Bug 8119

Summary: Define a format to mark Upstream CVE patches
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Aníbal Limón <anibal.limon>
Component: coreAssignee: Mariano Lopez <mariano.lopez>
Status: VERIFIED FIXED QA Contact: Daniel Istrate <daniel.alexandrux.istrate>
Severity: enhancement    
Priority: Medium+ CC: akuster, benjamin.esquivel, bogdanx.a.voiculescu, mariano.lopez, meta.mr.watcher, meta.watcher, richard.purdie
Version: 1.9   
Target Milestone: 2.1 M2   
Hardware: All   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Yes (doc changes required)
Bug Depends on:    
Bug Blocks: 7515    

Description Aníbal Limón 2015-08-06 20:17:00 UTC 
Now the patches to upstream sources don't say if this patch is a CVE.

We need to define a upstream patching format for mark patches that are CVE's.
to help to make track of CVE vulnerabilities into recipes.
Comment 1 Michael Halstead 2015-08-12 16:01:56 UTC 
Clearing 2.0 milestone
Comment 2 Ross Burton 2015-08-12 16:31:56 UTC 
Clear Linux (and the cve checking tool they use) simply states that CVE patches have "cve-XXXX-YYYY" in the filename somewhere.

We *could* go a step further and add a new metadata tag to the patch header alongside Upstream-Status, maybe just as simple as CVE: CVE-2015-1234.

From an impact to the repository point of view, adding a new tag is easier as it's just a matter of adding a single line to the file instead of renaming and updating recipes.
Comment 3 Benjamin Esquivel 2015-08-21 20:13:27 UTC 
Hey Ross, is this something like adding that tag in the [Tags] section of the commit?

------------------------
<commit title>

[commit message]

[Tags]

<Signature>
-----------------------
Comment 4 Armin Kuster 2015-11-12 00:23:49 UTC 
Upstream-Status: Security 

I would also have the CVSS score too. 

ie:
CVE: CVE-yyyy-xxxx
CVSS: (0 -10)

this info is can be used when creating release notes.
Comment 5 Mariano Lopez 2015-12-15 16:07:55 UTC 
I started a RFC thread in OE-core, OE-devel, so we get more input. Feel free to comment.

http://lists.openembedded.org/pipermail/openembedded-core/2015-December/114166.html

http://lists.openembedded.org/pipermail/openembedded-core/2015-December/114166.html
Comment 6 Mariano Lopez 2015-12-29 20:24:34 UTC 
Will wait after the holidays to reach a conclusion
Comment 7 Benjamin Esquivel 2016-01-04 18:31:34 UTC 
is today after the holidays? :)
Comment 8 Mariano Lopez 2016-01-04 18:35:25 UTC 
Very funny!

You can check the thread conclusion in: 

http://lists.openembedded.org/pipermail/openembedded-core/2016-January/114770.html

I will update the wiki to reflect this.
Comment 9 Mariano Lopez 2016-01-08 15:24:02 UTC 
The wiki has been updated to reflect this change:

http://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines#CVE_Patches

Now all the patches, that solve CVEs, must have the "CVE:" tag in header
Comment 10 Daniel Istrate 2016-02-16 16:12:16 UTC 
Verified: The wiki was indeed updated.