summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorLee Chee Yang <chee.yang.lee@intel.com>2021-03-04 22:44:06 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2021-03-28 22:31:47 +0100
commitdaf52f58e3b03db71030ee30d2c836163f2a057d (patch)
tree6c2f6d0159615eef1e3a54e0e3bcf86c28795743 /meta
parent1514b088ece0d3d58b5c265dbf307b03f130c816 (diff)
downloadpoky-daf52f58e3b03db71030ee30d2c836163f2a057d.tar.gz
cve-update-db-native: consider version suffix when update CVE db
some record from NVD can merge or split suffix from version, for example: CVE-2017-15906 "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:5.0:p1:*:*:*:*:*:*" "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:4.7p1:*:*:*:*:*:*:*" in such case include the suffix into version when update local CVE db. (From OE-Core rev: b8d3e1754faea3ba0b6e07d5a830fbab12b5f53d) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 13cc68197f81bb7c76fa1abecc5dd720b8bdb8d5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-core/meta/cve-update-db-native.bb7
1 files changed, 6 insertions, 1 deletions
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
index 9e8e006a32..5d9fb59cbc 100644
--- a/meta/recipes-core/meta/cve-update-db-native.bb
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -137,9 +137,14 @@ def parse_node_and_insert(c, node, cveId):
137 product = cpe23[4] 137 product = cpe23[4]
138 version = cpe23[5] 138 version = cpe23[5]
139 139
140 if cpe23[6] == '*' or cpe23[6] == '-':
141 version_suffix = ""
142 else:
143 version_suffix = "_" + cpe23[6]
144
140 if version != '*' and version != '-': 145 if version != '*' and version != '-':
141 # Version is defined, this is a '=' match 146 # Version is defined, this is a '=' match
142 yield [cveId, vendor, product, version, '=', '', ''] 147 yield [cveId, vendor, product, version + version_suffix, '=', '', '']
143 elif version == '-': 148 elif version == '-':
144 # no version information is available 149 # no version information is available
145 yield [cveId, vendor, product, version, '', '', ''] 150 yield [cveId, vendor, product, version, '', '', '']