[Buildroot] [RFC PATCH 00/14] Add exportable vulnerability informations

[Buildroot] [RFC PATCH 00/14] Add exportable vulnerability informations

[Thomas Perale via buildroot]

In Buildroot, we can put the ignore CVEs entries in different
categories:

- Vulnerability fixed by a patch.
- Vulnerability ignored because the internal tooling detect it as a
  false positive
- Vulnerability ignored because the database is wrong or not up-to-date.
- Vulnerability ignored because it doesn't apply to Buildroot
  (platform/hardware specific, ...).
- Vulnerability ignored because Buildroot is using an upstream fixed
  version (based on a hash for instance) while the CPE metadata
  reference the latest known version.

Since the introduction of `_IGNORE_CVES` the justification for the
vulnerability were added as a comment on top of the ignored
vulnerability.

With the introduction of the rule for the `CVE:` trailer it's now
possible to distinguish the vulnerabilities that are patched from the
one that are not-applicable for another unknown reason.

This series add support to tag the remaining 'IGNORE_CVES' entry with a
set of information that can then be exported with 'show-info'.

This was discussed during the post-FOSDEM buildroot hackathon. The idea
of using OpenVex for the annotation format as in the future multiple
SBOM output format might be supported and OpenVex looked like a good
candidate for the base annotation without re-inventing our own format.

This RFC to discuss: 
 - The OpenVex annotation used and how we make them map to the Buildroot
   cases (see the doc change). I also provided some example of ignored
   entries and how I make them map to give more context. Not all the
   entries are mapped yet.
 - Should we consider another format ?
 - How I translate this format to CycloneDX analysis.

Still TODO:

- The CycloneDX translation needs to change as it depends on
  https://patchwork.ozlabs.org/project/buildroot/patch/20260624101340.80670-8-thomas.perale@mind.be/.
  The current implementation is a rough draft that is used only for
  testing
- The STATUS and DETAIL variables needs to be replicated for host
  packages.
- Add a test case that run 'make show-info-all |
  utils/generate-cyclonedx' and verify no "in_triage" analysis remains.
  This depends on the two previous TODOs.

Thomas Perale (14):
  docs/manual: add vulnerability status and justification
  utils/checkpackagelib/lib_mk.py: check _STATUS value is supported
  package/pkg-utils: show-info expose vuln details
  utils/generate-cyclonedx: support vulnerability details
  package/sox: add vulnerabilities details
  package/php: add vulnerability details
  package/mupdf: add vulnerabilities details
  package/python-pip: add detail to vulnerability
  package/luajit: add details to vulnerabilities
  package/libuci: add vulnerability details
  package/glibc: add vulnerability details
  package/freeradius-server: add vulnerabilities details
  package/flex: add vulnerability details
  package/clamav: add vulnerability details

 docs/manual/adding-packages-generic.adoc      | 35 ++++++++
 package/clamav/clamav.mk                      |  6 +-
 package/flex/flex.mk                          |  7 +-
 .../freeradius-server/freeradius-server.mk    |  7 +-
 package/glibc/glibc.mk                        | 32 ++++---
 package/libuci/libuci.mk                      |  3 +-
 package/luajit/luajit.mk                      | 15 ++--
 package/mupdf/mupdf.mk                        | 10 +--
 package/php/php.mk                            |  3 +-
 package/pkg-utils.mk                          | 19 +++++
 package/python-pip/python-pip.mk              |  5 +-
 package/sox/sox.mk                            | 41 ++++++---
 utils/checkpackagelib/lib_mk.py               | 22 +++++
 utils/generate-cyclonedx                      | 83 +++++++++++++++----
 14 files changed, 227 insertions(+), 61 deletions(-)

-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 01/14] docs/manual: add vulnerability status and justification

[Thomas Perale via buildroot]

In Buildroot, we can put the ignore CVEs entries in different
categories:

- Vulnerability fixed by a patch.
- Vulnerability ignored because the internal tooling detect it as a
  false positive
- Vulnerability ignored because the database is wrong or not up-to-date.
- Vulnerability ignored because it doesn't apply to Buildroot
  (platform/hardware specific, ...).
- Vulnerability ignored because Buildroot is using an upstream fixed
  version (based on a hash for instance) while the CPE metadata
  reference the latest known version.

Since the introduction of `_IGNORE_CVES` the justification for the
vulnerability were added as a comment on top of the ignored
vulnerability. With the introduction of the rule for the `CVE:` trailer
it's now possible to distinguish the vulnerabilities that are patched
from the one that are not-applicable for another unknown reason.

This commit add documentation to introduce two new variables:

- `<pkg>_<vuln-id>_STATUS`
- `<pkg>_<vuln-id>_DETAIL`

This allows to have machine readable variables that are exposed and
contains the reasons why a vulnerability is set as ignored instead of
storing this knowledge in a comment on top of the `_IGNORE_CVES` entry.

The `<pkg>_<vuln-id>_STATUS` syntax is based on OpenVex statuses syntax
[1][2]. This varialbe only needs to be used if a patch on the Buildroot
tree isn't present.

The `<pkg>_<vuln-id>_DETAIL` is a free text field that allows to add
more information to justify the status.

