]> code.ossystems Code Review - openembedded-core.git/commit
cve-check: Consider CVE that affects versions with less than operator
authorPierre Le Magourou <pierre.lemagourou@softbankrobotics.com>
Wed, 6 Nov 2019 15:37:19 +0000 (17:37 +0200)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Wed, 6 Nov 2019 20:44:15 +0000 (20:44 +0000)
commit70046288894184477dcf6f7eba25b1994b88c8de
treef1dfbb1b0f0851890d9615b39f0065918c152674
parent4f96e9ba1f4f14f312b6024711fe8da0c3041e4c
cve-check: Consider CVE that affects versions with less than operator

In the NVD json CVE feed, affected versions can be strictly matched to a
version, but they can also be matched with the operator '<='.

Add a new condition in the sqlite query to match affected versions that
are defined with the operator '<='. Then use LooseVersion to discard all
versions that are not relevant.

(From OE-Core rev: 3bf63bc60848d91e90c23f6d854d22b78832aa2d)

Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
meta/classes/cve-check.bbclass