linux/poky.git/meta/classes/cve-check.bbclass, branch master-next

cve-update: Keep mtime stamp in the database itself

2025-11-07T13:15:35+00:00

This should help to avoid problems that will occur if the modification time of database file itself is altered e.g. by unassociated process(es) on the file system which hosts the database file. Since this change updates the database structure by adding a new table, bump the 'minor' version number in database file names to enforce full database fetch. This should also iron out e.g. situation where the database might have inconspicuously omitted entries due to way in which the mtime of database file itself was relied upon. (From OE-Core rev: 740b66cc7a4784b2f85f3a6a7cf8c21b7ba5db77) Signed-off-by: Niko Mauno Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

cve-update: Drop obsolete NVD1 support

2025-11-07T13:15:35+00:00

Since enabling NVD1 as NVD_DB_VERSION nowadays leads to BitBake failure WARNING: cve-update-db-native-1.0-r0 do_fetch: Failed to fetch CVE data (HTTP Error 403: Forbidden) WARNING: cve-update-db-native-1.0-r0 do_fetch: Host IPs are 172.65.90.26, 172.65.90.25, 172.65.90.24, 172.65.90.27, 2606:4700:78::90:0:180, 2606:4700:78::90:0:183, 2606:4700:78::90:0:181, 2606:4700:78::90:0:182 WARNING: cve-update-db-native-1.0-r0 do_fetch: CVE database update failed ERROR: cve-update-db-native-1.0-r0 do_unpack: Error executing a python function in exec_func_python() autogenerated: Remove the support for obsolete NVD1. (From OE-Core rev: 9cd19f0dc1629086ab1dd18d969e0b4e9acac3ea) Signed-off-by: Niko Mauno Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

cve-check: fix debug message

2025-05-01T13:22:54+00:00

Debug level was not added as a parameter, causing a warning. (From OE-Core rev: 40157fcbd9066f261812ba665ec963b2e496aa53) Signed-off-by: Daniel Turull Signed-off-by: Richard Purdie

cve-check: extract extending CVE_STATUS to library function

2025-04-24T10:27:06+00:00

The same code for extending CVE_STATUS by CVE_CHECK_IGNORE and CVE_STATUS_GROUPS is used on multiple places. Create a library funtion to have the code on single place and ready for reuse by additional classes. (From OE-Core rev: 45e18f4270d084d81c21b1e5a4a601ce975d8a77) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

cve-check: change the default feed

2025-03-19T10:07:30+00:00

Move to the FKIE feed by default, as it is showing better stability than NVD2. Content of the feed should be the same. (From OE-Core rev: 10580a6d36aa1366732f9c030345bd4590eb9f74) Signed-off-by: Marta Rybczynska Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

cve-check.bbclass: Mitigate symlink related error

2025-02-18T12:04:03+00:00

According to Yocto reference manual, in description of the IMAGE_LINK_NAME variable, it is said that It is possible to set this to "" to disable symlink creation, however, you also need to set :term:`IMAGE_NAME` to still have a reasonable value e.g.:: IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" However, when using following additions in local.conf file: INHERIT += "cve-check" IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" the implicit symlink creation in cve_check_write_rootfs_manifest leads to following build failure $ bitbake core-image-minimal core-image-base ... ERROR: core-image-base-1.0-r0 do_image_complete: Recipe core-image-base is trying to install files into a shared area when those files already exist. The files and the manifests listing them are: /home/poky/build/tmp/deploy/images/qemux86-64/.json (matched in manifest-qemux86_64-core-image-minimal.image_complete) Please adjust the recipes so only one recipe provides a given file. Mitigate the issue by creating the symlink only in case IMAGE_LINK_NAME has not been set to empty string. (From OE-Core rev: 64bfec359bd909761ce0a6a716286d938ed162d1) Signed-off-by: Niko Mauno Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

cve-check: allow feed choice

2025-02-18T11:56:04+00:00

Allow choice of one of three feeds and update task dependencies accordingly. All feeds contain data from NVD and are stored in different files. Set the NVD_DB_VERSION variable to choose feed: NVD2 (default) - the NVD feed with API version 2 NVD1 - the NVD JSON feed (deprecated) FKIE - the FKIE-CAD feed reconstruction In case of malformed database feed name, we default to NVD2 and show an error. (From OE-Core rev: f265812bfb6797aee10e7be42865736c9ff3478f) Signed-off-by: Marta Rybczynska Signed-off-by: Richard Purdie

cve-check: fix cvesInRecord

2024-11-28T12:27:12+00:00

Currently flag cvesInRecord is set to false if all CVEs are ignored or patched. This is inconsistent as it shows false if a CVE was fixed via patch and true if this CVE was fixed by upgrade. In both cases the CVE is valid and was fixed. As I understand this flag, it should say if any CVE exists for particular component's product (regardless of how this CVE is handled) and can be used to validate if a product is correctly set. Note that skipping ignored CVEs may make sense in some cases, as ignored may mean that NVD DB is wrong, but in many cases it is ignored for other reasons. Further patch can be done to evaluate ignore subtype but that would be against my understanding of this flag as described above. (From OE-Core rev: c5d499693672ec9619392011b765941cf94aa319) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

cve-check: restore CVE_CHECK_SHOW_WARNINGS functionality

2024-11-28T12:27:12+00:00

Commit 05ef4f2a7b225c8d230eaca8d333ffb921729d79 removed this functionality by accident. It was implemented in text exporter, while it should have been a global feature independent on exporter type to avoid such accidental deletion. (From OE-Core rev: 2996b11596afca288a6b7f409a5287063d331f3b) Signed-off-by: Peter Marko Cc: Marta Rybczynska Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

cve-check: add support for cvss v4.0

2024-10-25T14:25:33+00:00

https://nvd.nist.gov/general/news/cvss-v4-0-official-support CVSS v4.0 was released in November 2023 NVD announced support for it in June 2024 Current stats are: * cvss v4 provided, but also v3, so cve-check showed a value sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 != 0.0; 2069 * only cvss v4 provided, so cve-check did not show any sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 = 0.0; 260 (From OE-Core rev: 358dbfcd80ae1fa414d294c865dd293670c287f0) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie