@@ -69,5 +69,4 @@ RRECOMMENDS:${PN} = " \
coreutils \
"
-# CVE-2010-4176 affects only Fedora
-CVE_CHECK_IGNORE += "CVE-2010-4176"
+CVE_STATUS[CVE-2010-4176] = "not-applicable-platform: Applies only to Fedora"
@@ -43,10 +43,8 @@ SRCREV = "d956f683d37ea40e7977cc5907361f3e6988a439"
UPSTREAM_CHECK_GITTAGREGEX = "release_(?P<pver>\d+(\_\d+)+)"
-CVE_CHECK_IGNORE = "\
- CVE-2002-0318 \
- CVE-2011-4966 \
-"
+CVE_CHECK_STATUS[CVE-2002-0318] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
+CVE_CHECK_STATUS[CVE-2011-4966] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
PARALLEL_MAKE = ""
@@ -57,10 +57,8 @@ BBCLASSEXTEND = "native nativesdk"
CVE_PRODUCT = "mbed_tls"
-# Fix merged upstream https://github.com/Mbed-TLS/mbedtls/pull/5310
-CVE_CHECK_IGNORE += "CVE-2021-43666"
-# Fix merged upstream https://github.com/Mbed-TLS/mbedtls/commit/9a4a9c66a48edfe9ece03c7e4a53310adf73a86c
-CVE_CHECK_IGNORE += "CVE-2021-45451"
+CVE_STATUS[CVE-2021-43666] = "backported-patch: Fix merged upstream https://github.com/Mbed-TLS/mbedtls/pull/5310"
+CVE_STATUS[CVE-2021-43666] = "backported-patch: Fix merged upstream https://github.com/Mbed-TLS/mbedtls/commit/9a4a9c66a48edfe9ece03c7e4a53310adf73a86c"
# Strip host paths from autogenerated test files
do_compile:append() {
@@ -58,11 +58,6 @@ BBCLASSEXTEND = "native nativesdk"
CVE_PRODUCT = "mbed_tls"
-# Fix merged upstream https://github.com/Mbed-TLS/mbedtls/pull/5310
-CVE_CHECK_IGNORE += "CVE-2021-43666"
-# Fix merged upstream https://github.com/Mbed-TLS/mbedtls/commit/9a4a9c66a48edfe9ece03c7e4a53310adf73a86c
-CVE_CHECK_IGNORE += "CVE-2021-45451"
-
# Strip host paths from autogenerated test files
do_compile:append() {
sed -i 's+${S}/++g' ${B}/tests/*.c 2>/dev/null || :
@@ -22,11 +22,8 @@ S = "${WORKDIR}/git"
inherit pkgconfig perlnative autotools
-# CVE-2020-8916 has been fixed in commit
-# 3f108441e23e033b936e85be5b6877dd0a1fbf1c which is included in the SRCREV
-# CVE-2021-33889 has been fixed in commit
-# a8f3f761f6753b567d1e5ad22cbe6b0ceb6f2649 which is included in the SRCREV
# There has not been a wpantund release as of yet that includes these fixes.
# That means cve-check can not match them. Once a new release comes we can
-# remove the ignore statement.
-CVE_CHECK_IGNORE = "CVE-2020-8916 CVE-2021-33889"
+# remove the statement.
+CVE_STATUS[CVE-2020-8916] = "backported-patch: fixed via 3f108441e23e033b936e85be5b6877dd0a1fbf1c"
+CVE_STATUS[CVE-2021-33889] = "backported-patch: fixed via 3f108441e23e033b936e85be5b6877dd0a1fbf1c"
@@ -38,12 +38,7 @@ UPSTREAM_CHECK_REGEX = "samba\-(?P<pver>4\.18(\.\d+)+).tar.gz"
inherit systemd waf-samba cpan-base perlnative update-rc.d perl-version pkgconfig
-# CVE-2011-2411 is valnerble only on HP NonStop Servers.
-CVE_CHECK_IGNORE += "CVE-2011-2411"
-# Patch for CVE-2018-1050 is applied in version 4.5.15, 4.6.13, 4.7.5.
-CVE_CHECK_IGNORE += "CVE-2018-1050"
-# Patch for CVE-2018-1057 is applied in version 4.3.13, 4.4.16.
