LICENSE = Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MIT, OLDAP-2.8
 MENDER_CPE_ID_VENDOR = northern.tech
+# CVE-2024-46948 only affects mender-server
+MENDER_IGNORE_CVES = CVE-2024-46948
 
 # Vendor license paths generated with:
 #    awk '{print $2}' LIC_FILES_CHKSUM.sha256 | grep vendor