14127 2020-11-16 20:28:04 +0000 cve-check falsely indicates a vulnerabily to be patched 2023-03-31 07:33:31 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 3.2 x86 arm64 RESOLVED FIXED Medium+ major 4.2 M4 1 jere.viikari geoffrey.giry chee.yang.lee geoffrey.giry jere.viikari meta.mr.watcher meta.watcher randy.macleod ross.burton sakib.sajal tim.orling yoann.congal --- --- No (bug/feature does not impact docs) oldest_to_newest 88613 0 jere.viikari 2020-11-16 20:28:04 +0000 It seems cve-check does not understand operator OR in JSON file's nodes field. Example CVE-2020-15778 which not fixed in OpenSSH release 8.3p1 (maybe never). CVE-check output: PACKAGE NAME: openssh PACKAGE VERSION: 8.3p1 CVE: CVE-2020-15778 CVE STATUS: Patched CVE SUMMARY: scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows." CVSS v2 BASE SCORE: 6.8 CVSS v3 BASE SCORE: 7.8 VECTOR: NETWORK MORE INFORMATION: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15778 $ wget https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2020.json.gz "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", "versionEndExcluding" : "8.3" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:8.3:-:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:8.3:p1:*:*:*:*:*:*" } ] } ] Non-existing version 8.3 is excluded but 8.3p1 is vulnerable. 93158 1 randy.macleod 2022-04-21 15:17:16 +0000 There may be a duplicate of this bug. Ross is going to check. 93159 2 ross.burton 2022-04-21 15:20:43 +0000 Related to https://bugzilla.yoctoproject.org/show_bug.cgi?id=14630 as the CVE expression parser doesn't quite work right. 95070 3 geoffrey.giry 2023-03-07 10:37:07 +0000 When querying the CVE db used by cve_check, we can see that the name of the version stored in db is not the official release name : $ sqlite3 downloads/CVE_CHECK/nvdcve_1.1.db .dump | grep CVE-2020-15778 INSERT INTO NVD VALUES('CVE-2020-15778','** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."','6.8','7.8','2023-02-24T19:43Z','NETWORK'); INSERT INTO PRODUCTS VALUES('CVE-2020-15778','openbsd','openssh','8.3_p1','=','',''); INSERT INTO PRODUCTS VALUES('CVE-2020-15778','openbsd','openssh','8.3','=','',''); INSERT INTO PRODUCTS VALUES('CVE-2020-15778','openbsd','openssh','','','8.3','<'); The database use the name 8.3_p1, cve_check use 8.3p1. I will propose the following patch: Modify cve_check to interpret _ in the version name from the DB correctly: * removed for updates (_p*). * replaced by - for release candidate (_rc*) 95250 4 geoffrey.giry 2023-03-31 07:33:31 +0000 Fixed by: https://git.yoctoproject.org/poky/commit/?id=81740facf458a5a3326c0cfca20ebf75d8fe91d0