-CVE_CHECK_IGNORE += "CVE-2018-1057"
+CVE_STATUS[CVE-2011-2411] = "not-applicable-platform: vulnerable only on HP NonStop Servers"
# remove default added RDEPENDS on perl
RDEPENDS:${PN}:remove = "perl"
@@ -46,18 +46,16 @@ PACKAGECONFIG[tls] = ",tls=no,mbedtls"
CVE_PRODUCT = "apple:mdnsresponder"
-# CVE-2007-0613 is not applicable as it only affects Apple products
-# i.e. ichat,mdnsresponder, instant message framework and MacOS.
-# Also, https://www.exploit-db.com/exploits/3230 shows the part of code
-# affected by CVE-2007-0613 which is not preset in upstream source code.
-# Hence, CVE-2007-0613 does not affect other Yocto implementations and
-# is not reported for other distros can be marked whitelisted.
-# Links:
-# https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613
-# https://www.incibe-cert.es/en/early-warning/vulnerabilities/cve-2007-0613
-# https://security-tracker.debian.org/tracker/CVE-2007-0613
-# https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613
-CVE_CHECK_IGNORE += "CVE-2007-0613"
+CVE_STATUS[CVE-2007-0613] = "not-applicable-platform: Issue affects Apple products \
+i.e. ichat,mdnsresponder, instant message framework and MacOS. Also, \
+https://www.exploit-db.com/exploits/3230 shows the part of code \
+affected by CVE-2007-0613 which is not preset in upstream source code. \
+Hence, CVE-2007-0613 does not affect other Yocto implementations and \
+is not reported for other distros can be marked whitelisted. \
+Links: https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613 \
+https://www.incibe-cert.es/en/early-warning/vulnerabilities/cve-2007-0613 \
+https://security-tracker.debian.org/tracker/CVE-2007-0613 \
+https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613"
PARALLEL_MAKE = ""
@@ -13,10 +13,10 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=e870c934e2c3d6ccf085fd7cf0a1e2e2"
SRC_URI = "git://gitosis.stanford.edu/openflow.git;protocol=git;branch=master"
-CVE_CHECK_IGNORE = "\
- CVE-2015-1611 \
- CVE-2015-1612 \
-"
+CVE_STATUS[CVE-2015-1611] = "not-applicable-config: Not referred to our implementation of openflow"
+CVE_STATUS[CVE-2015-1612] = "not-applicable-config: Not referred to our implementation of openflow"
+CVE_STATUS[CVE-2018-1078] = "cpe-incorrect: This CVE is not for this product but cve-check assumes it is \
+because two CPE collides when checking the NVD database"
DEPENDS = "virtual/libc"
@@ -58,7 +58,3 @@ do_install:append() {
}
FILES:${PN} += "${nonarch_libdir}/tmpfiles.d"
-
-# This CVE is not for this product but cve-check assumes it is
-# because two CPE collides when checking the NVD database
-CVE_CHECK_IGNORE = "CVE-2018-1078"
@@ -71,5 +71,4 @@ FILES:${PN}-staticdev += "${libdir}/dovecot/*/*.a"
FILES:${PN}-dev += "${libdir}/dovecot/libdovecot*.so"
FILES:${PN}-dbg += "${libdir}/dovecot/*/.debug"
-# CVE-2016-4983 affects only postinstall script on specific distribution
-CVE_CHECK_IGNORE += "CVE-2016-4983"
+CVE_STATUS[CVE-2016-4983] = "not-applicable-platform: Affects only postinstall script on specific distribution."
@@ -26,12 +26,11 @@ SRC_URI = "http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-${PV}.tar.g
SRC_URI[sha256sum] = "103dd272e6a66c5b8df07dce5e9a02555fcd6f1397bdfb782237328e89d3a866"
-# CVE-2016-9312 is only for windows.
