mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-03-17 04:39:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

cve-check: CPE version '-' as all version

Browse Source 
CPE version could be '-' to mean no version info.
Current cve_check treat it as not valid and does not report these
CVE but some of these could be a valid vulnerabilities.

Since non-valid CVE can be whitelisted, so treat '-' as all version
and report all these CVE to capture possible vulnerabilities.

Non-valid CVE to be whitelisted separately.

[YOCTO #13617]

(From OE-Core rev: c69ee3594079589d27c10db32bc288566ebde9ef)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Lee Chee Yang
2020-03-31 15:26:03 +08:00
committed by Richard Purdie
parent 2d9a29a3cf
commit 7c37e5c7cd
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta/classes/cve-check.bbclass
View File

@@ -221,7 +221,7 @@ def check_cves(d, patched_cves):
(_, _, _, version_start, operator_start, version_end, operator_end) = row
#bb.debug(2, "Evaluating row " + str(row))
if (operator_start == '=' and pv == version_start):
if (operator_start == '=' and pv == version_start) or version_start == '-':
vulnerable = True
else:
if operator_start:

2
meta/recipes-core/meta/cve-update-db-native.bb
View File

@@ -135,7 +135,7 @@ def parse_node_and_insert(c, node, cveId):
product = cpe23[4]
version = cpe23[5]
if version != '*':
if version != '*' and version != '-':
# Version is defined, this is a '=' match
yield [cveId, vendor, product, version, '=', '', '']
else: