<div dir="ltr"><div dir="ltr">On Thu, 27 Feb 2020 at 14:28, Adrian Bunk <<a href="mailto:bunk@stusta.de">bunk@stusta.de</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">>...<br>
<br>
It is a crypto library with a history of unfixed CVEs in supported <br>
stable Yocto releases.<br></blockquote><div><br></div><div>If the issue is unfixed CVEs, then I do not think it's particularly relevant which layer the recipe is in. Stable release maintainers are not expected to 'track and fix CVEs', that one is on users.</div><div><br></div><div>Alex<br></div></div></div>