change: exclude CVEs that do not impact ESP-IDF components

cJSON: CVE-2024-31755 - Resolved in cJSON v1.7.18 FreeRTOS: CVE-2024-28115 - Affects only ARMv7-M MPU ports, and ARMv8-M ports Signed-off-by: Frantisek Hrbata <[email protected]>
safocl · Aug 1, 2024 · 0fdb309 · 0fdb309
1 parent 33b4d64
commit 0fdb309
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/.gitmodules b/.gitmodules
@@ -55,6 +55,7 @@
 	sbom-url = https://github.com/DaveGamble/cJSON
 	sbom-description = Ultralightweight JSON parser in ANSI C
 	sbom-hash = acc76239bee01d8e9c858ae2cab296704e52d916
+	sbom-cve-exclude-list = CVE-2024-31755 Resolved in v1.7.18
 
 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls

diff --git a/components/freertos/FreeRTOS-Kernel/sbom.yml b/components/freertos/FreeRTOS-Kernel/sbom.yml
@@ -4,3 +4,6 @@ cpe: cpe:2.3:o:amazon:freertos:{}:*:*:*:*:*:*:*
 supplier: 'Organization: Espressif Systems (Shanghai) CO LTD'
 originator: 'Organization: Amazon Web Services'
 description: An open-source, real-time operating system (RTOS) with additional features and patches from Espressif.
+cve-exclude-list:
+  - cve: CVE-2024-28115
+    reason: Affects only ARMv7-M MPU ports, and ARMv8-M ports with Memory Protected Unit (MPU) support enabled