From 8af2f17a6fa8bf282c4c27054adbea1bf0873069 Mon Sep 17 00:00:00 2001 From: Andrej Valek Date: Wed, 26 Jul 2023 11:50:09 +0200 Subject: cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS - Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version Signed-off-by: Andrej Valek Signed-off-by: Khem Raj --- meta-oe/recipes-extended/libimobiledevice/libplist_2.3.0.bb | 4 +++- meta-oe/recipes-extended/libimobiledevice/libplist_git.bb | 4 +++- meta-oe/recipes-extended/libzip/libzip_1.10.0.bb | 3 --- meta-oe/recipes-extended/sanlock/sanlock_3.8.5.bb | 4 +--- meta-oe/recipes-extended/sblim-sfcb/sblim-sfcb_1.4.9.bb | 4 +--- 5 files changed, 8 insertions(+), 11 deletions(-) (limited to 'meta-oe/recipes-extended') diff --git a/meta-oe/recipes-extended/libimobiledevice/libplist_2.3.0.bb b/meta-oe/recipes-extended/libimobiledevice/libplist_2.3.0.bb index 1a74dc88f1..f636990f89 100644 --- a/meta-oe/recipes-extended/libimobiledevice/libplist_2.3.0.bb +++ b/meta-oe/recipes-extended/libimobiledevice/libplist_2.3.0.bb @@ -14,7 +14,9 @@ SRC_URI = "git://github.com/libimobiledevice/libplist;protocol=https;branch=mast S = "${WORKDIR}/git" PR = "r1" -CVE_CHECK_IGNORE += "\ +CVE_STATUS_GROUPS += "CVE_STATUS_LIBLIST" +CVE_STATUS_LIBLIST[status] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." +CVE_STATUS_LIBLIST = " \ CVE-2017-5834 \ CVE-2017-5835 \ CVE-2017-5836 \ diff --git a/meta-oe/recipes-extended/libimobiledevice/libplist_git.bb b/meta-oe/recipes-extended/libimobiledevice/libplist_git.bb index db092600bc..3a10b40f1f 100644 --- a/meta-oe/recipes-extended/libimobiledevice/libplist_git.bb +++ b/meta-oe/recipes-extended/libimobiledevice/libplist_git.bb @@ -15,7 +15,9 @@ SRC_URI = "git://github.com/libimobiledevice/libplist;protocol=https;branch=mast S = "${WORKDIR}/git" -CVE_CHECK_IGNORE += "\ +CVE_STATUS_GROUPS += "CVE_STATUS_LIBLIST" +CVE_STATUS_LIBLIST[status] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." +CVE_STATUS_LIBLIST = " \ CVE-2017-5834 \ CVE-2017-5835 \ CVE-2017-5836 \ diff --git a/meta-oe/recipes-extended/libzip/libzip_1.10.0.bb b/meta-oe/recipes-extended/libzip/libzip_1.10.0.bb index e8aa7fdc07..b500f26e25 100644 --- a/meta-oe/recipes-extended/libzip/libzip_1.10.0.bb +++ b/meta-oe/recipes-extended/libzip/libzip_1.10.0.bb @@ -23,7 +23,4 @@ SRC_URI = "https://libzip.org/download/libzip-${PV}.tar.xz" SRC_URI[sha256sum] = "cd2a7ac9f1fb5bfa6218272d9929955dc7237515bba6e14b5ad0e1d1e2212b43" -# Patch for CVE-2017-12858 is applied in version 1.2.0. -CVE_CHECK_IGNORE += "CVE-2017-12858" - BBCLASSEXTEND += "native" diff --git a/meta-oe/recipes-extended/sanlock/sanlock_3.8.5.bb b/meta-oe/recipes-extended/sanlock/sanlock_3.8.5.bb index c2a17d06b9..962d19574c 100644 --- a/meta-oe/recipes-extended/sanlock/sanlock_3.8.5.bb +++ b/meta-oe/recipes-extended/sanlock/sanlock_3.8.5.bb @@ -21,9 +21,7 @@ SRCREV = "b820c63093c4ae85d7da4f719cf3026d7fca5d09" S = "${WORKDIR}/git" -CVE_CHECK_IGNORE += "\ - CVE-2012-5638 \ -" +CVE_STATUS[CVE-2012-5638] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." DEPENDS = "libaio util-linux" diff --git a/meta-oe/recipes-extended/sblim-sfcb/sblim-sfcb_1.4.9.bb b/meta-oe/recipes-extended/sblim-sfcb/sblim-sfcb_1.4.9.bb index a52f3641dd..2a7cf2285e 100644 --- a/meta-oe/recipes-extended/sblim-sfcb/sblim-sfcb_1.4.9.bb +++ b/meta-oe/recipes-extended/sblim-sfcb/sblim-sfcb_1.4.9.bb @@ -34,9 +34,7 @@ SRC_URI = "http://downloads.sourceforge.net/sblim/${BP}.tar.bz2 \ SRC_URI[md5sum] = "28021cdabc73690a94f4f9d57254ce30" SRC_URI[sha256sum] = "634a67b2f7ac3b386a79160eb44413d618e33e4e7fc74ae68b0240484af149dd" -CVE_CHECK_IGNORE += "\ - CVE-2012-3381 \ -" +CVE_STATUS[CVE-2012-3381] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." inherit autotools inherit systemd -- cgit v1.2.3-54-g00ecf