Bug 15317

Summary: Imported CVEs aren't Historical
Product: [Yocto Project Subprojects] Security Response Tool Reporter: Marta Rybczynska <rybczynska>
Component: GeneralAssignee: David Reyna <david.reyna>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium+    
Version: unspecified   
Target Milestone: 5.0 M1   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Marta Rybczynska 2023-12-11 13:24:28 UTC
In SRtool fe396799b2d2a7572b428868152c17dbac6781b6 freshly imported ancient CVEs aren't historical. They are all in 'New' state.
Comment 1 David Reyna 2023-12-12 00:39:06 UTC
Feature added. I will consider making the 'historical' data the default for new installs.

Use the "--test" flag for dry runs.

Usage:
Convert all new CVEs:
  $ ./bin/cve_checker/srtool_cvechecker.py --new-to-historical all

Convert new CVEs prior to a given Published date:
  $ ./bin/cve_checker/srtool_cvechecker.py --new-to-historical 2023-12-01

Example run:

$ ./bin/cve_checker/srtool_cvechecker.py --new-to-historical 2023-12-01 
 Results
Year        Found Changed    Kept
CVE-1999:     118     118       0
CVE-2000:     170     170       0
CVE-2001:      49      49       0
CVE-2002:      95      95       0
CVE-2003:      85      85       0
CVE-2004:     136     136       0
CVE-2005:     266     266       0
CVE-2006:     418     418       0
CVE-2007:     365     365       0
CVE-2008:     346     346       0
CVE-2009:     373     373       0
CVE-2010:    5216    5216       0
CVE-2011:    4859    4859       0
CVE-2012:    5890    5890       0
CVE-2013:    6779    6779       0
CVE-2014:    8976    8976       0
CVE-2015:    8738    8738       0
CVE-2016:   10544   10544       0
CVE-2017:   16977   16977       0
CVE-2018:   17342   17341       1
CVE-2019:   16968   16968       0
CVE-2020:   20410   20408       2
CVE-2021:   21989   21987       2
CVE-2022:   24425   24416       9
CVE-2023:   21866   21137     729
CVE-2024:       2       2       0
$ ./bin/cve_checker/srtool_cvechecker.py --new-to-historical 2023-12-01 

 Results
Year        Found Changed    Kept
CVE-2018:       1       0       1
CVE-2020:       2       0       2
CVE-2021:       2       0       2
CVE-2022:       9       0       9
CVE-2023:     729       0     729
$
Comment 2 David Reyna 2023-12-12 00:42:14 UTC
729 new CVEs for 2023 in 11 days!