Bug 8902 - Add "CVE:" tags to patches already in OE-core
Summary: Add "CVE:" tags to patches already in OE-core
Status: VERIFIED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: 2.0
Hardware: All Multiple
: Medium+ major
Target Milestone: 2.1 M2
Assignee: Mariano Lopez
QA Contact: Alexandru Roman
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2016-01-08 15:27 UTC by Mariano Lopez
Modified: 2016-01-18 14:58 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mariano Lopez 2016-01-08 15:27:44 UTC 
To easily identify the patches that solves CVEs, it was decided to add a tag in the metadata. Current patches in OE-core doesn't have this tag, it is necessary to tag these patches.
Comment 1 Ross Burton 2016-01-08 15:39:48 UTC 
My awesome tooling (github:rossburton/ross-tools, patchreview.py) is being updated right now and currently says this for oe-core:

Patches missing CVE: 35 (2%)

That's an estimate as it just looks for patches that have a CVE identifier in their content or filename, but that could be worse!
Comment 2 Mariano Lopez 2016-01-08 20:09:24 UTC 
Thanks Ross for the tool. I hack a little to try to find more CVE patches, but I couldn't find more.

Sent patch to the list with these 35 recipes.

http://lists.openembedded.org/pipermail/openembedded-core/2016-January/115127.html
Comment 3 Mariano Lopez 2016-01-14 17:10:47 UTC 
This has been solved with commit e5c011b041dc27cdfeb840b6933dcb9752886bb9:

http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=e5c011b041dc27cdfeb840b6933dcb9752886bb9
Comment 4 Alexandru Roman 2016-01-18 14:58:32 UTC 
Verified on master.