diff options
| author |   Lee Chee Yang <chee.yang.lee@intel.com> | 2020-03-31 15:26:03 +0800 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-03-31 21:52:26 +0100 |
| commit | c69ee3594079589d27c10db32bc288566ebde9ef (patch) | |
| tree | 7752e72e554f0d0129cb952ff0472200e62c4441 | |
| parent | 3937ca9e2dfabb1ce9bce1d536b60b1e2a43739b (diff) | |
| download | openembedded-core-contrib-c69ee3594079589d27c10db32bc288566ebde9ef.tar.gz | |
cve-check: CPE version '-' as all version
CPE version could be '-' to mean no version info.
Current cve_check treat it as not valid and does not report these
CVE but some of these could be a valid vulnerabilities.
Since non-valid CVE can be whitelisted, so treat '-' as all version
and report all these CVE to capture possible vulnerabilities.
Non-valid CVE to be whitelisted separately.
[YOCTO #13617]
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
| -rw-r--r-- | meta/classes/cve-check.bbclass | 2 | ||||
| -rw-r--r-- | meta/recipes-core/meta/cve-update-db-native.bb | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass index 5d84b93d71..2a530a0489 100644 --- a/meta/classes/cve-check.bbclass +++ b/meta/classes/cve-check.bbclass @@ -221,7 +221,7 @@ def check_cves(d, patched_cves): (_, _, _, version_start, operator_start, version_end, operator_end) = row #bb.debug(2, "Evaluating row " + str(row)) - if (operator_start == '=' and pv == version_start): + if (operator_start == '=' and pv == version_start) or version_start == '-': vulnerable = True else: if operator_start: diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb index 6afe09140b..497d957d65 100644 --- a/meta/recipes-core/meta/cve-update-db-native.bb +++ b/meta/recipes-core/meta/cve-update-db-native.bb @@ -135,7 +135,7 @@ def parse_node_and_insert(c, node, cveId): product = cpe23[4] version = cpe23[5] - if version != '*': + if version != '*' and version != '-': # Version is defined, this is a '=' match yield [cveId, vendor, product, version, '=', '', ''] else: |