Bug 14127

Summary: cve-check falsely indicates a vulnerabily to be patched
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Jere Viikari <jere.viikari>
Component: coreAssignee: Geoffrey Giry <geoffrey.giry>
Status: RESOLVED FIXED QA Contact:
Severity: major    
Priority: Medium+ CC: chee.yang.lee, geoffrey.giry, jere.viikari, meta.mr.watcher, meta.watcher, randy.macleod, ross.burton, sakib.sajal, tim.orling, yoann.congal
Version: 3.2   
Target Milestone: 4.2 M4   
Hardware: x86   
OS: arm64   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Jere Viikari 2020-11-16 20:28:04 UTC 
It seems cve-check does not understand operator OR in JSON file's nodes field.

Example CVE-2020-15778 which not fixed in OpenSSH release 8.3p1 (maybe never).

CVE-check output:

PACKAGE NAME: openssh
PACKAGE VERSION: 8.3p1
CVE: CVE-2020-15778
CVE STATUS: Patched
CVE SUMMARY: scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
CVSS v2 BASE SCORE: 6.8
CVSS v3 BASE SCORE: 7.8
VECTOR: NETWORK
MORE INFORMATION: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15778

$ wget https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2020.json.gz

    "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
          "versionEndExcluding" : "8.3"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:8.3:-:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:8.3:p1:*:*:*:*:*:*"
        } ]
      } ]

Non-existing version 8.3 is excluded but 8.3p1 is vulnerable.
Comment 1 Randy MacLeod 2022-04-21 15:17:16 UTC 
There may be a duplicate of this bug. Ross is going to check.
Comment 2 Ross Burton 2022-04-21 15:20:43 UTC 
Related to https://bugzilla.yoctoproject.org/show_bug.cgi?id=14630 as the CVE expression parser doesn't quite work right.
Comment 3 Geoffrey Giry 2023-03-07 10:37:07 UTC 
When querying the CVE db used by cve_check, we can see that the name of the version stored in db is not the official release name : 

$ sqlite3 downloads/CVE_CHECK/nvdcve_1.1.db .dump | grep CVE-2020-15778
INSERT INTO NVD VALUES('CVE-2020-15778','** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."','6.8','7.8','2023-02-24T19:43Z','NETWORK');
INSERT INTO PRODUCTS VALUES('CVE-2020-15778','openbsd','openssh','8.3_p1','=','','');
INSERT INTO PRODUCTS VALUES('CVE-2020-15778','openbsd','openssh','8.3','=','','');
INSERT INTO PRODUCTS VALUES('CVE-2020-15778','openbsd','openssh','','','8.3','<');

The database use the name 8.3_p1, cve_check use 8.3p1.

I will propose the following patch:

Modify cve_check to interpret _ in the version name from the DB correctly:
* removed for updates (_p*).
* replaced by - for release candidate (_rc*)