[1] https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-labels
[2] https://github.com/openvex/ospec/blob/main/OPENVEX-SPEC.md#status-justifications

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 docs/manual/adding-packages-generic.adoc | 35 ++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/docs/manual/adding-packages-generic.adoc b/docs/manual/adding-packages-generic.adoc
index e7547460fd..47b28adf4b 100644
--- a/docs/manual/adding-packages-generic.adoc
+++ b/docs/manual/adding-packages-generic.adoc
@@ -520,6 +520,41 @@ LIBFOO_IGNORE_CVES += CVE-2020-12345
 LIBFOO_IGNORE_CVES += CVE-2020-54321
 ----
 
+* +LIBFOO_<VULN-ID>_STATUS+ informs about the impact of the vulnerability
+  +<VULN-ID>+. This variable needs to be set only if the referenced +<VULN-ID>+
+  is not fixed by a patch present in the Buildroot tree. It support different
+  labels based on
+  https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-labels[OpenVex
+  statuses] and
+  https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-justifications[justification]:
+  ** +fixed+: referenced by the package Makefile already includes the fix but
+     no new version has been issued by the upstream project. This typically
+     happens when the version is using an +hash+ and the CPE reference the
+     latest known version.
+  ** +not-affected-component-not-present+: the vulnerability is incorrect and
+     should reference another package. Or the package is not part of the final
+     image.
+  ** +not-affected-vulnerable-code-not-present+: the code affected by the
+     vulnerability is not included in the final image. Could be a not supported
+     architecture, flags that are disabled by the package configuration,
+     busybox commands not built, dependencies not supported, ...
+  ** +not-affected-vulnerable-code-not-in-execute-path+: the vulnerable code is
+     present in the generated image but cannot be reached because of the
+     system's runtime configuration.
+  ** +not-affected-vulnerable-code-cannot-be-controlled-by-adversary+: the
+     vulnerable code may be executed, but an attacker cannot control the inputs
+     required to trigger the vulnerability.
+* +LIBFOO_<VULN-ID>_DETAIL+ is an optional free text entry that add
+  additional information on the reason a +STATUS+ has been set for a
+  +<VULN-ID>+.
++
+----
+LIBFOO_IGNORE_CVES += CVE-2020-54321
+
+LIBFOO_CVE-2020-54321_STATUS = not-affected-vulnerable-code-not-present
+LIBFOO_CVE-2020-54321_DETAIL = Only when built with libbaz, which Buildroot doesn't support
+----
+
 * [[cpe-id]] +LIBFOO_CPE_ID_*+ variables is a set of variables that allows the
   package to define its https://nvd.nist.gov/products/cpe[CPE
   identifier]. The available variables are:
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 02/14] utils/checkpackagelib/lib_mk.py: check _STATUS value is supported

[Thomas Perale via buildroot]

Check that `<pkg>_<vuln-id>_STATUS` variable values are using a status
value supported.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 utils/checkpackagelib/lib_mk.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/utils/checkpackagelib/lib_mk.py b/utils/checkpackagelib/lib_mk.py
index 5d48e8929c..6201d324fa 100644
--- a/utils/checkpackagelib/lib_mk.py
+++ b/utils/checkpackagelib/lib_mk.py
@@ -443,3 +443,25 @@ class CPEVariables(_CheckFunction):
             if field == "VALID":
                 self.valid = {"lineno": lineno, "text": text}
             self.non_defaults += 1
+
+
+class VulnerabilityStatus(_CheckFunction):
+    VALID_STATUSES = [
+        "fixed",
+        "not-affected-component-not-present",
+        "not-affected-vulnerable-code-not-present",
+        "not-affected-vulnerable-code-not-in-execute-path",
+        "not-affected-vulnerable-code-cannot-be-controlled-by-adversary",
+    ]
+    CVE_STATUS = re.compile(r"^[A-Z0-9_]+(CVE-\d{4}-\d+)_STATUS\s*=\s*(\S+)")
+
+    def check_line(self, lineno, text):
+        m = self.CVE_STATUS.match(text.rstrip())
+        if m is None:
+            return
+        status = m.group(2)
+        if status not in self.VALID_STATUSES:
+            return ["{}:{}: invalid _STATUS value '{}', expected one of: {} ({})".format(
+                self.filename, lineno, status,
+                ", ".join(self.VALID_STATUSES), self.url_to_manual),
+                text]
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 03/14] package/pkg-utils: show-info expose vuln details

[Thomas Perale via buildroot]

For each `_IGNORE_CVES` entries the status and details are exported if
present.

- `<pkg>_<vuln-id>_STATUS`
- `<pkg>_<vuln-id>_DETAIL`

For a hypotetical 'CVE-2025-1234' that affects the package 'foo' with
the following declaration:

```
FOO_CVE-2025-1234_STATUS = fixed
FOO_CVE-2025-1234_DETAIL = some details
```

Will result in the following show info output.

```json
{
    "foo": {
        ...
        "cves_status": {
            "CVE-2025-1234": {
                "status": "fixed",
                "detail": "some details"
            }
        }
    }
}
```

