Bug 13617

Summary:	CVE version checking fails if the version is -
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Ross Burton <ross.burton>
Component:	devtools / tool chain	Assignee:	Chee Yang <chee.yang.lee>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Medium+	CC:	meta.mr.watcher, meta.watcher, randy.macleod, ross.burton
Version:	3.0
Target Milestone:	3.1 M4
Hardware:	x86
OS:	Multiple
Whiteboard:	cve-check.bbclass
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)

Description Ross Burton 2019-11-08 13:05:02 UTC

CPE version fields can be - to mean N/A, instead of * to mean ANY.

This trips up the version parsing, and e.g. falsely report that thermald 1.9 is not vulnerable to CVE-2014-2312 when it is.

Comment 1 Ross Burton 2019-11-08 13:06:19 UTC

The CPE for that example is:

 cpe:2.3:a:debian:thermald:-:*:*:*:*:*:*:*

Comment 2 Chee Yang 2020-03-30 09:30:21 UTC

is it mean version '-' should be treat as any/all version too?

the given example CVE updated with new CPE with version number specified.

but there are other CVE with version '-', example 

  https://nvd.nist.gov/vuln/detail/CVE-2018-16869  with CPE
  cpe:2.3:a:nettle_project:nettle:-:*:*:*:*:*:*:*

and 

  https://nvd.nist.gov/vuln/detail/CVE-2017-6386 with CPE
  cpe:2.3:a:virglrenderer_project:virglrenderer:-:*:*:*:*:*:*:*

Comment 3 Chee Yang 2020-04-02 06:13:20 UTC

http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=7c37e5c7cd4507c5d9e05de6e0d78cfb7e37ae9e
this should report all the CVe with no version info