mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-22 13:01:16 +03:00
94ce057ccc
esp-idf-sbom reports four ESP-IDF CVEs against this branch because NVD pins them to 5.3.5 -- the version release/v5.3 still reports until 5.3.6 is released -- even though the fixes are already merged here: - CVE-2026-45160 DHCP server OOB read (9f713dbc94) - CVE-2026-45541 esp_http_server WebSocket NULL dereference (f88a47e4f3) - CVE-2026-45542 protocomm SRP6a heap overflow (0ea58d7984) - CVE-2026-46532 BlueDroid AVRCP vendor-command parser OOB read (7c004d3fe3) esp-idf-sbom merges this repository-local excluded_cves.yaml into its exclusion list when scanning the tree, so these CVEs are reported as excluded for this branch while the released v5.3.5 tag, which predates this file, is still reported. Once version.cmake is bumped to 5.3.6 the entries become no-ops (NVD does not list 5.3.6) and can be removed. Compared to the release/v5.5 file this backport was adapted from, the two ESP-TEE CVEs do not apply (NVD pins them to 5.5.4 and 6.0 only) and CVE-2026-46532 is added (fixed in the released v5.5.4, but only after v5.3.5 on this branch). Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
55 lines
2.4 KiB
YAML
55 lines
2.4 KiB
YAML
# SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Repository-local CVE exclusions for this ESP-IDF revision.
|
|
#
|
|
# esp-idf-sbom merges this file into its global exclusion list when scanning
|
|
# this tree (see the "Excluding CVEs" section of the esp-idf-sbom README). It
|
|
# uses the same format as esp-idf-sbom's own excluded_cves.yaml. Because the
|
|
# file lives in the tree it is scoped to this branch/revision: the affected
|
|
# release tag (v5.3.5) predates it and is still reported, while release/v5.3 --
|
|
# which carries the fixes and reports 5.3.5 until 5.3.6 is released -- is not.
|
|
#
|
|
# Every CVE below is pinned by NVD to 5.3.5 on the 5.3 line and patched in
|
|
# 5.3.6; the fixes are already merged on release/v5.3 (fix commit cited in each
|
|
# reason). Once version.cmake is bumped to 5.3.6, NVD no longer matches and
|
|
# these entries become no-ops that can be removed.
|
|
|
|
CVE-2026-45160:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*
|
|
reason: >-
|
|
Out-of-bounds read in the DHCP server option parser
|
|
(components/lwip/apps/dhcpserver/dhcpserver.c). Fixed on release/v5.3,
|
|
patched in 5.3.6 (commit 9f713dbc9498). The branch still reports 5.3.5
|
|
until 5.3.6 is released.
|
|
|
|
CVE-2026-45541:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*
|
|
reason: >-
|
|
NULL-pointer dereference in the esp_http_server WebSocket
|
|
subprotocol-negotiation path (components/esp_http_server/src/httpd_ws.c).
|
|
Fixed on release/v5.3, patched in 5.3.6 (commit f88a47e4f37f). The branch
|
|
still reports 5.3.5 until 5.3.6 is released.
|
|
|
|
CVE-2026-45542:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*
|
|
reason: >-
|
|
Heap buffer overflow in the protocomm SRP6a session setup
|
|
(handle_session_command0() in
|
|
components/protocomm/src/security/security2.c) from an unbounded username
|
|
length copy. Fixed on release/v5.3, patched in 5.3.6 (commit 0ea58d79845a).
|
|
The branch still reports 5.3.5 until 5.3.6 is released.
|
|
|
|
CVE-2026-46532:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*
|
|
reason: >-
|
|
Out-of-bounds read in the BlueDroid AVRCP vendor-command parser
|
|
(avrc_pars_vendor_cmd() in
|
|
components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c). Fixed on
|
|
release/v5.3, patched in 5.3.6 (commit 7c004d3fe302). The branch still
|
|
reports 5.3.5 until 5.3.6 is released.
|