Bug 11808 - cve-check does not match previous SW versions
Summary: cve-check does not match previous SW versions
Status: RESOLVED ReportedUpstream
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: Scripts and Tools (show other bugs)
Version: 2.4
Hardware: All Multiple
: Medium minor
Target Milestone: 2.5
Assignee: Ross Burton
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2017-07-19 13:07 UTC by mikko.rapeli
Modified: 2018-04-10 16:34 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description mikko.rapeli 2017-07-19 13:07:26 UTC 
Hi,

Maybe this more of a FYI bug. Upstream cve-check-tool bug report is here:

https://github.com/clearlinux/cve-check-tool/issues/64

cve-check does not produce matches to CVE's which are marked to affect a certain SW version including previous versions. As in the example, systemd 232 is not marked to be vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2017-1000082 tough it is.

Hopefully upstream fixes this at some point.


The result is that lots of CVE vulnerabilities are not detected in yocto recipe versions.
Comment 1 Ross Burton 2017-07-31 16:38:05 UTC 
Moving this to medium pending the resolution of bug 11183.
Comment 2 Ross Burton 2018-04-10 16:34:08 UTC 
Marking as resolved / reported upstream as this is an upstream bug.  Yes, we know that cve-check-tool isn't great due to limitations in the database it uses.