summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLee Chee Yang <chee.yang.lee@intel.com>2020-03-31 15:26:03 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-05-22 16:23:30 +0100
commit29b5805c629a3d73e4280adc7d109c2aa2b0bdd8 (patch)
treeafdf6dd993a8e94f78b087514632b9a377e1c9c2
parentbb9075fb41ce919455d1048721a62c2605ac6bb0 (diff)
downloadpoky-29b5805c629a3d73e4280adc7d109c2aa2b0bdd8.tar.gz
cve-check: CPE version '-' as all version
CPE version could be '-' to mean no version info. Current cve_check treat it as not valid and does not report these CVE but some of these could be a valid vulnerabilities. Since non-valid CVE can be whitelisted, so treat '-' as all version and report all these CVE to capture possible vulnerabilities. Non-valid CVE to be whitelisted separately. [YOCTO #13617] (From OE-Core rev: 1d06fedf46c8f67fccde7a00d7199d7052c33b30) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c69ee3594079589d27c10db32bc288566ebde9ef) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/classes/cve-check.bbclass2
-rw-r--r--meta/recipes-core/meta/cve-update-db-native.bb2
2 files changed, 2 insertions, 2 deletions
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 01b3637469..0ab022b135 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -214,7 +214,7 @@ def check_cves(d, patched_cves):
214 (_, _, _, version_start, operator_start, version_end, operator_end) = row 214 (_, _, _, version_start, operator_start, version_end, operator_end) = row
215 #bb.debug(2, "Evaluating row " + str(row)) 215 #bb.debug(2, "Evaluating row " + str(row))
216 216
217 if (operator_start == '=' and pv == version_start): 217 if (operator_start == '=' and pv == version_start) or version_start == '-':
218 vulnerable = True 218 vulnerable = True
219 else: 219 else:
220 if operator_start: 220 if operator_start:
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
index 575254af40..1b4f31692b 100644
--- a/meta/recipes-core/meta/cve-update-db-native.bb
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -122,7 +122,7 @@ def parse_node_and_insert(c, node, cveId):
122 product = cpe23[4] 122 product = cpe23[4]
123 version = cpe23[5] 123 version = cpe23[5]
124 124
125 if version != '*': 125 if version != '*' and version != '-':
126 # Version is defined, this is a '=' match 126 # Version is defined, this is a '=' match
127 yield [cveId, vendor, product, version, '=', '', ''] 127 yield [cveId, vendor, product, version, '=', '', '']
128 else: 128 else: