diff options
| author |   Lee Chee Yang <chee.yang.lee@intel.com> | 2021-03-04 22:44:06 +0800 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-03-20 18:50:05 +0000 |
| commit | 13cc68197f81bb7c76fa1abecc5dd720b8bdb8d5 (patch) | |
| tree | 6119976b0d4e874904f35626e6f229d8b1cf040b /meta/recipes-core | |
| parent | 93f0bf11ce2b950215a2de79a4ce928cd0b1b7b9 (diff) | |
| download | openembedded-core-13cc68197f81bb7c76fa1abecc5dd720b8bdb8d5.tar.gz | |
cve-update-db-native: consider version suffix when update CVE db
some record from NVD can merge or split suffix from version, for
example:
CVE-2017-15906
"cpe23Uri" : "cpe:2.3:a:openbsd:openssh:5.0:p1:*:*:*:*:*:*"
"cpe23Uri" : "cpe:2.3:a:openbsd:openssh:4.7p1:*:*:*:*:*:*:*"
in such case include the suffix into version when update local CVE db.
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-core')
| -rw-r--r-- | meta/recipes-core/meta/cve-update-db-native.bb | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb index cf62e1e32c..b3dc33734d 100644 --- a/meta/recipes-core/meta/cve-update-db-native.bb +++ b/meta/recipes-core/meta/cve-update-db-native.bb @@ -143,9 +143,14 @@ def parse_node_and_insert(c, node, cveId): product = cpe23[4] version = cpe23[5] + if cpe23[6] == '*' or cpe23[6] == '-': + version_suffix = "" + else: + version_suffix = "_" + cpe23[6] + if version != '*' and version != '-': # Version is defined, this is a '=' match - yield [cveId, vendor, product, version, '=', '', ''] + yield [cveId, vendor, product, version + version_suffix, '=', '', ''] elif version == '-': # no version information is available yield [cveId, vendor, product, version, '', '', ''] |