From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mail.openembedded.org (Postfix) with ESMTP id 3B45C7EB49 for ; Fri, 5 Jul 2019 09:41:24 +0000 (UTC) Received: by mail-wm1-f44.google.com with SMTP id 207so8202297wma.1 for ; Fri, 05 Jul 2019 02:41:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Y+XjftZ9yL9ywuPeQ8jGMx6i/BErsNikD/9/N6XPJrI=; b=WKEEcLtl2Jq8pil+tHLNBRzzvP471gDomnyUq56sxZwrFjnaHnMlUwlLH8EQGre4jx 0HwHS7dFVWzHweyk1cDD5/jTvec3TpxMfPStEaSj3YVPYFQ+TfJ3DYVTgHfwDoDbOkKK ATr92+jyzjKwCaGVoc8QbF1CfUhvYEn8O50SaoU3+JhbiVNK12k39YCK7TlPXZB2N5nW Qx+skShjORkMl+5IosFXM3ZYr1mjVLnOTQrQzSdFIpCN8+ZxfQEsxbrTNiSJKiHnRqus SwQ8MtPNOO9ccQFbup1k1yT+/ZfWpeCTOaNXLPyVdsQW/KuYEEM6ARWURHFuwue05igU MoYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Y+XjftZ9yL9ywuPeQ8jGMx6i/BErsNikD/9/N6XPJrI=; b=sH0YHcoCe8p5cITpzH0HU4TIzS+chK8ZrXPav02kQuUQh5z0/Ff2LqjMvcHU46TmEg iKlirF9c6LsK8moiTzX2PPgxp0W07NcydMvAw1ypnK4zB7e+JC8qbm0J6w4V3WXibeNL 78+Z0Wsdj/8uYqPVnmoH9VelxIiYyYYUL62jrMX69IwF/zR1TufmLE+YuiqTpt7J0MWj qQs+9X/YHu6Mj8JRoAnCnhB41wNJlVD0JadUamr7wF/VkpW8poQ4tGJRIQ+8mFw81SDs bpFejjx7w+PJHUqI9eJwUSJLvxRVYEVRM3KI4ZerRchtQLT1TPn7eiJQMbcrTeZYisg6 gj2A== X-Gm-Message-State: APjAAAV074K9Jg8rmr3bz1L3HOmo+6yrc7dfLhKSxWyEPbs7xtZSY3/+ 20IMNrMwkm4YAnbWxTBjcMOwuuo2 X-Google-Smtp-Source: APXvYqwuWkrnY2fUbPuSM5SWqrtEMexEt8BZTQXpLJr2HJKiunTYHFdY4rYOKa/8JhpkktrxwJDFNA== X-Received: by 2002:a7b:c928:: with SMTP id h8mr2749852wml.93.1562319684789; Fri, 05 Jul 2019 02:41:24 -0700 (PDT) Received: from localhost.localdomain (softbank-robotics-gw1.ter4.eqx2.par.cust.as8218.eu. [158.255.112.194]) by smtp.gmail.com with ESMTPSA id y16sm738249wrw.33.2019.07.05.02.41.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 05 Jul 2019 02:41:24 -0700 (PDT) From: Pierre Le Magourou To: openembedded-core@lists.openembedded.org Date: Fri, 5 Jul 2019 11:40:38 +0200 Message-Id: <20190705094038.29377-3-lemagoup@gmail.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20190705094038.29377-1-lemagoup@gmail.com> References: <20190705094038.29377-1-lemagoup@gmail.com> Subject: [PATCH v2 3/3] cve-check: Update unpatched CVE matching X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Jul 2019 09:41:24 -0000 From: Pierre Le Magourou Now that cve-update-db added CPE information to NVD database. We can check for unpatched versions with operators '<', '<=', '>', and '>='. Signed-off-by: Pierre Le Magourou --- meta/classes/cve-check.bbclass | 54 +++++++++++++++++++++++++++++++----------- 1 file changed, 40 insertions(+), 14 deletions(-) diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass index 6ffa0c4688..ffd624333f 100644 --- a/meta/classes/cve-check.bbclass +++ b/meta/classes/cve-check.bbclass @@ -26,7 +26,7 @@ CVE_PRODUCT ??= "${BPN}" CVE_VERSION ??= "${PV}" CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" -CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvd-json.db" +CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve.db" CVE_CHECK_LOG ?= "${T}/cve.log" CVE_CHECK_TMP_FILE ?= "${TMPDIR}/cve_check" @@ -189,27 +189,53 @@ def check_cves(d, patched_cves): conn = sqlite3.connect(db_file) c = conn.cursor() - query = """SELECT * FROM PRODUCTS WHERE - (PRODUCT IS '{0}' AND VERSION = '{1}' AND OPERATOR IS '=') OR - (PRODUCT IS '{0}' AND OPERATOR IS '<=');""" + query = "SELECT * FROM PRODUCTS WHERE PRODUCT IS '{0}';" + for product in products: for row in c.execute(query.format(product, pv)): cve = row[1] - version = row[4] - - try: - discardVersion = LooseVersion(version) < LooseVersion(pv) - except: - discardVersion = True + version_start = row[4] + operator_start = row[5] + version_end = row[6] + operator_end = row[7] if pv in cve_whitelist.get(cve, []): bb.note("%s-%s has been whitelisted for %s" % (product, pv, cve)) elif cve in patched_cves: bb.note("%s has been patched" % (cve)) - elif discardVersion: - bb.debug(2, "Do not consider version %s " % (version)) else: - cves_unpatched.append(cve) + if (operator_start == '=' and pv == version_start): + cves_unpatched.append(cve) + else: + if operator_start: + try: + to_append_start = (operator_start == '>=' and LooseVersion(pv) >= LooseVersion(version_start)) + to_append_start |= (operator_start == '>' and LooseVersion(pv) > LooseVersion(version_start)) + except: + bb.note("%s: Failed to compare %s %s %s for %s" % + (product, pv, operator_start, version_start, cve)) + to_append_start = False + else: + to_append_start = False + + if operator_end: + try: + to_append_end = (operator_end == '<=' and LooseVersion(pv) <= LooseVersion(version_end)) + to_append_end |= (operator_end == '<' and LooseVersion(pv) < LooseVersion(version_end)) + except: + bb.note("%s: Failed to compare %s %s %s for %s" % + (product, pv, operator_end, version_end, cve)) + to_append_end = False + else: + to_append_end = False + + if operator_start and operator_end: + to_append = to_append_start and to_append_end + else: + to_append = to_append_start or to_append_end + + if to_append: + cves_unpatched.append(cve) bb.debug(2, "%s-%s is not patched for %s" % (product, pv, cve)) conn.close() @@ -217,7 +243,7 @@ def check_cves(d, patched_cves): def get_cve_info(d, cves): """ - Get CVE information from the database used by cve-check-tool. + Get CVE information from the database. Unfortunately the only way to get CVE info is set the output to html (hard to parse) or query directly the database. -- 2.11.0