13687 2019-12-06 13:41:17 +0000 cve-check should distinguish between "Patched" and "Ignored" 2020-03-19 06:23:45 +0000 1 1 7 Build System, Metadata & Runtime OE-Core devtools / tool chain unspecified All Multiple RESOLVED FIXED cve-check.bbclass Medium enhancement 4.99 1 bunk chee.yang.lee chee.yang.lee meta.mr.watcher meta.watcher ross.burton --- --- Yes (doc changes required) oldest_to_newest 85757 0 bunk 2019-12-06 13:41:17 +0000 Sometimes CVE_CHECK_WHITELIST is needed for stating that a CVE is fixed. Examples for this case are incorrect CPE data, or cases where an upstream stable branch is followed that contains the fix. But there are also cases where a CVE is not patched but ignored, example: PACKAGE NAME: procps PACKAGE VERSION: 3.3.15 CVE: CVE-2018-1121 CVE STATUS: Patched Another example for the latter would be CVE-2019-15847, which is a non-issue for a distribution supporting only ARM targets so can be ignored for such distributions. These are two different cases, which need different syntax. 86723 1 chee.yang.lee 2020-03-16 08:29:54 +0000 these should works https://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/meta/classes?id=932ac04cb843a42fa174cd412ae24b2f9eda8eaf https://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/meta/classes?id=e753b71b392381315ce730186eb020c33fbf828b