From c91b04679f8bee04b3e41697c6d823fb4a68dec8 Mon Sep 17 00:00:00 2001 From: Michael Opdenacker Date: Mon, 6 Jun 2022 17:58:29 +0200 Subject: [PATCH] dev-manual: mention the new CVE patch metrics page (From yocto-docs rev: 42bfcb2d3a13e71264e5f29b07615c2da9866273) Signed-off-by: Michael Opdenacker Reviewed-by: Quentin Schulz Signed-off-by: Richard Purdie --- documentation/dev-manual/common-tasks.rst | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/documentation/dev-manual/common-tasks.rst b/documentation/dev-manual/common-tasks.rst index ca6d594386..d7f0b263e7 100644 --- a/documentation/dev-manual/common-tasks.rst +++ b/documentation/dev-manual/common-tasks.rst @@ -11507,8 +11507,15 @@ known security vulnerabilities, as tracked by the public `Common Vulnerabilities and Exposures (CVE) `__ database. -To know which packages are vulnerable to known security vulnerabilities, -add the following setting to your configuration:: +The Yocto Project maintains a `list of known vulnerabilities +`__ +for packages in Poky and OE-Core, tracking the evolution of the number of +unpatched CVEs and the status of patches. Such information is available for +the current development version and for each supported release. + +To know which packages are vulnerable to known security vulnerabilities +in the specific image you are building, add the following setting to your +configuration:: INHERIT += "cve-check"