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-utils.mk | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/package/pkg-utils.mk b/package/pkg-utils.mk
index 17b0aa1760..c6e509e9d1 100644
--- a/package/pkg-utils.mk
+++ b/package/pkg-utils.mk
@@ -154,6 +154,25 @@ define _json-info-pkg
 				) \
 			)
 		]
+		$(comma) "cves_status": {
+			$(foreach cve,$(sort $($(1)_IGNORE_CVES)), \
+				$(call _json-info-pkg-cve,$(1),$(cve)) \
+			) \
+		}
+	)
+endef
+
+# json-info-pkg-cve -- Create a JSON Object entry of a vulnerability id if the
+#  STATUS & DETAIL variable for that given package name & vulnerability
+#  id combination exists.
+# $(1): upper-case package name
+# $(2): vulnerability id
+define _json-info-pkg-cve
+	$(if $($(1)_$(2)_STATUS),
+		$(call mk-json-str,$(2)): {
+			"status": $(call mk-json-str,$($(1)_$(2)_STATUS))$(comma)
+			"detail": $(call mk-json-str,$($(1)_$(2)_DETAIL))
+		}$(comma)
 	)
 endef
 
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 04/14] utils/generate-cyclonedx: support vulnerability details

[Thomas Perale via buildroot]

Translate the OpenVex notation used to describe the vulnerabilities that
aren't patched in Buildroot into the CycloneDX format.

- fixed -> resolved
- not-affected-component-not-present -> false_positive
- not-affected-vulnerable-code-not-present -> not_affected &
  code_not_present
- not-affected-vulnerable-code-not-in-execute-path -> not_affected &
  code_not_reachable
- not-affected-vulnerable-code-cannot-be-controlled-by-adversary -> not_affected &
  protected_by_mitigating_control

See https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_analysis
for more information

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 utils/generate-cyclonedx | 83 +++++++++++++++++++++++++++++++++-------
 1 file changed, 69 insertions(+), 14 deletions(-)

diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
index df12ee84c0..c1aa1f980d 100755
--- a/utils/generate-cyclonedx
+++ b/utils/generate-cyclonedx
@@ -403,6 +403,43 @@ def cyclonedx_dependency(ref, depends):
         "dependsOn": sorted(depends),
     }
 
+def openvex_to_cyclonedx_analysis(state) -> dict:
+    """Convert an OpenVex vulnerability state into a CycloneDX analysis.
+
+    Supported:
+      - fixed
+      - not-affected-component-not-present
+      - not-affected-vulnerable-code-not-present
+      - not-affected-vulnerable-code-not-in-execute-path
+      - not-affected-vulnerable-code-cannot-be-controlled-by-adversary
+
+    Args:
+        state (str): OpenVex status string.
+
+    Returns:
+        dict: CycloneDX analysis dict with 'state' and optional 'justification'.
+    """
+    MAPPING = {
+        "fixed": {
+            "state": "resolved",
+        },
+        "not-affected-component-not-present": {
+            "state": "false_positive",
+        },
+        "not-affected-vulnerable-code-not-present": {
+            "state": "not_affected",
+            "justification": "code_not_present",
+        },
+        "not-affected-vulnerable-code-not-in-execute-path": {
+            "state": "not_affected",
+            "justification": "code_not_reachable",
+        },
+        "not-affected-vulnerable-code-cannot-be-controlled-by-adversary": {
+            "state": "not_affected",
+            "justification": "protected_by_mitigating_control",
+        },
+    }
+    return MAPPING.get(state, {"state": "in_triage"})
 
 def cyclonedx_vulnerabilities(show_info_dict):
     """Create a JSON list of vulnerabilities ignored by buildroot and associate
@@ -421,20 +458,38 @@ def cyclonedx_vulnerabilities(show_info_dict):
         for cve in comp.get('ignore_cves', []):
             cves.setdefault(cve, []).append(name)
 
-    return [{
-        "id": cve,
-        "source": {
-            "name": "NVD",
-            "url": "https://nvd.nist.gov/vuln/detail/" + cve
-        },
-        "analysis": {
-            "state": "resolved_with_pedigree" if cve in VULN_WITH_PEDIGREE else "in_triage",
-            "detail": f"The CVE '{cve}' has been marked as ignored by Buildroot"
-        },
-        "affects": [
-            {"ref": bomref} for bomref in components
-        ]
-    } for cve, components in cves.items()]
+    ret = []
+    for cve, components in cves.items():
+        # retrieve first occurance of the "cves_status" for this CVE.
+        cve_status = next(
+            (status for comp_name in components
+             if (status := show_info_dict.get(comp_name, {}).get("cves_status", {}).get(cve, {}))),
+            {}
+        )
+
+        if cve in VULN_WITH_PEDIGREE:
+            state = {"state": "resolved_with_pedigree"}
+        else:
+            state = openvex_to_cyclonedx_analysis(cve_status.get("status"))
+
+        detail = cve_status.get("detail", f"The CVE '{cve}' has been marked as ignored by Buildroot")
+
+        ret.append({
+            "id": cve,
+            "source": {
+                "name": "NVD",
+                "url": "https://nvd.nist.gov/vuln/detail/" + cve
+            },
+            "analysis": {
+                **state,
+                "detail": detail
+            },
+            "affects": [
+                {"ref": bomref} for bomref in components
+            ]
+        })
+
+    return ret
 
 
 def br2_virtual_is_provided_by(ref, show_info_dict) -> list:
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 05/14] package/sox: add vulnerabilities details

[Thomas Perale via buildroot]

All the vulnerabilities have been already fixed in the upstream used by
Buildroot but no new upstream version have been created. The CPE still
reference the last known version.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/sox/sox.mk | 41 ++++++++++++++++++++++++++++-------------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/package/sox/sox.mk b/package/sox/sox.mk
index 9fd3f2151c..90121cd02c 100644
--- a/package/sox/sox.mk
+++ b/package/sox/sox.mk
@@ -19,45 +19,60 @@ SOX_AUTORECONF = YES
 SOX_AUTORECONF_OPTS = --include=$(HOST_DIR)/share/autoconf-archive
 SOX_INSTALL_STAGING = YES
 
