| Message ID | 20240220050347.9424-1-shin.matsunaga@fujitsu.com |
|---|---|
| State | Accepted, archived |
| Commit | a1989e4197178c2431ceca499e0b4876b233b131 |
| Headers | show |
| Series | cve-check: Modify judgment processing using "=" in version comparison | expand |
Hi, Le 20/02/2024 à 06:03, Matsunaga-Shinji via lists.openembedded.org a écrit : > Judgment processing of vulnerable using "=" compares characters as strings rather than numbers, > and misjudges "cases that do not match in strings but do match in numbers" as "Patched". > (e.g. PV = "1.2.0" and Vulnerabilities Affected Versions (registered with NVD) = "1.2") > > Therefore, if the comparison operator used in the judgment processing of vulnerable is "=", > add numeric comparison processing. > > Signed-off-by: Shinji Matsunaga <shin.matsunaga@fujitsu.com> > Signed-off-by: Shunsuke Tokumoto <s-tokumoto@fujitsu.com> > --- > meta/classes/cve-check.bbclass | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass > index 5191d04303..086d87687f 100644 > --- a/meta/classes/cve-check.bbclass > +++ b/meta/classes/cve-check.bbclass > @@ -375,6 +375,7 @@ def check_cves(d, patched_cves): > try: > vulnerable_start = (operator_start == '>=' and Version(pv,suffix) >= Version(version_start,suffix)) > vulnerable_start |= (operator_start == '>' and Version(pv,suffix) > Version(version_start,suffix)) > + vulnerable_start |= (operator_start == '=' and Version(pv,suffix) == Version(version_start,suffix)) > except: > bb.warn("%s: Failed to compare %s %s %s for %s" % > (product, pv, operator_start, version_start, cve)) As far as I can tell, this patch is the same that was: * merged in commit 291bc9e96a1f ("cve-check: Modify judgment processing using "=" in version comparison") * and reverted in commit 028b6f62263c ("Revert "cve-check: Modify judgment processing using "=" in version comparison"") (poky.git SHA1s) I am not a maintainer but I whould say that you need to adress the warnings in the revert commit message: > This change introduced a warning if version comparisons failed, but this is far too common an issue in data that we don't control, so this shouldn't cause a warning: > > WARNING: automake-native-1.16.5-r0 do_cve_check: automake: Failed to compare 1.16.5 = branch_1-9 for CVE-2009-4029 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m1 for CVE-2010-4539 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m2 for CVE-2010-4539 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m3 for CVE-2010-4539 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m4\/m5 for CVE-2010-4539 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m1 for CVE-2010-4644 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m2 for CVE-2010-4644 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m3 for CVE-2010-4644 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m4\/m5 for CVE-2010-4644 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m1 for CVE-2011-0715 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m2 for CVE-2011-0715 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m3 for CVE-2011-0715 > WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m4\/m5 for CVE-2011-0715 > WARNING: automake-1.16.5-r0 do_cve_check: automake: Failed to compare 1.16.5 = branch_1-9 for CVE-2009-4029 > WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2003-0577 > WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2004-0982 > WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2004-1284 > WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s_r11 for CVE-2006-3355 > WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2007-0578 > WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s_r11 for CVE-2007-0578 > WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2009-1301 > WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s_r11 for CVE-2009-1301 Regards,
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass index 5191d04303..086d87687f 100644 --- a/meta/classes/cve-check.bbclass +++ b/meta/classes/cve-check.bbclass @@ -375,6 +375,7 @@ def check_cves(d, patched_cves): try: vulnerable_start = (operator_start == '>=' and Version(pv,suffix) >= Version(version_start,suffix)) vulnerable_start |= (operator_start == '>' and Version(pv,suffix) > Version(version_start,suffix)) + vulnerable_start |= (operator_start == '=' and Version(pv,suffix) == Version(version_start,suffix)) except: bb.warn("%s: Failed to compare %s %s %s for %s" % (product, pv, operator_start, version_start, cve))