Bug 13617 - CVE version checking fails if the version is -
Summary: CVE version checking fails if the version is -
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: devtools / tool chain (show other bugs)
Version: 3.0
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 3.1 M4
Assignee: Chee Yang
QA Contact:
URL:
Whiteboard: cve-check.bbclass
Depends on:
Blocks:
 
Reported: 2019-11-08 13:05 UTC by Ross Burton
Modified: 2020-04-02 06:13 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ross Burton 2019-11-08 13:05:02 UTC 
CPE version fields can be - to mean N/A, instead of * to mean ANY.

This trips up the version parsing, and e.g. falsely report that thermald 1.9 is not vulnerable to CVE-2014-2312 when it is.
Comment 1 Ross Burton 2019-11-08 13:06:19 UTC 
The CPE for that example is:

 cpe:2.3:a:debian:thermald:-:*:*:*:*:*:*:*
Comment 2 Chee Yang 2020-03-30 09:30:21 UTC 
is it mean version '-' should be treat as any/all version too?

the given example CVE updated with new CPE with version number specified.

but there are other CVE with version '-', example 

  https://nvd.nist.gov/vuln/detail/CVE-2018-16869  with CPE
  cpe:2.3:a:nettle_project:nettle:-:*:*:*:*:*:*:*

and 

  https://nvd.nist.gov/vuln/detail/CVE-2017-6386 with CPE
  cpe:2.3:a:virglrenderer_project:virglrenderer:-:*:*:*:*:*:*:*
Comment 3 Chee Yang 2020-04-02 06:13:20 UTC 
http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=7c37e5c7cd4507c5d9e05de6e0d78cfb7e37ae9e
this should report all the CVe with no version info