-# sox-14.4.2-6-g6e177c45
 SOX_IGNORE_CVES += CVE-2017-11332
+SOX_CVE-2017-11332_STATUS = fixed
+SOX_CVE-2017-11332_DETAIL = sox-14.4.2-6-g6e177c45
 
-# sox-14.4.2-7-ge410d00c
 SOX_IGNORE_CVES += CVE-2017-11358
+SOX_CVE-2017-11358_STATUS = fixed
+SOX_CVE-2017-11358_DETAIL = sox-14.4.2-7-ge410d00c
 
-# sox-14.4.2-8-g7b3f30e1
 SOX_IGNORE_CVES += CVE-2017-11359
+SOX_CVE-2017-11359_STATUS = fixed
+SOX_CVE-2017-11359_DETAIL = sox-14.4.2-8-g7b3f30e1
 
-# sox-14.4.2-9-ge076a7ad
 SOX_IGNORE_CVES += CVE-2017-15370
+SOX_CVE-2017-11370_STATUS = fixed
+SOX_CVE-2017-11370_DETAIL = sox-14.4.2-9-ge076a7ad
 
-# sox-14.4.2-10-g968c689a
 SOX_IGNORE_CVES += CVE-2017-15371
+SOX_CVE-2017-11371_STATUS = fixed
+SOX_CVE-2017-11371_DETAIL = sox-14.4.2-10-g968c689a
 
-# sox-14.4.2-11-g515b9861
 SOX_IGNORE_CVES += CVE-2017-15372
+SOX_CVE-2017-11372_STATUS = fixed
+SOX_CVE-2017-11372_DETAIL = sox-14.4.2-11-g515b9861
 
-# sox-14.4.2-12-gf56c0dbc
 SOX_IGNORE_CVES += CVE-2017-15642
+SOX_CVE-2017-15642_STATUS = fixed
+SOX_CVE-2017-15642_DETAIL = sox-14.4.2-12-gf56c0dbc
 
-# sox-14.4.2-13-g09d7388c
 # CVE-2019-1010004 is a duplicate of CVE-2017-18189
 SOX_IGNORE_CVES += CVE-2017-18189 CVE-2019-1010004
+SOX_CVE-2017-18189_STATUS = fixed
+SOX_CVE-2017-18189_DETAIL = sox-14.4.2-13-g09d7388c
+SOX_CVE-2019-1010004_STATUS = fixed
+SOX_CVE-2019-1010004_DETAIL = sox-14.4.2-13-g09d7388c
 
-# sox-14.4.2-38-gf7091126
 SOX_IGNORE_CVES += CVE-2019-8354
+SOX_CVE-2019-8354_STATUS = fixed
+SOX_CVE-2019-8354_DETAIL = sox-14.4.2-38-gf7091126
 
-# sox-14.4.2-39-gf8587e2d
 SOX_IGNORE_CVES += CVE-2019-8355
+SOX_CVE-2019-8355_STATUS = fixed
+SOX_CVE-2019-8355_DETAIL = sox-14.4.2-39-gf8587e2d
 
-# sox-14.4.2-40-gb7883ae1
 SOX_IGNORE_CVES += CVE-2019-8356
+SOX_CVE-2019-8356_STATUS = fixed
+SOX_CVE-2019-8356_DETAIL = sox-14.4.2-40-gb7883ae1
 
-# sox-14.4.2-41-g2ce02fea
 SOX_IGNORE_CVES += CVE-2019-8357
+SOX_CVE-2019-8357_STATUS = fixed
+SOX_CVE-2019-8357_DETAIL = sox-14.4.2-41-g2ce02fea
 
-# sox-14.4.2-44-g7b6a8892
 SOX_IGNORE_CVES += CVE-2019-13590
+SOX_CVE-2019-13590_STATUS = fixed
+SOX_CVE-2019-13590_DETAIL = sox-14.4.2-44-g7b6a8892
 
 # 0006-voc-word-width-should-never-be-0-to-avoid-division-b.patch
 # This entry is NOT stale, those CVEs are not reported by pkg-stats
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 06/14] package/php: add vulnerability details

[Thomas Perale via buildroot]

Mark the vulnerability as 'not-affected-vulnerable-code-not-present' as
the vulnerability only affect windows systems.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/php/php.mk | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package/php/php.mk b/package/php/php.mk
index 0bfb12a8eb..6160248c51 100644
--- a/package/php/php.mk
+++ b/package/php/php.mk
@@ -15,8 +15,9 @@ PHP_LICENSE = PHP-3.01
 PHP_LICENSE_FILES = LICENSE
 PHP_CPE_ID_VENDOR = php
 
-# Only affects the Windows operating system
 PHP_IGNORE_CVES += CVE-2024-3566
+PHP_CVE-2024-3566_STATUS = not-affected-vulnerable-code-not-present
+PHP_CVE-2024-3566_DETAIL = Only affects the Windows operating system but cve.py doesn't support environment check
 
 PHP_CONF_OPTS = \
 	--mandir=/usr/share/man \
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 07/14] package/mupdf: add vulnerabilities details

[Thomas Perale via buildroot]

