<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Helvetica,Arial,sans-serif'>
<p> </p>
<p> </p>
<div>
<pre>Petter Mabäcker
Technux <petter@technux.se>
www.technux.se</pre>
</div>
<p>2015-10-06 12:06 skrev Burton, Ross:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px; width:100%"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div dir="ltr">
<div class="gmail_extra"><br />
<div class="gmail_quote">On 6 October 2015 at 09:11, Petter Mabäcker <span><<a href="mailto:petter@technux.se">petter@technux.se</a>></span> wrote:<br />
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: #cccccc; border-left-style: solid; padding-left: 1ex;">
<p>I played around with the new meta-security-isafw layer and the cve-check-tool. In readline the cve CVE-2014-2524 is marked as 'missing' by the framework and I was confused to start with, since I saw that this commit was included. But after looking at the actual patch I realized that it only contains a report and not the patch itself. My question is if that is with purpose and due to some decision that the CVE isn't really causing any harm or if it's by mistake?</p>
<p> </p>
</blockquote>
</div>
<br />As can be seen at <a href="http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html">http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html</a> the CVE patch is simply adding a #if defined (DEBUG), which is in the patch included in oe-core master as readline-6.3/readline63-003.</div>
<div class="gmail_extra"> </div>
<div class="gmail_extra">The tool is probably reporting it as missing as -- if i recall correctly -- it identifies CVE patches by filename.</div>
<div class="gmail_extra"> </div>
<div class="gmail_extra">Ross</div>
</div>
<div dir="ltr"> </div>
</blockquote>
<div dir="ltr"> </div>
<div dir="ltr">Hi Ross,</div>
<div dir="ltr"> </div>
<div dir="ltr">That is correct that the isafw layer assumes that it's named *cve*.patch in order to understand that it's patched in a separate step. But what I really meant was that the file readline63-003 just contains information about the CVE and how to patch the source. It will never be applied on the source, it is just copied to the WORKDIR.</div>
<div dir="ltr"> </div>
<div dir="ltr"> </div>
<div dir="ltr">$ pwd</div>
<div dir="ltr">~BUILDDIR/tmp/work/core2-64-poky-linux/readline/6.3-r0</div>
<div dir="ltr">$ls<br />
<div class="gmail_extra">build configure-fix.patch norpath.patch readline63-003 temp<br />config-dirent-symbols.patch configure.sstate readline-6.3 readline-dispatch-multikey.patch<br />$ grep DEBUG readline-6.3/util.c<br />$ echo $?<br />1<br /><br /></div>
<div class="gmail_extra"> The patch must be applied by something/someone.. For example Debian solves it by doing their own .diff patch (http://http.debian.net/debian/pool/main/r/readline6/readline6_6.3-8.debian.tar.xz). I can send a suggestion about how to solve this in a proper way.</div>
<div class="gmail_extra"> </div>
<div class="gmail_extra">BR Petter</div>
</div>
</body></html>