mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-22 13:01:16 +03:00
289424f2d7
esp-idf-sbom reports five ESP-IDF CVEs against this branch because NVD pins them to 5.5.4 -- the version release/v5.5 still reports until 5.5.5 is released -- even though the fixes are already merged here: - CVE-2026-45160 DHCP server OOB read (d51b107609) - CVE-2026-45328 ESP-TEE hardening against REE manipulation (b471faf803) - CVE-2026-45329 ESP-TEE service-call input validation (eebabaff2f,dcb758a30b) - CVE-2026-45541 esp_http_server WebSocket NULL dereference (00a2f7fbbb) - CVE-2026-45542 protocomm SRP6a heap overflow (71eb2dbe6a) esp-idf-sbom merges this repository-local excluded_cves.yaml into its exclusion list when scanning the tree, so these CVEs are reported as excluded for this branch while the released v5.5.4 tag, which predates this file, is still reported. Once version.cmake is bumped to 5.5.5 the entries become no-ops (NVD does not list 5.5.5) and can be removed. Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
63 lines
2.7 KiB
YAML
63 lines
2.7 KiB
YAML
# SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Repository-local CVE exclusions for this ESP-IDF revision.
|
|
#
|
|
# esp-idf-sbom merges this file into its global exclusion list when scanning
|
|
# this tree (see the "Excluding CVEs" section of the esp-idf-sbom README). It
|
|
# uses the same format as esp-idf-sbom's own excluded_cves.yaml. Because the
|
|
# file lives in the tree it is scoped to this branch/revision: the affected
|
|
# release tag (v5.5.4) predates it and is still reported, while release/v5.5 --
|
|
# which carries the fixes and reports 5.5.4 until 5.5.5 is released -- is not.
|
|
#
|
|
# Every CVE below is pinned by NVD to 5.5.4 on the 5.5 line and patched in
|
|
# 5.5.5; the fixes are already merged on release/v5.5 (fix commit cited in each
|
|
# reason). Once version.cmake is bumped to 5.5.5, NVD no longer matches and
|
|
# these entries become no-ops that can be removed.
|
|
|
|
CVE-2026-45160:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*
|
|
reason: >-
|
|
Out-of-bounds read in the DHCP server option parser
|
|
(components/lwip/apps/dhcpserver/dhcpserver.c). Fixed on release/v5.5,
|
|
patched in 5.5.5 (commit d51b10760924). The branch still reports 5.5.4
|
|
until 5.5.5 is released.
|
|
|
|
CVE-2026-45328:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*
|
|
reason: >-
|
|
ESP-TEE secure-service wrappers (esp_secure_services.c) exposed
|
|
TEE-protected peripherals and features to the REE. Fixed on release/v5.5,
|
|
patched in 5.5.5 (commit b471faf803e1). The branch still reports 5.5.4
|
|
until 5.5.5 is released.
|
|
|
|
CVE-2026-45329:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*
|
|
reason: >-
|
|
ESP-TEE secure-service wrappers left caller-supplied input pointers
|
|
unvalidated, allowing disclosure of TEE memory. Fixed on release/v5.5,
|
|
patched in 5.5.5 (commits eebabaff2fdc and dcb758a30b32). The branch still
|
|
reports 5.5.4 until 5.5.5 is released.
|
|
|
|
CVE-2026-45541:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*
|
|
reason: >-
|
|
NULL-pointer dereference in the esp_http_server WebSocket
|
|
subprotocol-negotiation path (components/esp_http_server/src/httpd_ws.c).
|
|
Fixed on release/v5.5, patched in 5.5.5 (commit 00a2f7fbbbd8). The branch
|
|
still reports 5.5.4 until 5.5.5 is released.
|
|
|
|
CVE-2026-45542:
|
|
cpes:
|
|
- cpe: cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*
|
|
reason: >-
|
|
Heap buffer overflow in the protocomm SRP6a session setup
|
|
(handle_session_command0() in
|
|
components/protocomm/src/security/security2.c) from an unbounded username
|
|
length copy. Fixed on release/v5.5, patched in 5.5.5 (commit 71eb2dbe6aae).
|
|
The branch still reports 5.5.4 until 5.5.5 is released.
|