Those vulnerabilities applies to another package and have been then
marked as 'not-affected-vulnerable-code-not-present'.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/mupdf/mupdf.mk | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package/mupdf/mupdf.mk b/package/mupdf/mupdf.mk
index c538b9bec8..8d96b18062 100644
--- a/package/mupdf/mupdf.mk
+++ b/package/mupdf/mupdf.mk
@@ -21,11 +21,11 @@ MUPDF_DEPENDENCIES = \
 	lcms2 openjpeg \
 	zlib
 
-# Fix is in libfreeglut, but CVE applied to mupdf 1.23.9.
-# Buildroot libfreeglut is >3.4.0 then is not affected.
-MUPDF_IGNORE_CVES = \
-	CVE-2024-24258 \
-	CVE-2024-24259
+MUPDF_IGNORE_CVES += CVE-2024-24258 CVE-2024-24259
+MUPDF_CVE-2024-24258_STATUS = not-affected-vulnerable-code-not-present
+MUPDF_CVE-2024-24258_DETAIL = Fix is in libfreeglut, but CVE applied to mupdf 1.23.9
+MUPDF_CVE-2024-24259_STATUS = not-affected-vulnerable-code-not-present
+MUPDF_CVE-2024-24259_DETAIL = Fix is in libfreeglut, but CVE applied to mupdf 1.23.9
 
 # 0001-Fix-incorrect-error-case-free-of-pixmap.patch
 MUPDF_IGNORE_CVES += CVE-2026-25556
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 08/14] package/python-pip: add detail to vulnerability

[Thomas Perale via buildroot]

The vulnerability is marked as fixed as it work as expected according to
the upstream project.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/python-pip/python-pip.mk | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/package/python-pip/python-pip.mk b/package/python-pip/python-pip.mk
index d12bea3225..ae9a4225eb 100644
--- a/package/python-pip/python-pip.mk
+++ b/package/python-pip/python-pip.mk
@@ -12,9 +12,10 @@ PYTHON_PIP_LICENSE = MIT
 PYTHON_PIP_LICENSE_FILES = LICENSE.txt
 PYTHON_PIP_CPE_ID_VENDOR = pypa
 PYTHON_PIP_CPE_ID_PRODUCT = pip
-# Disputed CVE: things work as designed, and only affects the
-# --extra-index-url option. This CVE will never be fixed.
+
 PYTHON_PIP_IGNORE_CVES += CVE-2018-20225
+PYTHON_PIP_CVE-2018-20225_STATUS = fixed
+PYTHON_PIP_CVE-2018-20225_DETAIL = Disputed CVE: things work as designed, and only affects the --extra-index-url option. This CVE will never be fixed.
 
 $(eval $(python-package))
 $(eval $(host-python-package))
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 09/14] package/luajit: add details to vulnerabilities

[Thomas Perale via buildroot]

Those vulnerabilities has already been addressed upstream but no new
package version have been released with those fixes.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/luajit/luajit.mk | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/package/luajit/luajit.mk b/package/luajit/luajit.mk
index bbd423ad02..ef3e840f8d 100644
--- a/package/luajit/luajit.mk
+++ b/package/luajit/luajit.mk
@@ -12,20 +12,25 @@ LUAJIT_CPE_ID_VENDOR = luajit
 LUAJIT_CPE_ID_VERSION = 2.1.0
 LUAJIT_CPE_ID_UPDATE = beta3
 
-# Fixed in 53f82e6e2e858a0a62fd1a2ff47e9866693382e6
 LUAJIT_IGNORE_CVES += CVE-2020-15890
+LUAJIT_CVE-2020-15890_STATUS = fixed
+LUAJIT_CVE-2020-15890_DETAIL = 53f82e6e2e858a0a62fd1a2ff47e9866693382e6
 
-# Fixed in e296f56b825c688c3530a981dc6b495d972f3d01
 LUAJIT_IGNORE_CVES += CVE-2020-24372
+LUAJIT_CVE-2020-24372_STATUS = fixed
+LUAJIT_CVE-2020-24372_DETAIL = e296f56b825c688c3530a981dc6b495d972f3d01
 
-# Fixed in 343ce0edaf3906a62022936175b2f5410024cbfc
 LUAJIT_IGNORE_CVES += CVE-2024-25176
+LUAJIT_CVE-2024-25176_STATUS = fixed
+LUAJIT_CVE-2024-25176_DETAIL = 343ce0edaf3906a62022936175b2f5410024cbfc
 
-# Fixed in 85b4fed0b0353dd78c8c875c2f562d522a2b310f
 LUAJIT_IGNORE_CVES += CVE-2024-25177
+LUAJIT_CVE-2024-25177_STATUS = fixed
+LUAJIT_CVE-2024-25177_DETAIL = 85b4fed0b0353dd78c8c875c2f562d522a2b310f
 
-# Fixed in defe61a56751a0db5f00ff3ab7b8f45436ba74c8
 LUAJIT_IGNORE_CVES += CVE-2024-25178
+LUAJIT_CVE-2024-25178_STATUS = fixed
+LUAJIT_CVE-2024-25178_DETAIL = defe61a56751a0db5f00ff3ab7b8f45436ba74c8
 
 LUAJIT_INSTALL_STAGING = YES
 
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 10/14] package/libuci: add vulnerability details

[Thomas Perale via buildroot]

