mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-22 13:01:16 +03:00
5539626b6e
esp-idf-sbom reports two ESP-IDF CVEs against this branch even though the fixes are already merged here: - CVE-2026-45160 DHCP server OOB read (2da2db43fd). NVD pins it to 5.2.7, the version release/v5.2 still reports until 5.2.8 is released. Once version.cmake is bumped to 5.2.8 the entry becomes a no-op (NVD does not list 5.2.8) and can be removed. - CVE-2025-55297 BluFi example memory overflows (bf50c0c197,e65cf7ea2a). Fixed since v5.2.6, but NVD's affected range for the 5.2 line ([5.2, 5.3.3)) was assigned before v5.2.6 was released and never narrowed, so it matches any version this branch will ever report. The entry stays until the NVD record is corrected. The same exclusion exists in esp-idf-sbom's global excluded_cves.yaml to also cover scans of the released v5.2.6/v5.2.7 tags, which predate this file; it is kept here as well so the information lives next to the sources (on duplicate CVE IDs the repository-local entry wins). esp-idf-sbom merges this repository-local excluded_cves.yaml into its exclusion list when scanning the tree, so these CVEs are reported as excluded for this branch while the released tags, which predate this file, are still reported. Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
47 lines
2.2 KiB
YAML
47 lines
2.2 KiB
YAML
# SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Repository-local CVE exclusions for this ESP-IDF revision.
|
|
#
|
|
# esp-idf-sbom merges this file into its global exclusion list when scanning
|
|
# this tree (see the "Excluding CVEs" section of the esp-idf-sbom README). It
|
|
# uses the same format as esp-idf-sbom's own excluded_cves.yaml. Because the
|
|
# file lives in the tree it is scoped to this branch/revision: the affected
|
|
# release tags predate it and are still reported, while release/v5.2 -- which
|
|
# carries the fixes -- is not.
|
|
#
|
|
# CVE-2026-45160 is pinned by NVD to 5.2.7 on the 5.2 line and patched in
|
|
# 5.2.8; the fix is already merged on release/v5.2. Once version.cmake is
|
|
# bumped to 5.2.8, NVD no longer matches and the entry becomes a no-op that
|
|
# can be removed.
|
|
#
|
|
# CVE-2025-55297 is a stale NVD record: it is fixed since v5.2.6, but NVD's
|
|
# affected range for the 5.2 line ([5.2, 5.3.3)) was assigned before v5.2.6
|
|
# was released and never narrowed, so it matches any version this branch will
|
|
# ever report. The entry stays until the NVD record is corrected. The same
|
|
# exclusion exists in esp-idf-sbom's global excluded_cves.yaml to also cover
|
|
# scans of the released v5.2.6/v5.2.7 tags, which predate this file; it is
|
|
# kept here as well so the information lives next to the sources (on duplicate
|
|
# CVE IDs the repository-local entry wins).
|
|
|
|
CVE-2026-45160:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.2.7:*:*:*:*:*:*:*
|
|
reason: >-
|
|
Out-of-bounds read in the DHCP server option parser
|
|
(components/lwip/apps/dhcpserver/dhcpserver.c). Fixed on release/v5.2,
|
|
patched in 5.2.8 (commit 2da2db43fd7e). The branch still reports 5.2.7
|
|
until 5.2.8 is released.
|
|
|
|
CVE-2025-55297:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*
|
|
versionStartIncluding: '5.2.6'
|
|
versionEndExcluding: '5.3'
|
|
reason: >-
|
|
Memory overflows in the BluFi example, fixed on the 5.2 release line since
|
|
v5.2.6 (commits bf50c0c197af and e65cf7ea2a2b). NVD's affected range for
|
|
the 5.2 line ([5.2, 5.3.3)) was assigned before v5.2.6 was released and
|
|
never narrowed, so it still matches the fixed releases and this branch.
|
|
https://github.com/espressif/esp-idf/security/advisories/GHSA-9w88-r2vm-qfc4
|