linux/poky.git/meta/classes/cve-check.bbclass, branch yocto-4.0.29

cve_check: Use a local copy of the database during builds

2024-11-11T14:19:18+00:00

Rtaher than trying to use a sqlite database over NFS from DL_DIR, work from a local copy in STAGING DIR after fetching. (From OE-Core rev: 9b6363994e5715f1d08b98956befd8915c128e85) Signed-off-by: Richard Purdie (cherry picked from commit 03596904392d257572a905a182b92c780d636744) Signed-off-by: Steve Sakoman

cve-check: add support for cvss v4.0

2024-11-02T13:32:36+00:00

https://nvd.nist.gov/general/news/cvss-v4-0-official-support CVSS v4.0 was released in November 2023 NVD announced support for it in June 2024 Current stats are: * cvss v4 provided, but also v3, so cve-check showed a value sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 != 0.0; 2069 * only cvss v4 provided, so cve-check did not show any sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 = 0.0; 260 (From OE-Core rev: 358dbfcd80ae1fa414d294c865dd293670c287f0) (From OE-Core rev: 8c20a7badb6e5d6c6c90176e45e90f776df25298) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

cve-check: add CVSS vector string to CVE database and reports

2024-11-02T13:32:36+00:00

This allows building detailed vulnerability analysis tools without relying on external resources. (From OE-Core rev: 048ff0ad927f4d37cc5547ebeba9e0c221687ea6) (From OE-Core rev: 3e47644d24d97c2541ccb70d91c144cf6530d5b0) Signed-off-by: Antoine Lubineau Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

cve-check: sort the package list in the JSON report

2023-11-14T16:49:11+00:00

The JSON report generated by the cve-check class is basically a huge list of packages. This list of packages is, however, unsorted. To make things easier for people comparing the JSON, or more specifically for git when archiving the JSON over time in a git repository, we can sort the list by package name. (From OE-Core rev: 1245649fd2725915154648a98584c908da07af18) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit e9861be0e5020830c2ecc24fd091f4f5b05da036) Signed-off-by: Steve Sakoman

cve-update-nvd2-native: new CVE database fetcher

2023-06-21T14:00:58+00:00

Add new fetcher for the NVD database using the 2.0 API [1]. The implementation changes as little as possible, keeping the current database format (but using a different database file for the transition period), with a notable exception of not using the META table. Minor changes that could be visible: - the database starts in 1999 instead of 2002 - the complete fetch is longer (30 minutes typically) [1] https://nvd.nist.gov/developers/vulnerabilities (From OE-Core rev: b8ae26aabe825c1bc8d84fd7e0ee197695f1dee7) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni (cherry picked from commit fb62c4c3dbca4e58f7ce6cf29d4b630a06411a97) Signed-off-by: Steve Sakoman

cve-check: Fix false negative version issue

2023-04-11T10:31:52+00:00

NVD DB store version and update in the same value, separated by '_'. The proposed patch check if the version from NVD DB contains a "_", ie 9.2.0_p1 is convert to 9.2.0p1 before version comparison. [YOCTO #14127] Reviewed-by: Yoann CONGAL (From OE-Core rev: f331c80df6c447d3073ebe3f00102c78ced242f3) Signed-off-by: Geoffrey GIRY Signed-off-by: Alexandre Belloni (cherry picked from commit 7d00f6ec578084a0a0e5caf36241d53036d996c4) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: write the cve manifest to IMGDEPLOYDIR

2023-01-26T23:37:05+00:00

When building an image cve_check_write_rootfs_manifest() would sometimes fail with a FileNotFoundError when writing the manifest.cve due to the parent directory (DEPLOY_DIR_IMAGE) not (yet) existing. The image task will provide the manifest in the deploy directory afterwards, so other recipes depending on the manifest being in DEPLOY_DIR_IMAGE should continue to function properly. (From OE-Core rev: 3e1ae171d89d0ac5487a8930bf6f8a97c43fdf57) Signed-off-by: Jermain Horsman Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 00fb2aae22ce0d7ff5f3f8766fa770eeb4e73483) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: close cursors as soon as possible

2022-09-12T07:41:47+00:00

We can have multiple processes reading the database at the same time, and cursors only release their locks when they're garbage collected. This might be the cause of random sqlite errors on the autobuilder, so explicitly close the cursors when we're done with them. (From OE-Core rev: 90917cadeb7201e56c74294e9156fe899d5455d7) Signed-off-by: Ross Burton Signed-off-by: Luca Ceresoli (cherry picked from commit 5d2e90e4a58217a943ec21140bc2ecdd4357a98a) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

classes: cve-check: Get shared database lock

2022-09-12T07:41:47+00:00

The CVE check database needs to have a shared lock acquired on it before it is accessed. This to prevent cve-update-db-native from deleting the database file out from underneath it. [YOCTO #14899] (From OE-Core rev: 655bc5acdebdee9b4dfd3c964104a84b6845b2d4) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie (cherry picked from commit 20a9911b73df62a0d0d1884e57085f13ac5016dd) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: hook cleanup to the BuildCompleted event, not CookerExit

2022-07-08T07:27:16+00:00

The cve-check class writes temporary files to preserve state across the build, and cleans them up in a CookerExit handler. However, in memory-resident builds the cooker won't exit in between builds, so the state isn't cleared and the CVE report generation fails: NOTE: Generating JSON CVE summary ERROR: Error adding the same package twice Easily solved by hooking to BuildCompleted, instead of CookerExit. (From OE-Core rev: 6f9c806dd1580a80856a687a2ad3a0b32d74dd17) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit fccdcfd301de281a427bfee48d8ff47fa07b7259) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie