libarchive: ignore CVE-2023-30571

Source: poky MR: 127621, 126578 Type: Security Fix Disposition: Merged from poky ChangeID: 0de5f6a27a794c915a2ef2483901ab915056d961 Description: This issue was reported and discusses under [1] which is linked in NVD CVE report. It was already documented that some parts or libarchive are thread safe and some not. [2] was now merged to document that also reported function is not thread safe. So this CVE *now* reports thread race condition for non-thread-safe function. And as such the CVE report is now invalid. The issue is still not closed for 2 reasons: * better document what is and what is not thread safe * request to public if someone could make these functions thread safe This should however not invalidate above statment about ignoring this CVE. [1] libarchive/libarchive#1876 [2] libarchive/libarchive#1875 (From OE-Core rev: 9374e680ae2376589a9bfe4565dfcf4dc9791aa8) Signed-off-by: Peter Marko <[email protected]> Signed-off-by: Steve Sakoman <[email protected]> Signed-off-by: Jeremy A. Puhlman <[email protected]>
MontaVista-OpenSourceTechnology · Aug 23, 2023 · c97e7d9 · c97e7d9
1 parent 27e7fe9
commit c97e7d9
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/meta/recipes-extended/libarchive/libarchive_3.4.2.bb b/meta/recipes-extended/libarchive/libarchive_3.4.2.bb
@@ -47,6 +47,9 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \
 SRC_URI[md5sum] = "d953ed6b47694dadf0e6042f8f9ff451"
 SRC_URI[sha256sum] = "b60d58d12632ecf1e8fad7316dc82c6b9738a35625746b47ecdcaf4aed176176"
 
+# upstream-wontfix: upstream has documented that reported function is not thread-safe
+CVE_CHECK_WHITELIST += "CVE-2023-30571"
+
 inherit autotools update-alternatives pkgconfig
 
 CPPFLAGS += "-I${WORKDIR}/extra-includes"