mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-07 16:59:22 +00:00
Code Issues Projects Releases Wiki Activity

cve-check: Manage CVE_PRODUCT with more than one name

Browse Source 
In some rare cases (eg. curl recipe) the CVE_PRODUCT contains more than
one name.

(From OE-Core rev: 7f62a20b32a3d42f04ec58786a7d0db68ef1bb05)

Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Pierre Le Magourou
2019-06-19 15:59:39 +02:00
committed by Richard Purdie
parent 05fb9db633
commit 95f0d11e21
1 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/classes/cve-check.bbclass
+14 -11
View File
@@ -168,9 +168,10 @@ def check_cves(d, patched_cves):
import ast, csv, tempfile, subprocess, io
cves_unpatched = []
bpn = d.getVar("CVE_PRODUCT")
# CVE_PRODUCT can contain more than one product (eg. curl/libcurl)
bpn = d.getVar("CVE_PRODUCT").split()
# If this has been unset then we're not scanning for CVEs here (for example, image recipes)
if not bpn:
if len(bpn) == 0:
return ([], [])
pv = d.getVar("CVE_VERSION").split("+git")[0]
cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST"))
@@ -184,16 +185,18 @@ def check_cves(d, patched_cves):
db_file = d.getVar("CVE_CHECK_DB_FILE")
conn = sqlite3.connect(db_file)
c = conn.cursor()
query = "SELECT * FROM PRODUCTS WHERE PRODUCT IS '%s' AND VERSION IS '%s';"
for row in c.execute(query % (bpn,pv)):
cve = row[1]
if pv in cve_whitelist.get(cve,[]):
bb.note("%s-%s has been whitelisted for %s" % (bpn, pv, cve))
elif cve in patched_cves:
bb.note("%s has been patched" % (cve))
else:
cves_unpatched.append(cve)
bb.debug(2, "%s-%s is not patched for %s" % (bpn, pv, cve))
for idx in range(len(bpn)):
for row in c.execute(query % (bpn[idx],pv)):
cve = row[1]
if pv in cve_whitelist.get(cve,[]):
bb.note("%s-%s has been whitelisted for %s" % (bpn[idx], pv, cve))
elif cve in patched_cves:
bb.note("%s has been patched" % (cve))
else:
cves_unpatched.append(cve)
bb.debug(2, "%s-%s is not patched for %s" % (bpn[idx], pv, cve))
conn.close()
return (list(patched_cves), cves_unpatched)