diff mbox series

package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689

Message ID 20260901112323.2671803-1-yegorslists@googlemail.com
State New
Headers show
Series package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689 | expand

Commit Message

yegorslists--- via buildroot Sept. 1, 2026, 11:23 a.m. UTC 
From: Yegor Yefremov <yegorslists@googlemail.com>

Both CVEs describe a NULL pointer dereference affecting libmicrohttpd
1.0.2 and earlier. They were fixed upstream in commit
ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b, released in version 1.0.3, so
the current LIBMICROHTTPD_VERSION is not affected.

pkg-stats nevertheless keeps reporting both, because the NVD entries
encode the affected range as

  cpe:2.3:a:gnu:libmicrohttpd:*:*:*:*:*:*:*:*, versionEndExcluding 2025-09-16

i.e. the date of the fix commit instead of a version number. Since
support/scripts/cve.py compares versions using LooseVersion, every 1.0.x
version evaluates as smaller than "2025-09-16" and is thus reported as
affected, no matter how far the package gets bumped.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
---
 package/libmicrohttpd/libmicrohttpd.mk | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox series

Patch

diff --git a/package/libmicrohttpd/libmicrohttpd.mk b/package/libmicrohttpd/libmicrohttpd.mk
index 8756adb4c6..69b45a8c05 100644
--- a/package/libmicrohttpd/libmicrohttpd.mk
+++ b/package/libmicrohttpd/libmicrohttpd.mk
@@ -10,6 +10,13 @@  LIBMICROHTTPD_LICENSE_FILES = COPYING
 LIBMICROHTTPD_CPE_ID_VENDOR = gnu
 LIBMICROHTTPD_INSTALL_STAGING = YES
 LIBMICROHTTPD_DEPENDENCIES = host-pkgconf
+
+# Both fixed in commit ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b, released in
+# version 1.0.3. The NVD entries encode the affected range as
+# "< 2025-09-16", i.e. the date of the fix instead of a version number, so
+# every 1.0.x version compares as affected.
+LIBMICROHTTPD_IGNORE_CVES += CVE-2025-59777 CVE-2025-62689
+
 LIBMICROHTTPD_CONF_OPTS = --disable-curl --disable-examples
 LIBMICROHTTPD_CFLAGS = $(TARGET_CFLAGS) -std=c99