Merge pull request #446 from espressif/fix/expat_exclude_cve

change: exclude CVE-2024-50602 from libexpat component
espressif · Nov 8, 2024 · 884934d · 884934d
2 parents 9634f8d + 8ccc7ca
commit 884934d
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/expat/idf_component.yml b/expat/idf_component.yml
@@ -1,4 +1,4 @@
-version: "2.6.4"
+version: "2.6.4~1"
 description: "Expat - XML Parsing C Library"
 url: https://github.com/espressif/idf-extra-components/tree/master/expat
 dependencies:

diff --git a/expat/sbom_libexpat.yml b/expat/sbom_libexpat.yml
@@ -8,3 +8,5 @@ hash: 2691aff4304a6d7e053199c205620136481b9dd1
 cve-exclude-list:
   - cve: CVE-2024-28757
     reason: Resolved in version 2.6.2
+  - cve: CVE-2024-50602
+    reason: Resolved in version 2.6.4, please see https://github.com/libexpat/libexpat/pull/915