Le dim. 3 mars 2024 à 13:36, Richard Purdie < [email protected]> a écrit :
> On Sun, 2024-03-03 at 11:49 +0000, Simone Weiß wrote: > > > Full list: Found 41 unpatched CVEs > > I'm a bit puzzled/worried that our patch metrics page says 50 rather > than 41: > > > https://autobuilder.yocto.io/pub/non-release/patchmetrics/cve-status-master.txt > > :/ > > Does anyone know why? > Weird... Here is the added CVEs from Steve's run to the AB run ( https://autobuilder.yoctoproject.org/typhoon/#/builders/138/builds/1275/steps/15/logs/stdio ): +CVE-2022-3563: bluez5 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3563 * +CVE-2022-3637: bluez5 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3637 * +CVE-2023-28736: mdadm https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28736 * +CVE-2023-28938: mdadm https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28938 * +CVE-2023-3180: qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3180 * +CVE-2023-3354: qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3354 * +CVE-2023-4135: qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4135 * +CVE-2023-6918: libssh2:libssh2-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6918 * +CVE-2024-24806: libuv https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24806 * I've started looking at this at the top: CVE-2022-3563: bluez5 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3563 * => Fixed in >= 5.65 (last NVD update November 2023), bluez5 is 5.72 in oe-core but cve-check says Unpatched : https://git.yoctoproject.org/yocto-metrics/tree/cve-check/master/1709449295.json?id=851f9dd3bf9faccb85796b45e62139cc50cbbcb7#n12305 Locally this CVE is not displayed as unpatched. The rest of the list is in similar state: * oe-core is updated enough for the CVE to be patched as per NVD data * all NVD updates are at least a few weeks old (except CVE-2024-24806: libuv : 4 days) * locally these CVE do not appear as Unpatched Something is weird on the autobuilder. Maybe keep the build directory around and a copy of the current CVE database for analysis ($DL_DIR/CVE_CHECK/nvdcve_2-1.db) ? > Cheers, > > Richard > > > > -- Yoann Congal Smile ECS - Tech expert
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#196561): https://lists.openembedded.org/g/openembedded-core/message/196561 Mute This Topic: https://lists.openembedded.org/mt/104701002/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
