13617 2019-11-08 13:05:02 +0000 CVE version checking fails if the version is - 2020-04-02 06:13:20 +0000 1 1 7 Build System, Metadata & Runtime OE-Core devtools / tool chain 3.0 x86 Multiple RESOLVED FIXED cve-check.bbclass Medium+ normal 3.1 M4 1 ross.burton chee.yang.lee meta.mr.watcher meta.watcher randy.macleod ross.burton --- --- No (bug/feature does not impact docs) oldest_to_newest 85505 0 ross.burton 2019-11-08 13:05:02 +0000 CPE version fields can be - to mean N/A, instead of * to mean ANY. This trips up the version parsing, and e.g. falsely report that thermald 1.9 is not vulnerable to CVE-2014-2312 when it is. 85506 1 ross.burton 2019-11-08 13:06:19 +0000 The CPE for that example is: cpe:2.3:a:debian:thermald:-:*:*:*:*:*:*:* 86862 2 chee.yang.lee 2020-03-30 09:30:21 +0000 is it mean version '-' should be treat as any/all version too? the given example CVE updated with new CPE with version number specified. but there are other CVE with version '-', example https://nvd.nist.gov/vuln/detail/CVE-2018-16869 with CPE cpe:2.3:a:nettle_project:nettle:-:*:*:*:*:*:*:* and https://nvd.nist.gov/vuln/detail/CVE-2017-6386 with CPE cpe:2.3:a:virglrenderer_project:virglrenderer:-:*:*:*:*:*:*:* 86884 3 chee.yang.lee 2020-04-02 06:13:20 +0000 http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=7c37e5c7cd4507c5d9e05de6e0d78cfb7e37ae9e this should report all the CVe with no version info