Re: [Buildroot] [PATCH v2 4/5] support/scripts/cve-check: fix vulnerabilities with different analysis

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

On Fri, May 29, 2026 at 05:06:30PM +0200, Thomas Perale via buildroot wrote:
> Before this commit, only one entry per vulnerability ID was added to the
> output. In CycloneDX, if you need to provide different analyses for
> different affected components with the same vulnerability ID, you must
> create multiple entries with the same ID.
> 
> When running `cve-check` with the `--include-resolved` argument, the
> analysis of some vulnerabilities would get overwritten, which led to
> undefined analysis results.
> 
> This is especially true when running the analysis on multiple components
> with the same name but different versions. For instance, if the input
> SBOM includes both the `gnupg` and `gnupg2` packages, CVE-2025-68973
> could be included. This CVE might be exploitable for the `gnupg` package
> but resolved for `gnupg2`. Therefore, a single analysis entry cannot
> cover both cases.
> 
> This commit fixes the logic for adding vulnerabilities to the output
> SBOM. A vulnerability is now added as a new entry if:
> 
> 1. A vulnerability with the same ID doesn't exist yet.
> 2. The affect of the new vulnerability is not the same as the one
>    already present.
> 
> For the CVE-2025-68973 example this would result in the following
> output:
> 
> ```json
> [
>     {
>         "id": "CVE-2025-68973",
>         "analysis": {
>             "state": "exploitable"
>         }
>         "affects": [
>             {"ref": "gnupg"}
>         ]
>     },
>     {
>         "id": "CVE-2025-68973",
>         "analysis": {
>             "state": "resolved"
>         }
>         "affects": [
>             {"ref": "gnupg2"}
>         ]
>     }
> ]
> ```
> 
> 45 vulnerabilities were concerned by this bug over the Buildroot tree.
> 
> Co-Authored-By: Tim Soubry <tim.soubry@mind.be>
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Applied to master, thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot