diff options
Diffstat (limited to 'documentation/dev-manual/vulnerabilities.rst')
| -rw-r--r-- | documentation/dev-manual/vulnerabilities.rst | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/documentation/dev-manual/vulnerabilities.rst b/documentation/dev-manual/vulnerabilities.rst index f8dac5edc6..0ee3ec52c5 100644 --- a/documentation/dev-manual/vulnerabilities.rst +++ b/documentation/dev-manual/vulnerabilities.rst | |||
| @@ -27,8 +27,9 @@ patches to fix them, see ":ref:`dev-manual/changes:submitting a change to the yo | |||
| 27 | Vulnerability check at build time | 27 | Vulnerability check at build time |
| 28 | ================================= | 28 | ================================= |
| 29 | 29 | ||
| 30 | To enable a check for CVE security vulnerabilities using :ref:`cve-check <ref-classes-cve-check>` in the specific image | 30 | To enable a check for CVE security vulnerabilities using |
| 31 | or target you are building, add the following setting to your configuration:: | 31 | :ref:`ref-classes-cve-check` in the specific image or target you are building, |
| 32 | add the following setting to your configuration:: | ||
| 32 | 33 | ||
| 33 | INHERIT += "cve-check" | 34 | INHERIT += "cve-check" |
| 34 | 35 | ||
| @@ -100,7 +101,7 @@ It is also possible to check the CVE status of individual packages as follows:: | |||
| 100 | Fixing CVE product name and version mappings | 101 | Fixing CVE product name and version mappings |
| 101 | ============================================ | 102 | ============================================ |
| 102 | 103 | ||
| 103 | By default, :ref:`cve-check <ref-classes-cve-check>` uses the recipe name :term:`BPN` as CVE | 104 | By default, :ref:`ref-classes-cve-check` uses the recipe name :term:`BPN` as CVE |
| 104 | product name when querying the CVE database. If this mapping contains false positives, e.g. | 105 | product name when querying the CVE database. If this mapping contains false positives, e.g. |
| 105 | some reported CVEs are not for the software component in question, or false negatives like | 106 | some reported CVEs are not for the software component in question, or false negatives like |
| 106 | some CVEs are not found to impact the recipe when they should, then the problems can be | 107 | some CVEs are not found to impact the recipe when they should, then the problems can be |
| @@ -167,8 +168,7 @@ the :term:`CVE_CHECK_SKIP_RECIPE` variable. | |||
| 167 | Implementation details | 168 | Implementation details |
| 168 | ====================== | 169 | ====================== |
| 169 | 170 | ||
| 170 | Here's what the :ref:`cve-check <ref-classes-cve-check>` class does to | 171 | Here's what the :ref:`ref-classes-cve-check` class does to find unpatched CVE IDs. |
| 171 | find unpatched CVE IDs. | ||
| 172 | 172 | ||
| 173 | First the code goes through each patch file provided by a recipe. If a valid CVE ID | 173 | First the code goes through each patch file provided by a recipe. If a valid CVE ID |
| 174 | is found in the name of the file, the corresponding CVE is considered as patched. | 174 | is found in the name of the file, the corresponding CVE is considered as patched. |
