Bug 13687

Summary: cve-check should distinguish between "Patched" and "Ignored"
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Adrian Bunk <bunk>
Component: devtools / tool chainAssignee: Chee Yang <chee.yang.lee>
Status: RESOLVED FIXED QA Contact:
Severity: enhancement    
Priority: Medium CC: chee.yang.lee, meta.mr.watcher, meta.watcher, ross.burton
Version: unspecified   
Target Milestone: 4.99   
Hardware: All   
OS: Multiple   
Whiteboard: cve-check.bbclass
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Yes (doc changes required)

Description Adrian Bunk 2019-12-06 13:41:17 UTC 
Sometimes CVE_CHECK_WHITELIST is needed for stating that a CVE is fixed.
Examples for this case are incorrect CPE data, or cases where an upstream stable branch is followed that contains the fix.

But there are also cases where a CVE is not patched but ignored, example:
PACKAGE NAME: procps
PACKAGE VERSION: 3.3.15
CVE: CVE-2018-1121
CVE STATUS: Patched

Another example for the latter would be CVE-2019-15847, which is a non-issue for a distribution supporting only ARM targets so can be ignored for such distributions.

These are two different cases, which need different syntax.