diff mbox series

cve-check: Modify judgment processing using "=" in version comparison

Message ID 20231129021915.21212-1-shin.matsunaga@fujitsu.com
State Accepted, archived
Commit a1989e4197178c2431ceca499e0b4876b233b131
Headers show
Series cve-check: Modify judgment processing using "=" in version comparison | expand

Commit Message

Shinji Matsunaga Nov. 29, 2023, 2:19 a.m. UTC 
Judgment processing of vulnerable using "=" compares characters as strings rather than numbers,
and misjudges "cases that do not match in strings but do match in numbers" as "Patched".
(e.g. PV = "1.2.0" and Vulnerabilities Affected Versions (registered with NVD) = "1.2")

Therefore, if the comparison operator used in the judgment processing of vulnerable is "=",
add numeric comparison processing.

Signed-off-by: Shinji Matsunaga <shin.matsunaga@fujitsu.com>
Signed-off-by: Shunsuke Tokumoto <s-tokumoto@fujitsu.com>
---
 meta/classes/cve-check.bbclass | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 5191d04303..086d87687f 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -375,6 +375,7 @@  def check_cves(d, patched_cves):
                         try:
                             vulnerable_start =  (operator_start == '>=' and Version(pv,suffix) >= Version(version_start,suffix))
                             vulnerable_start |= (operator_start == '>' and Version(pv,suffix) > Version(version_start,suffix))
+                            vulnerable_start |= (operator_start == '=' and Version(pv,suffix) == Version(version_start,suffix))
                         except:
                             bb.warn("%s: Failed to compare %s %s %s for %s" %
                                     (product, pv, operator_start, version_start, cve))