8902 2016-01-08 15:27:44 +0000 Add "CVE:" tags to patches already in OE-core 2016-01-18 14:58:32 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 2.0 All Multiple VERIFIED FIXED Medium+ major 2.1 M2 1 mariano.lopez mariano.lopez bogdanx.a.voiculescu meta.mr.watcher meta.watcher ross.burton alexandru.costinx.roman --- --- No (bug/feature does not impact docs) oldest_to_newest 57682 0 mariano.lopez 2016-01-08 15:27:44 +0000 To easily identify the patches that solves CVEs, it was decided to add a tag in the metadata. Current patches in OE-core doesn't have this tag, it is necessary to tag these patches. 57684 1 ross.burton 2016-01-08 15:39:48 +0000 My awesome tooling (github:rossburton/ross-tools, patchreview.py) is being updated right now and currently says this for oe-core: Patches missing CVE: 35 (2%) That's an estimate as it just looks for patches that have a CVE identifier in their content or filename, but that could be worse! 57692 2 mariano.lopez 2016-01-08 20:09:24 +0000 Thanks Ross for the tool. I hack a little to try to find more CVE patches, but I couldn't find more. Sent patch to the list with these 35 recipes. http://lists.openembedded.org/pipermail/openembedded-core/2016-January/115127.html 57829 3 mariano.lopez 2016-01-14 17:10:47 +0000 This has been solved with commit e5c011b041dc27cdfeb840b6933dcb9752886bb9: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=e5c011b041dc27cdfeb840b6933dcb9752886bb9 57919 4 alexandru.costinx.roman 2016-01-18 14:58:32 +0000 Verified on master.