-# CVE-2019-11331 is inherent to RFC 5905 and cannot be fixed without breaking compatibility
-# The other CVEs are not correctly identified because cve-check
-# is not able to check the version correctly (it only checks for 4.2.8 omitting p15 that makes the difference)
-CVE_CHECK_IGNORE += "\
- CVE-2016-9312 \
+CVE_STATUS[CVE-2016-9312] = "not-applicable-platform: Issue only applies on Windows"
+CVE_STATUS[CVE-2019-11331] = "upstream-wontfix: inherent to RFC 5905 and cannot be fixed without breaking compatibility"
+CVE_STATUS_GROUPS += "CVE_STATUS_NTP"
+CVE_STATUS_NTP[status] = "fixed-version: Yocto CVE check can not handle 'p' in ntp version"
+CVE_STATUS_NTP = " \
CVE-2015-5146 \
CVE-2015-5300 \
CVE-2015-7975 \
@@ -51,7 +50,6 @@ CVE_CHECK_IGNORE += "\
CVE-2016-7433 \
CVE-2016-9310 \
CVE-2016-9311 \
- CVE-2019-11331 \
"
@@ -16,8 +16,7 @@ UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"
SRC_URI[sha256sum] = "13b207a376d8880507c74ff78aabc3778a9da47c89f1e247dcee3c7237138ff6"
-# CVE-2020-7224 and CVE-2020-27569 are for Aviatrix OpenVPN client, not for openvpn.
-CVE_CHECK_IGNORE += "CVE-2020-7224 CVE-2020-27569"
+CVE_STATUS[CVE-2020-27569] = "not-applicable-config: Applies only Aviatrix OpenVPN client, not openvpn"
INITSCRIPT_PACKAGES = "${PN}"
INITSCRIPT_NAME:${PN} = "openvpn"
@@ -30,11 +30,7 @@ SRC_URI = " \
S = "${WORKDIR}/git"
-CVE_CHECK_IGNORE += "\
- CVE-2016-0749 \
- CVE-2016-2150 \
- CVE-2018-10893 \
-"
+CVE_STATUS[CVE-2018-10893] = "fixed-version: patched already, caused by inaccurate CPE in the NVD database."
inherit autotools gettext python3native python3-dir pkgconfig
@@ -50,11 +50,8 @@ SRC_URI:append:toolchain-clang = "\
S = "${WORKDIR}/git"
-CVE_CHECK_IGNORE += "\
- CVE-2014-8180 \
- CVE-2017-18381 \
- CVE-2017-2665 \
-"
+CVE_STATUS[CVE-2014-8180] = "not-applicable-config: Not affecting our configuration so it can be safely ignored."
+CVE_STATUS[CVE-2017-2665] = "not-applicable-config: Not affecting our configuration so it can be safely ignored."
COMPATIBLE_HOST ?= '(x86_64|i.86|powerpc64|arm|aarch64).*-linux'
@@ -9,9 +9,7 @@ DEPENDS = "zlib libsigc++-2.0 openssl cppunit"
SRC_URI = "git://github.com/rakshasa/libtorrent;branch=master;protocol=https"
SRCREV = "e60f222241319aaae482789517ad00ae9344bd13"
-CVE_CHECK_IGNORE += "\
- CVE-2009-1760 \
-"
+CVE_STATUS[CVE-2009-1760] = "backported-patch: patched in our product"
PV = "0.13.8+git${SRCPV}"
@@ -25,11 +25,9 @@ do_install() {
RRECOMMENDS:${PN} += "kernel-module-emlog"
-# The NVD database doesn't have a CPE for this product,
-# the name of this product is exactly the same as github.com/emlog/emlog
-# but it's not related in any way. The following CVEs are from that project
-# so they can be safely ignored
-CVE_CHECK_IGNORE += "\
+CVE_STATUS_GROUPS += "CVE_STATUS_EMLOG"
+CVE_STATUS_EMLOG[status] = "fixed-version: The name of this product is exactly the same as github.com/emlog/emlog. CVE can be safely ignored."
+CVE_STATUS_EMLOG = " \
CVE-2019-16868 \
CVE-2019-17073 \
CVE-2021-44584 \
@@ -13,6 +13,4 @@ SRC_URI += "\
SRC_URI[sha256sum] = "ffc7d4891f00ffbf5c3f4eab7fbbced8460b8c0ee63c5a5167133b9e6599d932"
-CVE_CHECK_IGNORE += "\
- CVE-2017-8806 \
-"
+CVE_STATUS[CVE-2017-8806] = "not-applicable-config: Ddoesn't apply to out configuration of postgresql so we can safely ignore it."
