Le dim. 3 mars 2024 à 14:18, Peter Marko via lists.yoctoproject.org <[email protected]> a écrit :
> I already mentioned this last week. > https://lists.openembedded.org/g/openembedded-core/message/196199 > > I think that partial NVD DB update is not working properly as things which > were corrected by NVD are still showing up in patchmetrics but not in email > reports. > The yocto-metrics repo shows that CVE-2022-3563 has been "Unpatched" since its creation 31/10/2023. +1 on the "partial NVD DB update is not working properly" hyptohesis Looking into this, I've started to look at the NVD API: IIUC, a partial update is done by requesting every CVE that have a lastModified field after our last update. But from the NVD API doc: https://nvd.nist.gov/developers/vulnerabilities#cves-lastModDates > A CVE's lastModified *does* *not* change when any of the follow actions > occur: > [...] > The NVD modifies a CPE record previously associated with the CVE record If I read that correctly, this means that CVEs CPE updated by the NVD (which is what we frequently request to the NVD) would not have their lastModified field updated and then, missed by the partial update. Sounds like a bug, no? For example: > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6779 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6780 > kirkstone has glibc 2.35 and nvd recently fixed these to >= 2.37 and these > ate still in patchmetrics. > > Email reports maybe use different (not-broken yet) NVD DB cache or make > full update instead of incremental? > > Peter > > -----Original Message----- > From: [email protected] < > [email protected]> On Behalf Of Richard Purdie via > lists.yoctoproject.org > Sent: Sunday, March 3, 2024 13:36 > To: Simone Weiß <[email protected]>; Steve Sakoman < > [email protected]>; [email protected]; > [email protected] > Subject: Re: [yocto-security] OE-core CVE metrics for master on Sun 03 Mar > 2024 01:00:01 AM HST > > > On Sun, 2024-03-03 at 11:49 +0000, Simone Weiß wrote: > > > quick check: No news for any old issue, except cpio, which is disputed > > > by the maintainer. > > > > Thanks, that is really useful to know! > > > > > > > > > Full list: Found 41 unpatched CVEs > > > > I'm a bit puzzled/worried that our patch metrics page says 50 rather > than 41: > > > > > https://autobuilder.yocto.io/pub/non-release/patchmetrics/cve-status-master.txt > > > >:/ > > > > Does anyone know why? > > > > Cheers, > > > > Richard > > > > -- Yoann Congal Smile ECS - Tech expert
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#196564): https://lists.openembedded.org/g/openembedded-core/message/196564 Mute This Topic: https://lists.openembedded.org/mt/104701002/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
