linux/poky.git/meta/classes/cve-check.bbclass, branch uninative-2.6

cve-check: Consider CVE that affects versions with less than operator

2019-06-20T12:14:21+00:00

In the NVD json CVE feed, affected versions can be strictly matched to a version, but they can also be matched with the operator '<='. Add a new condition in the sqlite query to match affected versions that are defined with the operator '<='. Then use LooseVersion to discard all versions that are not relevant. (From OE-Core rev: 3bf63bc60848d91e90c23f6d854d22b78832aa2d) Signed-off-by: Pierre Le Magourou Signed-off-by: Richard Purdie

cve-check: Manage CVE_PRODUCT with more than one name

2019-06-20T12:14:21+00:00

In some rare cases (eg. curl recipe) the CVE_PRODUCT contains more than one name. (From OE-Core rev: 7f62a20b32a3d42f04ec58786a7d0db68ef1bb05) Signed-off-by: Pierre Le Magourou Signed-off-by: Richard Purdie

cve-check: Remove dependency to cve-check-tool-native

2019-06-20T12:14:21+00:00

Use the new update-cve-db recipe to update database. (From OE-Core rev: bc144b028f6f51252f4359248f6921028bcb6780) Signed-off-by: Pierre Le Magourou Signed-off-by: Richard Purdie

cve-check: Allow multiple entries in CVE_PRODUCT

2018-10-29T17:01:45+00:00

There are both "curl" and "libcurl" CPEs in NVD. All "curl" CVEs are currently missing in the reports. Hence, switch "CVE_PRODUCT" to a space separated list. It is useful for recipes generating several packages, that have different product names in NVD. (From OE-Core rev: 404f75e026393ddc55da87f6f04fb1201cff4e11) Signed-off-by: Grygorii Tertychnyi Signed-off-by: Richard Purdie

cve-check.bbclass: do not download the CVE DB in package-specific tasks

2018-08-15T20:45:58+00:00

Disable downloading of the vulnerability DB in do_check_cves() task. When invoked in this task, cve-check-tool attempts re-download of the CVE DB if the latter is older than certain threshold. While reasonable for a stand-alone CVE checker, this behavior can cause errors in parallel builds if the build time is longer than this threshold: * Other tasks might be using the DB. * Several packages can start the download of the same file at the same time. This check is not really needed, as the DB has been downloaded by cve_check_tool:do_populate_cve_db() which is a prerequisite of any do_build(). The DB will be at most (threshold + build_time) old. (From OE-Core rev: 125789b6ee6d47ab84192230f63971c4e22418ba) Signed-off-by: Konstantin Shemyak Signed-off-by: Richard Purdie

cve-check.bbclass: detect CVE IDs listed on multiple lines

2018-05-15T09:56:49+00:00

Some backported patches fix multiple CVEs and list the corresponding identifiers on multiple lines, rather than on a single line. cve-check.bbclass yields false positive warnings when CVE IDs are presented on multiple lines because re.search() returns only the first match. An example of this behavior may be found when running do_cve_check() on the wpa-supplicant recipe while in the rocko branch. Only CVE-2017-13077 is reported to be patched by commit de57fd8, despite the patch including fixes for a total of 9 CVEs. This is resolved by iterating over all regular expression matches, rather than just the first. (From OE-Core rev: 8fb70ce2df66fc8404395ecbe66a75d0038f22dd) Signed-off-by: Jon Szymaniak Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check-tool: correctly exported web proxies

2018-02-24T10:31:46+00:00

The binary 'cve-check-update' downloads the CVE database from the Internet. If the system is behind a web proxy, the download fails, as proxy-related variables are not exported. In turn, 'cve-check-tool' does not connect to the network and correspondingly does not need exported proxies. Exported all proxy-related environment variables to 'cve-check-update' and removed the unneeded export from 'cve-check-tool'. (From OE-Core rev: 17db210975c740aff12732c511cf4fb32b507365) Signed-off-by: Konstantin Shemyak Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: short-circuit checking if CVE_PRODUCT isn't set

2018-02-16T18:05:40+00:00

For some recipes is is meaningless to do a CVE check, for example packagegroups or images. Check that CVE_PRODUCT is set and short-circuit the scan if it isn't. (From OE-Core rev: d1e7cb5c9e0d5d253b6bb5c968fa58944ea42d06) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: allow recipes to override their version

2018-02-16T18:05:40+00:00

For reasons which I don't understand, the Berkeley DB tarball is version 5.3.28 but in CVE reports the version is 11.2.5.3.28. To handle this allow recipes to override their version as well as their name. (From OE-Core rev: 36fbf96cf284acbc810ff3bf00702f1f82bc0da9) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: put log in T so it doesn't get deleted by rm_work

2018-02-16T18:05:40+00:00

This is where the other task logs go, so it's a sensible place to put it. (From OE-Core rev: 4bbb8cd5f3943231ab5be0448d1b0d4a08341249) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie