Bug 11808

Summary:	cve-check does not match previous SW versions
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	mikko.rapeli
Component:	Scripts and Tools	Assignee:	Ross Burton <ross.burton>
Status:	RESOLVED ReportedUpstream	QA Contact:
Severity:	minor
Priority:	Medium	CC:	poky.bs.watcher, poky.watcher, randy.macleod, ross.burton
Version:	2.4
Target Milestone:	2.5
Hardware:	All
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)

Description mikko.rapeli 2017-07-19 13:07:26 UTC

Hi,

Maybe this more of a FYI bug. Upstream cve-check-tool bug report is here:

https://github.com/clearlinux/cve-check-tool/issues/64

cve-check does not produce matches to CVE's which are marked to affect a certain SW version including previous versions. As in the example, systemd 232 is not marked to be vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2017-1000082 tough it is.

Hopefully upstream fixes this at some point.


The result is that lots of CVE vulnerabilities are not detected in yocto recipe versions.

Comment 1 Ross Burton 2017-07-31 16:38:05 UTC

Moving this to medium pending the resolution of bug 11183.

Comment 2 Ross Burton 2018-04-10 16:34:08 UTC

Marking as resolved / reported upstream as this is an upstream bug.  Yes, we know that cve-check-tool isn't great due to limitations in the database it uses.