@@ -15,8 +15,6 @@ RDEPENDS:${PN}-dev += "${PN}-compiler"
S = "${WORKDIR}/git"
-CVE_CHECK_IGNORE += "CVE-2020-35864"
-
EXTRA_OECMAKE += " \
-DFLATBUFFERS_BUILD_TESTS=OFF \
-DFLATBUFFERS_BUILD_SHAREDLIB=ON \
@@ -36,7 +36,9 @@ SRC_URI:append:class-target = " \
S = "${WORKDIR}/php-${PV}"
SRC_URI[sha256sum] = "5bfb2a35c67921bdcadd5c90cb290ad7537d24da113a5e8bc2d646b02de7488f"
-CVE_CHECK_IGNORE += "\
+CVE_STATUS_GROUPS += "CVE_STATUS_PHP"
+CVE_STATUS_PHP[status] = "fixed-version: The name of this product is exactly the same as github.com/emlog/emlog. CVE can be safely ignored."
+CVE_STATUS_PHP = " \
CVE-2007-2728 \
CVE-2007-3205 \
CVE-2007-4596 \
@@ -22,9 +22,7 @@ SRC_URI[sha256sum] = "53e15a2b5c1bc80161d42e9f69792a3fa18332b7b771910131004eb520
S = "${WORKDIR}/imap-${PV}"
-CVE_CHECK_IGNORE += "\
- CVE-2005-0198 \
-"
+CVE_STATUS[CVE-2005-0198] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}"
PACKAGECONFIG[pam] = ",,libpam"
@@ -14,7 +14,9 @@ SRC_URI = "git://github.com/libimobiledevice/libplist;protocol=https;branch=mast
S = "${WORKDIR}/git"
PR = "r1"
-CVE_CHECK_IGNORE += "\
+CVE_STATUS_GROUPS += "CVE_STATUS_LIBLIST"
+CVE_STATUS_LIBLIST[status] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
+CVE_STATUS_LIBLIST = " \
CVE-2017-5834 \
CVE-2017-5835 \
CVE-2017-5836 \
@@ -15,7 +15,9 @@ SRC_URI = "git://github.com/libimobiledevice/libplist;protocol=https;branch=mast
S = "${WORKDIR}/git"
-CVE_CHECK_IGNORE += "\
+CVE_STATUS_GROUPS += "CVE_STATUS_LIBLIST"
+CVE_STATUS_LIBLIST[status] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
+CVE_STATUS_LIBLIST = " \
CVE-2017-5834 \
CVE-2017-5835 \
CVE-2017-5836 \
@@ -23,7 +23,4 @@ SRC_URI = "https://libzip.org/download/libzip-${PV}.tar.xz"
SRC_URI[sha256sum] = "cd2a7ac9f1fb5bfa6218272d9929955dc7237515bba6e14b5ad0e1d1e2212b43"
-# Patch for CVE-2017-12858 is applied in version 1.2.0.
-CVE_CHECK_IGNORE += "CVE-2017-12858"
-
BBCLASSEXTEND += "native"
@@ -21,9 +21,7 @@ SRCREV = "b820c63093c4ae85d7da4f719cf3026d7fca5d09"
S = "${WORKDIR}/git"
-CVE_CHECK_IGNORE += "\
- CVE-2012-5638 \
-"
+CVE_STATUS[CVE-2012-5638] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
DEPENDS = "libaio util-linux"
@@ -34,9 +34,7 @@ SRC_URI = "http://downloads.sourceforge.net/sblim/${BP}.tar.bz2 \
SRC_URI[md5sum] = "28021cdabc73690a94f4f9d57254ce30"
SRC_URI[sha256sum] = "634a67b2f7ac3b386a79160eb44413d618e33e4e7fc74ae68b0240484af149dd"
-CVE_CHECK_IGNORE += "\
- CVE-2012-3381 \
-"
+CVE_STATUS[CVE-2012-3381] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
inherit autotools
inherit systemd
@@ -29,10 +29,6 @@ SRC_URI:append:class-nativesdk = "\
"
SRC_URI[sha256sum] = "d593695fdaa8a19297523b679ad13d3ef2027b0b7f14cc2bc23e77969ed81565"
-CVE_CHECK_IGNORE += "\
- CVE-2014-9157 \
-"
-
PACKAGECONFIG ??= "librsvg"
PACKAGECONFIG[librsvg] = "--with-librsvg,--without-librsvg,librsvg"
@@ -6,9 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a80440d1d8f17d041c71c7271d6e06eb"
SRC_URI = "git://github.com/jasper-software/jasper.git;protocol=https;branch=master"
SRCREV = "fe00207dc10db1d7cc6f2757961c5c6bdfd10973"
-CVE_CHECK_IGNORE += "\
- CVE-2015-8751 \
-"
+CVE_STATUS[CVE-2015-8751] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
S = "${WORKDIR}/git"
@@ -81,5 +81,4 @@ do_configure:prepend() {
BBCLASSEXTEND = "native nativesdk"
-#CVE-2019-14906 is a RHEL specific vulnerability.
