8119 2015-08-06 20:17:00 +0000 Define a format to mark Upstream CVE patches 2016-02-16 16:12:16 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 1.9 All Multiple VERIFIED FIXED Medium+ enhancement 2.1 M2 7515 1 anibal.limon mariano.lopez akuster benjamin.esquivel bogdanx.a.voiculescu mariano.lopez meta.mr.watcher meta.watcher richard.purdie daniel.alexandrux.istrate --- --- Yes (doc changes required) oldest_to_newest 52884 0 anibal.limon 2015-08-06 20:17:00 +0000 Now the patches to upstream sources don't say if this patch is a CVE. We need to define a upstream patching format for mark patches that are CVE's. to help to make track of CVE vulnerabilities into recipes. 53032 1 mhalstead 2015-08-12 16:01:56 +0000 Clearing 2.0 milestone 53043 2 ross.burton 2015-08-12 16:31:56 +0000 Clear Linux (and the cve checking tool they use) simply states that CVE patches have "cve-XXXX-YYYY" in the filename somewhere. We *could* go a step further and add a new metadata tag to the patch header alongside Upstream-Status, maybe just as simple as CVE: CVE-2015-1234. From an impact to the repository point of view, adding a new tag is easier as it's just a matter of adding a single line to the file instead of renaming and updating recipes. 53338 3 benjamin.esquivel 2015-08-21 20:13:27 +0000 Hey Ross, is this something like adding that tag in the [Tags] section of the commit? ------------------------ <commit title> [commit message] [Tags] <Signature> ----------------------- 56403 4 akuster 2015-11-12 00:23:49 +0000 Upstream-Status: Security I would also have the CVSS score too. ie: CVE: CVE-yyyy-xxxx CVSS: (0 -10) this info is can be used when creating release notes. 57279 5 mariano.lopez 2015-12-15 16:07:55 +0000 I started a RFC thread in OE-core, OE-devel, so we get more input. Feel free to comment. http://lists.openembedded.org/pipermail/openembedded-core/2015-December/114166.html http://lists.openembedded.org/pipermail/openembedded-core/2015-December/114166.html 57489 6 mariano.lopez 2015-12-29 20:24:34 +0000 Will wait after the holidays to reach a conclusion 57519 7 benjamin.esquivel 2016-01-04 18:31:34 +0000 is today after the holidays? :) 57520 8 mariano.lopez 2016-01-04 18:35:25 +0000 Very funny! You can check the thread conclusion in: http://lists.openembedded.org/pipermail/openembedded-core/2016-January/114770.html I will update the wiki to reflect this. 57681 9 mariano.lopez 2016-01-08 15:24:02 +0000 The wiki has been updated to reflect this change: http://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines#CVE_Patches Now all the patches, that solve CVEs, must have the "CVE:" tag in header 59112 10 daniel.alexandrux.istrate 2016-02-16 16:12:16 +0000 Verified: The wiki was indeed updated.