Those vulnerabilities has already been addressed upstream but no new
package version have been released with those fixes.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/libuci/libuci.mk | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package/libuci/libuci.mk b/package/libuci/libuci.mk
index 3c7e12baae..2af8f719f3 100644
--- a/package/libuci/libuci.mk
+++ b/package/libuci/libuci.mk
@@ -13,8 +13,9 @@ LIBUCI_CPE_ID_VENDOR = openwrt
 LIBUCI_INSTALL_STAGING = YES
 LIBUCI_DEPENDENCIES = libubox
 
-# Fixed in commit 19e29ffc15dbd958e8e6a648ee0982c68353516f, older than LIBUCI_VERSION
 LIBUCI_IGNORE_CVES += CVE-2019-15513
+LIBUCI_CVE-2019-15513_STATUS = fixed
+LIBUCI_CVE-2019-15513_DETAIL = 19e29ffc15dbd958e8e6a648ee0982c68353516f
 
 ifeq ($(BR2_PACKAGE_LUA_5_1),y)
 LIBUCI_DEPENDENCIES += lua
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 11/14] package/glibc: add vulnerability details

[Thomas Perale via buildroot]

Those vulnerabilities has already been addressed upstream but no new
package version have been released with those fixes.

The CVE-2010-4756 is not considered as a security issue by the upstream
project and is then marked as fixed.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/glibc/glibc.mk | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
index 4a6bc94634..9edab5e4d2 100644
--- a/package/glibc/glibc.mk
+++ b/package/glibc/glibc.mk
@@ -19,37 +19,45 @@ GLIBC_CPE_ID_VENDOR = gnu
 # allow proper matching with the CPE database.
 GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION)))
 
-# Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
 GLIBC_IGNORE_CVES += CVE-2025-8058
+GLIBC_CVE-2026-8058_STATUS = fixed
+GLIBC_CVE-2026-8058_DETAIL = glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
 
-# Fixed by glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
 GLIBC_IGNORE_CVES += CVE-2026-0861
+GLIBC_CVE-2026-0861_STATUS = fixed
+GLIBC_CVE-2026-0861_DETAIL = glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
 
-# Fixed by glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
 GLIBC_IGNORE_CVES += CVE-2026-0915
+GLIBC_CVE-2026-0915_STATUS = fixed
+GLIBC_CVE-2026-0915_DETAIL = glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
 
-# Fixed by glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
 GLIBC_IGNORE_CVES += CVE-2025-15281
+GLIBC_CVE-2025-15281_STATUS = fixed
+GLIBC_CVE-2025-15281_DETAIL = glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
 
-# Fixed by glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
 GLIBC_IGNORE_CVES += CVE-2026-4437
+GLIBC_CVE-2026-4437_STATUS = fixed
+GLIBC_CVE-2026-4437_DETAIL = glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
 
-# Fixed by glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
 GLIBC_IGNORE_CVES += CVE-2026-4438
+GLIBC_CVE-2026-4438_STATUS = fixed
+GLIBC_CVE-2026-4438_DETAIL = glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
 
-# Fixed by glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
 GLIBC_IGNORE_CVES += CVE-2026-4046
+GLIBC_CVE-2026-4046_STATUS = fixed
+GLIBC_CVE-2026-4046_DETAIL = glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
 
-# Fixed by glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
 GLIBC_IGNORE_CVES += CVE-2026-5928
+GLIBC_CVE-2026-5928_STATUS = fixed
+GLIBC_CVE-2026-5928_DETAIL = glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
 
-# Fixed by glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
 GLIBC_IGNORE_CVES += CVE-2026-5450
+GLIBC_CVE-2026-5450_STATUS = fixed
+GLIBC_CVE-2026-5450_DETAIL = glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
 
-# This CVE is considered as not being security issues by
-# upstream glibc:
-#  https://security-tracker.debian.org/tracker/CVE-2010-4756
 GLIBC_IGNORE_CVES += CVE-2010-4756
+GLIBC_CVE-2010-4756_STATUS = fixed
+GLIBC_CVE-2010-4756_DETAIL = This CVE is considered as not being security issues by upstream glibc: https://security-tracker.debian.org/tracker/CVE-2010-4756
 
 # glibc is part of the toolchain so disable the toolchain dependency
 GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 12/14] package/freeradius-server: add vulnerabilities details

[Thomas Perale via buildroot]

Those vulnerabilities has already been addressed upstream but the NVD
entries are wrong.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/freeradius-server/freeradius-server.mk | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/package/freeradius-server/freeradius-server.mk b/package/freeradius-server/freeradius-server.mk
index 80ace1c130..0ebaec8e73 100644
--- a/package/freeradius-server/freeradius-server.mk
+++ b/package/freeradius-server/freeradius-server.mk
@@ -15,12 +15,13 @@ FREERADIUS_SERVER_CPE_ID_PRODUCT = freeradius
 FREERADIUS_SERVER_DEPENDENCIES = libtalloc
 FREERADIUS_SERVER_AUTORECONF = YES
 
-# Mitigated upstream since version 0.5.0, NVD database entry not
-# up-to-date
 FREERADIUS_SERVER_IGNORE_CVES += CVE-2002-0318
+FREERADIUS_CVE-2002-0318_STATUS = fixed
+FREERADIUS_CVE-2002-0318_DETAIL = Mitigated upstream since version 0.5.0, NVD database entry not up-to-date
 
