From: Lee Chee Yang Date: Thu, 4 Mar 2021 14:44:06 +0000 (+0800) Subject: cve-update-db-native: consider version suffix when update CVE db X-Git-Tag: 2020-04.7-dunfell~23 X-Git-Url: https://code.ossystems.io/gitweb?a=commitdiff_plain;h=b8d3e1754faea3ba0b6e07d5a830fbab12b5f53d;p=openembedded-core.git cve-update-db-native: consider version suffix when update CVE db some record from NVD can merge or split suffix from version, for example: CVE-2017-15906 "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:5.0:p1:*:*:*:*:*:*" "cpe23Uri" : "cpe:2.3:a:openbsd:openssh:4.7p1:*:*:*:*:*:*:*" in such case include the suffix into version when update local CVE db. Signed-off-by: Lee Chee Yang Signed-off-by: Richard Purdie (cherry picked from commit 13cc68197f81bb7c76fa1abecc5dd720b8bdb8d5) Signed-off-by: Steve Sakoman --- diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb index 9e8e006a32..5d9fb59cbc 100644 --- a/meta/recipes-core/meta/cve-update-db-native.bb +++ b/meta/recipes-core/meta/cve-update-db-native.bb @@ -137,9 +137,14 @@ def parse_node_and_insert(c, node, cveId): product = cpe23[4] version = cpe23[5] + if cpe23[6] == '*' or cpe23[6] == '-': + version_suffix = "" + else: + version_suffix = "_" + cpe23[6] + if version != '*' and version != '-': # Version is defined, this is a '=' match - yield [cveId, vendor, product, version, '=', '', ''] + yield [cveId, vendor, product, version + version_suffix, '=', '', ''] elif version == '-': # no version information is available yield [cveId, vendor, product, version, '', '', '']