Bug 13687 - cve-check should distinguish between "Patched" and "Ignored"
Summary: cve-check should distinguish between "Patched" and "Ignored"
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: devtools / tool chain (show other bugs)
Version: unspecified
Hardware: All Multiple
: Medium enhancement
Target Milestone: 4.99
Assignee: Chee Yang
QA Contact:
URL:
Whiteboard: cve-check.bbclass
Depends on:
Blocks:
 
Reported: 2019-12-06 13:41 UTC by Adrian Bunk
Modified: 2020-03-19 06:23 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Yes (doc changes required)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Adrian Bunk 2019-12-06 13:41:17 UTC 
Sometimes CVE_CHECK_WHITELIST is needed for stating that a CVE is fixed.
Examples for this case are incorrect CPE data, or cases where an upstream stable branch is followed that contains the fix.

But there are also cases where a CVE is not patched but ignored, example:
PACKAGE NAME: procps
PACKAGE VERSION: 3.3.15
CVE: CVE-2018-1121
CVE STATUS: Patched

Another example for the latter would be CVE-2019-15847, which is a non-issue for a distribution supporting only ARM targets so can be ignored for such distributions.

These are two different cases, which need different syntax.