-# Fixed in 2.2.0, NVD database entry not up-to-date
 FREERADIUS_SERVER_IGNORE_CVES += CVE-2011-4966
+FREERADIUS_CVE-2011-4966_STATUS = fixed
+FREERADIUS_CVE-2011-4966_DETAIL = Fixed in 2.2.0, NVD database entry not up-to-date
 
 # We're patching src/modules/rlm_krb5/configure.ac
 define FREERADIUS_SERVER_RUN_KRB5_AUTORECONF
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 13/14] package/flex: add vulnerability details

[Thomas Perale via buildroot]

The upstream project as discarded the vulnerability as it works as
expected.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/flex/flex.mk | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/package/flex/flex.mk b/package/flex/flex.mk
index c6417fea83..2acd6d1e3d 100644
--- a/package/flex/flex.mk
+++ b/package/flex/flex.mk
@@ -10,12 +10,13 @@ FLEX_INSTALL_STAGING = YES
 FLEX_LICENSE = FLEX
 FLEX_LICENSE_FILES = COPYING
 FLEX_CPE_ID_VENDOR = westes
-# bug does not cause stack overflows in the generated code and has been
-# noted upstream as a bug in the code generator
-FLEX_IGNORE_CVES = CVE-2019-6293
 FLEX_DEPENDENCIES = $(TARGET_NLS_DEPENDENCIES) host-m4
 HOST_FLEX_DEPENDENCIES = host-m4
 
+FLEX_IGNORE_CVES = CVE-2019-6293
+FLEX_CVE-2019-6293_STATUS = not-affected-vulnerable-code-not-present
+FLEX_CVE-2019-6293_DETAIL = bug does not cause stack overflows in the generated code and has been noted upstream as a bug in the code generator
+
 # 0001-build-AC_USE_SYSTEM_EXTENSIONS-in-configure.ac.patch
 # 0002-build-make-it-possible-to-disable-the-build-of-the-f.patch
 # 0003-build-make-it-possible-to-disable-the-build-of-the-d.patch
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [RFC PATCH 14/14] package/clamav: add vulnerability details

[Thomas Perale via buildroot]

This vulnerability only affects Cisco device and is then marked as not
present in this case.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/clamav/clamav.mk | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/package/clamav/clamav.mk b/package/clamav/clamav.mk
index 7f8008ab5f..80935fede2 100644
--- a/package/clamav/clamav.mk
+++ b/package/clamav/clamav.mk
@@ -21,8 +21,6 @@ CLAMAV_LICENSE_FILES = \
 	COPYING/COPYING.zlib
 CLAMAV_CPE_ID_VENDOR = clamav
 CLAMAV_SELINUX_MODULES = clamav
-# affects only Cisco devices
-CLAMAV_IGNORE_CVES += CVE-2016-1405
 CLAMAV_DEPENDENCIES = \
 	bzip2 \
 	host-pkgconf \
@@ -36,6 +34,10 @@ CLAMAV_DEPENDENCIES = \
 	zlib \
 	$(TARGET_NLS_DEPENDENCIES)
 
+CLAMAV_IGNORE_CVES += CVE-2016-1405
+CLAMAV_CVE-2016-1405_STATUS = not-affected-vulnerable-code-not-present
+CLAMAV_CVE-2016-1405_DETAIL = affects only Cisco devices
+
 ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
 CLAMAV_LIBS += -latomic
 endif
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [RFC PATCH 11/14] package/glibc: add vulnerability details

[Romain Naour via buildroot]

Hello Thomas, All,

Le 24/06/2026 à 16:06, Thomas Perale via buildroot a écrit :
> Those vulnerabilities has already been addressed upstream but no new
> package version have been released with those fixes.
> 
> The CVE-2010-4756 is not considered as a security issue by the upstream
> project and is then marked as fixed.
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>  package/glibc/glibc.mk | 32 ++++++++++++++++++++------------
>  1 file changed, 20 insertions(+), 12 deletions(-)
> 
> diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
> index 4a6bc94634..9edab5e4d2 100644
> --- a/package/glibc/glibc.mk
> +++ b/package/glibc/glibc.mk
> @@ -19,37 +19,45 @@ GLIBC_CPE_ID_VENDOR = gnu
>  # allow proper matching with the CPE database.
>  GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION)))
>  
> -# Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
>  GLIBC_IGNORE_CVES += CVE-2025-8058
> +GLIBC_CVE-2026-8058_STATUS = fixed
> +GLIBC_CVE-2026-8058_DETAIL = glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65

While updating my mailbox, I noticed this typo: CVE-2025-8058 vs CVE-2026-8058

Maybe checkpackage could check for this?

