Bug 15317 - Imported CVEs aren't Historical
Summary: Imported CVEs aren't Historical
Status: RESOLVED FIXED
Alias: None
Product: Security Response Tool
Classification: Yocto Project Subprojects
Component: General (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 5.0 M1
Assignee: David Reyna
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2023-12-11 13:24 UTC by Marta Rybczynska
Modified: 2023-12-12 00:42 UTC (History)
0 users

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marta Rybczynska 2023-12-11 13:24:28 UTC 
In SRtool fe396799b2d2a7572b428868152c17dbac6781b6 freshly imported ancient CVEs aren't historical. They are all in 'New' state.
Comment 1 David Reyna 2023-12-12 00:39:06 UTC 
Feature added. I will consider making the 'historical' data the default for new installs.

Use the "--test" flag for dry runs.

Usage:
Convert all new CVEs:
  $ ./bin/cve_checker/srtool_cvechecker.py --new-to-historical all

Convert new CVEs prior to a given Published date:
  $ ./bin/cve_checker/srtool_cvechecker.py --new-to-historical 2023-12-01

Example run:

$ ./bin/cve_checker/srtool_cvechecker.py --new-to-historical 2023-12-01 
 Results
Year        Found Changed    Kept
CVE-1999:     118     118       0
CVE-2000:     170     170       0
CVE-2001:      49      49       0
CVE-2002:      95      95       0
CVE-2003:      85      85       0
CVE-2004:     136     136       0
CVE-2005:     266     266       0
CVE-2006:     418     418       0
CVE-2007:     365     365       0
CVE-2008:     346     346       0
CVE-2009:     373     373       0
CVE-2010:    5216    5216       0
CVE-2011:    4859    4859       0
CVE-2012:    5890    5890       0
CVE-2013:    6779    6779       0
CVE-2014:    8976    8976       0
CVE-2015:    8738    8738       0
CVE-2016:   10544   10544       0
CVE-2017:   16977   16977       0
CVE-2018:   17342   17341       1
CVE-2019:   16968   16968       0
CVE-2020:   20410   20408       2
CVE-2021:   21989   21987       2
CVE-2022:   24425   24416       9
CVE-2023:   21866   21137     729
CVE-2024:       2       2       0
$ ./bin/cve_checker/srtool_cvechecker.py --new-to-historical 2023-12-01 

 Results
Year        Found Changed    Kept
CVE-2018:       1       0       1
CVE-2020:       2       0       2
CVE-2021:       2       0       2
CVE-2022:       9       0       9
CVE-2023:     729       0     729
$
Comment 2 David Reyna 2023-12-12 00:42:14 UTC 
729 new CVEs for 2023 in 11 days!