Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
src/poky:libarchive: ignore CVE-2023-30571
This issue was reported and discusses under [1] which is linked in NVD CVE report. It was already documented that some parts or libarchive are thread safe and some not. [2] was now merged to document that also reported function is not thread safe. So this CVE *now* reports thread race condition for non-thread-safe function. And as such the CVE report is now invalid. The issue is still not closed for 2 reasons: * better document what is and what is not thread safe * request to public if someone could make these functions thread safe This should however not invalidate above statment about ignoring this CVE. [1] libarchive/libarchive#1876 [2] libarchive/libarchive#1875 (From OE-Core rev: 9b5b850d6a6982bb8ff14dcfbb6769b293638293) Signed-off-by: Peter Marko <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
- Loading branch information