diff options
author | Lee Chee Yang <chee.yang.lee@intel.com> | 2020-03-31 15:26:03 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-04-29 16:11:56 +0100 |
commit | 73738879a282e3a39c5753024ed363b27e704416 (patch) | |
tree | 1fb2ae3d715435e615062b3f1951492184c08888 | |
parent | 74f229160c7f4037107c1dad8f0d02128c080a7e (diff) | |
download | poky-73738879a282e3a39c5753024ed363b27e704416.tar.gz |
cve-check: CPE version '-' as all version
CPE version could be '-' to mean no version info.
Current cve_check treat it as not valid and does not report these
CVE but some of these could be a valid vulnerabilities.
Since non-valid CVE can be whitelisted, so treat '-' as all version
and report all these CVE to capture possible vulnerabilities.
Non-valid CVE to be whitelisted separately.
[YOCTO #13617]
(From OE-Core rev: 1e8e188514584f9f972c0eb733c10a61853ec3d0)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c69ee3594079589d27c10db32bc288566ebde9ef)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/classes/cve-check.bbclass | 2 | ||||
-rw-r--r-- | meta/recipes-core/meta/cve-update-db-native.bb | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass index 5d84b93d71..2a530a0489 100644 --- a/meta/classes/cve-check.bbclass +++ b/meta/classes/cve-check.bbclass | |||
@@ -221,7 +221,7 @@ def check_cves(d, patched_cves): | |||
221 | (_, _, _, version_start, operator_start, version_end, operator_end) = row | 221 | (_, _, _, version_start, operator_start, version_end, operator_end) = row |
222 | #bb.debug(2, "Evaluating row " + str(row)) | 222 | #bb.debug(2, "Evaluating row " + str(row)) |
223 | 223 | ||
224 | if (operator_start == '=' and pv == version_start): | 224 | if (operator_start == '=' and pv == version_start) or version_start == '-': |
225 | vulnerable = True | 225 | vulnerable = True |
226 | else: | 226 | else: |
227 | if operator_start: | 227 | if operator_start: |
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb index 575254af40..1b4f31692b 100644 --- a/meta/recipes-core/meta/cve-update-db-native.bb +++ b/meta/recipes-core/meta/cve-update-db-native.bb | |||
@@ -122,7 +122,7 @@ def parse_node_and_insert(c, node, cveId): | |||
122 | product = cpe23[4] | 122 | product = cpe23[4] |
123 | version = cpe23[5] | 123 | version = cpe23[5] |
124 | 124 | ||
125 | if version != '*': | 125 | if version != '*' and version != '-': |
126 | # Version is defined, this is a '=' match | 126 | # Version is defined, this is a '=' match |
127 | yield [cveId, vendor, product, version, '=', '', ''] | 127 | yield [cveId, vendor, product, version, '=', '', ''] |
128 | else: | 128 | else: |