11808 2017-07-19 13:07:26 +0000 cve-check does not match previous SW versions 2018-04-10 16:34:08 +0000 1 1 7 Build System, Metadata & Runtime OE-Core Scripts and Tools 2.4 All Multiple RESOLVED ReportedUpstream Medium minor 2.5 1 mikko.rapeli ross.burton poky.bs.watcher poky.watcher randy.macleod ross.burton --- --- No (bug/feature does not impact docs) oldest_to_newest 75129 0 mikko.rapeli 2017-07-19 13:07:26 +0000 Hi, Maybe this more of a FYI bug. Upstream cve-check-tool bug report is here: https://github.com/clearlinux/cve-check-tool/issues/64 cve-check does not produce matches to CVE's which are marked to affect a certain SW version including previous versions. As in the example, systemd 232 is not marked to be vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2017-1000082 tough it is. Hopefully upstream fixes this at some point. The result is that lots of CVE vulnerabilities are not detected in yocto recipe versions. 75504 1 ross.burton 2017-07-31 16:38:05 +0000 Moving this to medium pending the resolution of bug 11183. 80193 2 ross.burton 2018-04-10 16:34:08 +0000 Marking as resolved / reported upstream as this is an upstream bug. Yes, we know that cve-check-tool isn't great due to limitations in the database it uses.