summaryrefslogtreecommitdiffstats
path: root/meta/classes/cve-check.bbclass
diff options
context:
space:
mode:
authorLee Chee Yang <chee.yang.lee@intel.com>2020-03-31 15:26:03 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-04-01 11:44:23 +0100
commit7c37e5c7cd4507c5d9e05de6e0d78cfb7e37ae9e (patch)
tree2d10fd8bf76946b5f0add864b666ffeca0c4888c /meta/classes/cve-check.bbclass
parent2d9a29a3cf87fb42c552067d2aa56d81cdaf99e4 (diff)
downloadpoky-7c37e5c7cd4507c5d9e05de6e0d78cfb7e37ae9e.tar.gz
cve-check: CPE version '-' as all version
CPE version could be '-' to mean no version info. Current cve_check treat it as not valid and does not report these CVE but some of these could be a valid vulnerabilities. Since non-valid CVE can be whitelisted, so treat '-' as all version and report all these CVE to capture possible vulnerabilities. Non-valid CVE to be whitelisted separately. [YOCTO #13617] (From OE-Core rev: c69ee3594079589d27c10db32bc288566ebde9ef) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/classes/cve-check.bbclass')
-rw-r--r--meta/classes/cve-check.bbclass2
1 files changed, 1 insertions, 1 deletions
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 5d84b93d71..2a530a0489 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -221,7 +221,7 @@ def check_cves(d, patched_cves):
221 (_, _, _, version_start, operator_start, version_end, operator_end) = row 221 (_, _, _, version_start, operator_start, version_end, operator_end) = row
222 #bb.debug(2, "Evaluating row " + str(row)) 222 #bb.debug(2, "Evaluating row " + str(row))
223 223
224 if (operator_start == '=' and pv == version_start): 224 if (operator_start == '=' and pv == version_start) or version_start == '-':
225 vulnerable = True 225 vulnerable = True
226 else: 226 else:
227 if operator_start: 227 if operator_start: