mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-07-26 07:37:14 +00:00
Code Issues Projects Releases Wiki Activity

cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS

Browse Source 
- Try to add convert and apply statuses for old CVEs
- Drop some obsolete ignores, while they are not relevant for current
  version

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Andrej Valek
2023-07-26 11:50:09 +02:00
committed by Khem Raj
parent 4c201ede93
commit 8af2f17a6f
33 changed files with 60 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-protocols/mdns/mdns_1790.80.10.bb
+10 -12
View File
@@ -46,18 +46,16 @@ PACKAGECONFIG[tls] = ",tls=no,mbedtls"
CVE_PRODUCT = "apple:mdnsresponder"
# CVE-2007-0613 is not applicable as it only affects Apple products
# i.e. ichat,mdnsresponder, instant message framework and MacOS.
# Also, https://www.exploit-db.com/exploits/3230 shows the part of code
# affected by CVE-2007-0613 which is not preset in upstream source code.
# Hence, CVE-2007-0613 does not affect other Yocto implementations and
# is not reported for other distros can be marked whitelisted.
# Links:
# https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613
# https://www.incibe-cert.es/en/early-warning/vulnerabilities/cve-2007-0613
# https://security-tracker.debian.org/tracker/CVE-2007-0613
# https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613
CVE_CHECK_IGNORE += "CVE-2007-0613"
CVE_STATUS[CVE-2007-0613] = "not-applicable-platform: Issue affects Apple products \
i.e. ichat,mdnsresponder, instant message framework and MacOS. Also, \
https://www.exploit-db.com/exploits/3230 shows the part of code \
affected by CVE-2007-0613 which is not preset in upstream source code. \
Hence, CVE-2007-0613 does not affect other Yocto implementations and \
is not reported for other distros can be marked whitelisted. \
Links: https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613 \
https://www.incibe-cert.es/en/early-warning/vulnerabilities/cve-2007-0613 \
https://security-tracker.debian.org/tracker/CVE-2007-0613 \
https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613"
PARALLEL_MAKE = ""
meta-networking/recipes-protocols/openflow/openflow.inc
+4 -8
View File
@@ -13,10 +13,10 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=e870c934e2c3d6ccf085fd7cf0a1e2e2"
SRC_URI = "git://gitosis.stanford.edu/openflow.git;protocol=git;branch=master"
CVE_CHECK_IGNORE = "\
CVE-2015-1611 \
CVE-2015-1612 \
"
CVE_STATUS[CVE-2015-1611] = "not-applicable-config: Not referred to our implementation of openflow"
CVE_STATUS[CVE-2015-1612] = "not-applicable-config: Not referred to our implementation of openflow"
CVE_STATUS[CVE-2018-1078] = "cpe-incorrect: This CVE is not for this product but cve-check assumes it is \
because two CPE collides when checking the NVD database"
DEPENDS = "virtual/libc"
@@ -58,7 +58,3 @@ do_install:append() {
}
FILES:${PN} += "${nonarch_libdir}/tmpfiles.d"
# This CVE is not for this product but cve-check assumes it is
# because two CPE collides when checking the NVD database
CVE_CHECK_IGNORE = "CVE-2018-1078"