15931 2025-07-09 20:33:57 +0000 CVE Reporting wrong CVSSv3 score 2026-08-20 12:34:58 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core unspecified All Multiple NEW NEWCOMER Medium major 6.1 1 prosper.van colinmca242 Archana.Polampalli ccasciato colinmca242 mathieu.dubois-briand meta.mr.watcher meta.watcher randy.macleod yoann.congal --- New (Never tested) Don't know oldest_to_newest 102441 0 prosper.van 2025-07-09 20:33:57 +0000 This is under the assumption that v3.1 score should take precedence over v3.0 For CVE-2018-16840 there is a v3.1 score of 9.8 and a v3.0 score of 4.3. I image that and v3.1 score should override v3.0 score. Otherwise add another field to capture both scores. CVE for curl { "id": "CVE-2018-16840", ..... "scorev2": "7.5", "scorev3": "4.3", "scorev4": "0.0", ..... "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-16840" }, Code in cve-update-nvd2-native.bb try: accessVector = accessVector or elt['cve']['metrics']['cvssMetricV30'][0]['cvssData']['attackVector'] vectorString = vectorString or elt['cve']['metrics']['cvssMetricV30'][0]['cvssData']['vectorString'] cvssv3 = elt['cve']['metrics']['cvssMetricV30'][0]['cvssData']['baseScore'] except KeyError: pass try: accessVector = accessVector or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['attackVector'] vectorString = vectorString or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['vectorString'] cvssv3 = cvssv3 or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['baseScore'] except KeyError: pass cvssv3 = cvssv3 or 0.0 102446 1 randy.macleod 2025-07-10 14:44:06 +0000 Hi Prosper, Can you send a patch to the oe-core list? https://docs.yoctoproject.org/contributor-guide/index.html Also, what systems from Fluke are using Yocto? 102653 2 randy.macleod 2025-08-21 14:56:41 +0000 Perhaps Archana would be willing to work on this but only if she has time and interest. 103860 3 colinmca242 2026-01-13 17:55:11 +0000 I have attempted to fix this issue by adding all CVSS score versions to the database and cve-check report. See the linked thread below. https://lists.openembedded.org/g/openembedded-core/topic/109850435#msg208046 IIRC there was some back and forth in the developers meeting because of some rework that Marta was adding for the CVE database fetcher recipes. I'd be happy to pick up my patch again and get it merged if that would be considered helpful. I think the big question is for the LTS versions, should the current score logic be left as-is to not break any compatibility issues, or should the logic be inverted to include the latest CVSS score version that exists for a given CVE? Regardless, I could also create a new key with an object or list containing all CVSS scores. 103943 4 yoann.congal 2026-01-16 10:26:04 +0000 Maybe related patch: [scarthgap] [PATCH] Fix CVE CVSS scoring to use maximum score from all sources https://lists.openembedded.org/g/openembedded-core/message/229229 103987 5 yoann.congal 2026-01-21 10:36:28 +0000 [PATCH v2] cve-update-nvd2-native: Use maximum CVSS score from all sources https://lists.openembedded.org/g/openembedded-core/topic/patch_v2/117379016 This patch points here but this may be subtly different: * This bug is about aggregating CVSS score from different version * The patch is about aggregating CVSS scores from multiple disagreeing sources. 104002 6 colinmca242 2026-01-21 14:57:43 +0000 I'd personally really like cve-check to include all CVSS version vector strings and scores, not just the maximum. I think at that point users of the cve-check output can be fully informed with all score data and determine which they should use. As it's currently implemented, I don't really use any of the CVSS score or vector information included by CVE check and instead use post-processing tooling to enrich the cve-check output with all available CVSS data from NVD. 104014 7 randy.macleod 2026-01-21 21:26:38 +0000 Colin, Did you really intend to move the defect milestone to "Future"? If so, maybe we should move it to 6.0, unassigned. Note that I'm not following the bug discussion closely since I'm allergic to CVEs! ;-) 106569 8 mathieu.dubois-briand 2026-08-20 12:34:58 +0000 (In reply to Yoann Congal from comment #5) > [PATCH v2] cve-update-nvd2-native: Use maximum CVSS score from all sources > https://lists.openembedded.org/g/openembedded-core/topic/patch_v2/117379016 > > This patch points here but this may be subtly different: > * This bug is about aggregating CVSS score from different version > * The patch is about aggregating CVSS scores from multiple disagreeing > sources. This patch got merged, but above comment about differences still applies. https://git.openembedded.org/openembedded-core/commit/?id=4f6192f3165de0bc2499e045607c7e7ffd878a4b