aboutsummaryrefslogtreecommitdiff
path: root/support
diff options
context:
space:
mode:
authorGravatar Thomas Petazzoni <thomas.petazzoni@bootlin.com>2020-11-04 15:51:35 +0100
committerGravatar Thomas Petazzoni <thomas.petazzoni@bootlin.com>2020-11-26 16:31:37 +0100
commit1ff7f003e1cfc02241aef8f35429462edd60ed09 (patch)
tree803d5efb6370466dec175dfc061156c88ba1439c /support
parent3f2ccb46823469eca2cf2361ee79aaaf0dd4b39a (diff)
downloadbuildroot-1ff7f003e1cfc02241aef8f35429462edd60ed09.tar.gz
buildroot-1ff7f003e1cfc02241aef8f35429462edd60ed09.tar.bz2
support/scripts/cve.py: properly match CPEs with version '*'
Currently, when the version encoded in a CPE is '-', we assume all versions are affected, but when it's '*' with no further range information, we assume no version is affected. This doesn't make sense, so instead, we handle '*' and '-' in the same way. If there's no version information available in the CVE CPE ID, we assume all versions are affected. This increases quite a bit the number of CVEs and package affected: - "total-cves": 302, - "pkg-cves": 100, + "total-cves": 597, + "pkg-cves": 135, For example, CVE-2007-4476 has a CPE ID of: cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:* So it should be taken into account. In this specific case, it is combined with an AND with CPE ID cpe:2.3:o:suse:suse_linux:10:*:enterprise_server:*:*:*:*:* but since we don't support this kind of matching, we'd better be on the safe side, and report this CVE as affecting tar, do an analysis of the CVE impact, and document it in TAR_IGNORE_CVES. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Reviewed-by: Matt Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Diffstat (limited to 'support')
-rwxr-xr-xsupport/scripts/cve.py9
1 files changed, 1 insertions, 8 deletions
diff --git a/support/scripts/cve.py b/support/scripts/cve.py
index 6396019e0e..e7472cd470 100755
--- a/support/scripts/cve.py
+++ b/support/scripts/cve.py
@@ -144,10 +144,6 @@ class CVE:
# Version is defined, this is a '=' match
op_start = '='
v_start = version
- elif version == '-':
- # no version information is available
- op_start = '='
- v_start = version
else:
# Parse start version, end version and operators
if 'versionStartIncluding' in cpe:
@@ -206,11 +202,8 @@ class CVE:
for cpe in self.each_cpe():
if cpe['product'] != name:
continue
- if cpe['v_start'] == '-':
- return self.CVE_AFFECTS
if not cpe['v_start'] and not cpe['v_end']:
- print("No CVE affected version")
- continue
+ return self.CVE_AFFECTS
if not pkg_version:
continue