diff options
author | Yoann Congal <yoann.congal@smile.fr> | 2024-03-15 01:20:19 +0100 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2024-03-20 06:02:50 -1000 |
commit | 11d9d02cf60444b034636aa2b59ea8438344293e (patch) | |
tree | 195d624ee853aca20db4a50a0a59671b98d8684d | |
parent | 8d5fb5f5d2328f3a6c7cb4093e1ec00ff8ed6925 (diff) | |
download | poky-11d9d02cf60444b034636aa2b59ea8438344293e.tar.gz |
cve-update-nvd2-native: Fix CVE configuration update
When a CVE is created, it often has no precise version information and
this is stored as "-" (matching any version). After an update, version
information is added. The previous "-" must be removed, otherwise, the
CVE is still "Unpatched" for cve-check.
(From OE-Core rev: 67c4d9d27f06a07eac46c0f2cba8cfa1691b0737)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 641ae3f36e09af9932dc33043a0a5fbfce62122e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
-rw-r--r-- | meta/recipes-core/meta/cve-update-nvd2-native.bb | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/meta/recipes-core/meta/cve-update-nvd2-native.bb b/meta/recipes-core/meta/cve-update-nvd2-native.bb index 5bba2219d6..4b8d01fe84 100644 --- a/meta/recipes-core/meta/cve-update-nvd2-native.bb +++ b/meta/recipes-core/meta/cve-update-nvd2-native.bb | |||
@@ -357,6 +357,10 @@ def update_db(conn, elt): | |||
357 | [cveId, cveDesc, cvssv2, cvssv3, date, accessVector, vectorString]).close() | 357 | [cveId, cveDesc, cvssv2, cvssv3, date, accessVector, vectorString]).close() |
358 | 358 | ||
359 | try: | 359 | try: |
360 | # Remove any pre-existing CVE configuration. Even for partial database | ||
361 | # update, those will be repopulated. This ensures that old | ||
362 | # configuration is not kept for an updated CVE. | ||
363 | conn.execute("delete from PRODUCTS where ID = ?", [cveId]).close() | ||
360 | for config in elt['cve']['configurations']: | 364 | for config in elt['cve']['configurations']: |
361 | # This is suboptimal as it doesn't handle AND/OR and negate, but is better than nothing | 365 | # This is suboptimal as it doesn't handle AND/OR and negate, but is better than nothing |
362 | for node in config["nodes"]: | 366 | for node in config["nodes"]: |