From c021875bc441ddda05fb1ea0fb99f346c190ef69 Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Fri, 9 Jan 2026 14:04:17 +0100 Subject: [PATCH] memcached: ignore disputed CVE-2022-26635 Per [1] this is a problem of applications using memcached inproperly. This should not be a CVE against php-memcached, but for whatever software the issue was actually found in. php-memcached and libmemcached provide a VERIFY_KEY flag if they're too lazy to filter untrusted user input. [1] https://github.com/php-memcached-dev/php-memcached/issues/519 Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 889ccce6848276fa68b3736b345552a533bc6bd2) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari --- meta-networking/recipes-support/memcached/memcached_1.6.15.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta-networking/recipes-support/memcached/memcached_1.6.15.bb b/meta-networking/recipes-support/memcached/memcached_1.6.15.bb index b28bfe72b7..76e4768fb9 100644 --- a/meta-networking/recipes-support/memcached/memcached_1.6.15.bb +++ b/meta-networking/recipes-support/memcached/memcached_1.6.15.bb @@ -24,6 +24,9 @@ SRC_URI = "http://www.memcached.org/files/${BP}.tar.gz \ " SRC_URI[sha256sum] = "8d7abe3d649378edbba16f42ef1d66ca3f2ac075f2eb97145ce164388e6ed515" +# disputed: this is a problem of applications using php-memcached inproperly +CVE_CHECK_IGNORE = "CVE-2022-26635" + # set the same COMPATIBLE_HOST as libhugetlbfs COMPATIBLE_HOST = "(i.86|x86_64|powerpc|powerpc64|aarch64|arm).*-linux*"