-CVE_CHECK_IGNORE += "CVE-2019-14906"
+CVE_STATUS[CVE-2019-14906] = "not-applicable-platform: Applies on RHEL only"
@@ -95,6 +95,3 @@ FILES:${PN}-dbg += "${libdir}/sasl2/.debug"
FILES:${PN}-staticdev += "${libdir}/sasl2/*.a"
INSANE_SKIP:${PN} += "dev-so"
-
-# CVE-2020-8032 affects only openSUSE
-CVE_CHECK_IGNORE += "CVE-2020-8032"
@@ -24,9 +24,7 @@ SRC_URI = "http://www.atoptool.nl/download/${BP}.tar.gz \
SRC_URI[md5sum] = "1077da884ed94f2bc3c81ac3ab970436"
SRC_URI[sha256sum] = "be1c010a77086b7d98376fce96514afcd73c3f20a8d1fe01520899ff69a73d69"
-CVE_CHECK_IGNORE += "\
- CVE-2011-3618 \
-"
+CVE_STATUS[CVE-2011-3618] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
do_compile() {
oe_runmake all
@@ -11,9 +11,7 @@ SRC_URI:append:class-target = " file://usemake-docfile-native.patch"
SRC_URI[sha256sum] = "ee21182233ef3232dc97b486af2d86e14042dbb65bbc535df562c3a858232488"
-CVE_CHECK_IGNORE = "\
- CVE-2007-6109 \
-"
+CVE_CHECK_STATUS[CVE-2007-6109] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
PACKAGECONFIG[gnutls] = "--with-gnutls=yes,--with-gnutls=no,gnutls"
PACKAGECONFIG[kerberos] = "--with-kerberos=yes,--with-kerberos=no,krb5"
@@ -283,12 +283,8 @@ BBCLASSEXTEND = "native nativesdk"
CVE_PRODUCT += "network_security_services"
-# CVE-2006-5201 affects only Sun Solaris
-CVE_CHECK_IGNORE += "CVE-2006-5201"
+CVE_STATUS_GROUPS += "CVE_STATUS_NSS"
+CVE_STATUS_NSS[status] = "not-applicable-config: This only affect the legacy db (libnssdbm), only compiled with --enable-legacy-db"
+CVE_STATUS_NSS = "CVE-2017-11695 CVE-2017-11696 CVE-2017-11697 CVE-2017-11698"
-# CVES CVE-2017-11695 CVE-2017-11696 CVE-2017-11697 CVE-2017-11698 only affect
-# the legacy db (libnssdbm), only compiled with --enable-legacy-db.
-CVE_CHECK_IGNORE += "CVE-2017-11695 CVE-2017-11696 CVE-2017-11697 CVE-2017-11698"
-
-# vulnerability was introduced in 3.77 and fixed in 3.87
-CVE_CHECK_IGNORE += "CVE-2022-3479"
+CVE_STATUS[CVE-2022-3479] = "not-applicable-config: vulnerability was introduced in 3.77 and fixed in 3.87"
@@ -233,6 +233,3 @@ python populate_packages:prepend () {
}
BBCLASSEXTEND = "native"
-
-# CVE-2015-3276 has no target code.
-CVE_CHECK_IGNORE += "CVE-2015-3276"
@@ -15,10 +15,8 @@ SRC_URI = "\
SRC_URI[sha256sum] = "19654ad276b149646371fbdac21bc7620742f2975f7399fed0ffc1a18fbaf603"
-CVE_CHECK_IGNORE += "\
- CVE-2010-1624 \
- CVE-2011-3594 \
-"
+CVE_CHECK_STATUS[CVE-2010-1624] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
+CVE_CHECK_STATUS[CVE-2011-3594] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
PACKAGECONFIG ??= "gnutls consoleui avahi dbus idn nss \
${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11 gtk startup-notification', '', d)} \