Best regards,
Romain

>  
> -# Fixed by glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
>  GLIBC_IGNORE_CVES += CVE-2026-0861
> +GLIBC_CVE-2026-0861_STATUS = fixed
> +GLIBC_CVE-2026-0861_DETAIL = glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
>  
> -# Fixed by glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
>  GLIBC_IGNORE_CVES += CVE-2026-0915
> +GLIBC_CVE-2026-0915_STATUS = fixed
> +GLIBC_CVE-2026-0915_DETAIL = glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
>  
> -# Fixed by glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
>  GLIBC_IGNORE_CVES += CVE-2025-15281
> +GLIBC_CVE-2025-15281_STATUS = fixed
> +GLIBC_CVE-2025-15281_DETAIL = glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
>  
> -# Fixed by glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
>  GLIBC_IGNORE_CVES += CVE-2026-4437
> +GLIBC_CVE-2026-4437_STATUS = fixed
> +GLIBC_CVE-2026-4437_DETAIL = glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
>  
> -# Fixed by glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
>  GLIBC_IGNORE_CVES += CVE-2026-4438
> +GLIBC_CVE-2026-4438_STATUS = fixed
> +GLIBC_CVE-2026-4438_DETAIL = glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
>  
> -# Fixed by glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
>  GLIBC_IGNORE_CVES += CVE-2026-4046
> +GLIBC_CVE-2026-4046_STATUS = fixed
> +GLIBC_CVE-2026-4046_DETAIL = glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
>  
> -# Fixed by glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
>  GLIBC_IGNORE_CVES += CVE-2026-5928
> +GLIBC_CVE-2026-5928_STATUS = fixed
> +GLIBC_CVE-2026-5928_DETAIL = glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
>  
> -# Fixed by glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
>  GLIBC_IGNORE_CVES += CVE-2026-5450
> +GLIBC_CVE-2026-5450_STATUS = fixed
> +GLIBC_CVE-2026-5450_DETAIL = glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
>  
> -# This CVE is considered as not being security issues by
> -# upstream glibc:
> -#  https://security-tracker.debian.org/tracker/CVE-2010-4756
>  GLIBC_IGNORE_CVES += CVE-2010-4756
> +GLIBC_CVE-2010-4756_STATUS = fixed
> +GLIBC_CVE-2010-4756_DETAIL = This CVE is considered as not being security issues by upstream glibc: https://security-tracker.debian.org/tracker/CVE-2010-4756
>  
>  # glibc is part of the toolchain so disable the toolchain dependency
>  GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [RFC PATCH 11/14] package/glibc: add vulnerability details

[Thomas Perale via buildroot]

Hi Romain,

In reply of:
> Hello Thomas, All,
> 
> Le 24/06/2026 à 16:06, Thomas Perale via buildroot a écrit :
> > Those vulnerabilities has already been addressed upstream but no new
> > package version have been released with those fixes.
> > 
> > The CVE-2010-4756 is not considered as a security issue by the upstream
> > project and is then marked as fixed.
> > 
> > Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> > ---
> >  package/glibc/glibc.mk | 32 ++++++++++++++++++++------------
> >  1 file changed, 20 insertions(+), 12 deletions(-)
> > 
> > diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
> > index 4a6bc94634..9edab5e4d2 100644
> > --- a/package/glibc/glibc.mk
> > +++ b/package/glibc/glibc.mk
> > @@ -19,37 +19,45 @@ GLIBC_CPE_ID_VENDOR = gnu
> >  # allow proper matching with the CPE database.
> >  GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION)))
> >  
> > -# Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
> >  GLIBC_IGNORE_CVES += CVE-2025-8058
> > +GLIBC_CVE-2026-8058_STATUS = fixed
> > +GLIBC_CVE-2026-8058_DETAIL = glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
> 
> While updating my mailbox, I noticed this typo: CVE-2025-8058 vs CVE-2026-8058
> 
> Maybe checkpackage could check for this?
> 
> Best regards,
> Romain

Good catch thanks ! I will add this to the checkpackage check I added for the
"_STATUS" content.

> >  
> > -# Fixed by glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
> >  GLIBC_IGNORE_CVES += CVE-2026-0861
> > +GLIBC_CVE-2026-0861_STATUS = fixed
> > +GLIBC_CVE-2026-0861_DETAIL = glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
> >  
> > -# Fixed by glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
> >  GLIBC_IGNORE_CVES += CVE-2026-0915
> > +GLIBC_CVE-2026-0915_STATUS = fixed
> > +GLIBC_CVE-2026-0915_DETAIL = glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
> >  
> > -# Fixed by glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
> >  GLIBC_IGNORE_CVES += CVE-2025-15281
> > +GLIBC_CVE-2025-15281_STATUS = fixed
> > +GLIBC_CVE-2025-15281_DETAIL = glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
> >  
> > -# Fixed by glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
> >  GLIBC_IGNORE_CVES += CVE-2026-4437
> > +GLIBC_CVE-2026-4437_STATUS = fixed
> > +GLIBC_CVE-2026-4437_DETAIL = glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
> >  
> > -# Fixed by glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
> >  GLIBC_IGNORE_CVES += CVE-2026-4438
> > +GLIBC_CVE-2026-4438_STATUS = fixed
> > +GLIBC_CVE-2026-4438_DETAIL = glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
> >  
> > -# Fixed by glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
> >  GLIBC_IGNORE_CVES += CVE-2026-4046
> > +GLIBC_CVE-2026-4046_STATUS = fixed
> > +GLIBC_CVE-2026-4046_DETAIL = glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
> >  
> > -# Fixed by glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
> >  GLIBC_IGNORE_CVES += CVE-2026-5928
> > +GLIBC_CVE-2026-5928_STATUS = fixed
> > +GLIBC_CVE-2026-5928_DETAIL = glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
> >  
> > -# Fixed by glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
> >  GLIBC_IGNORE_CVES += CVE-2026-5450
> > +GLIBC_CVE-2026-5450_STATUS = fixed
> > +GLIBC_CVE-2026-5450_DETAIL = glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
> >  
> > -# This CVE is considered as not being security issues by
> > -# upstream glibc:
> > -#  https://security-tracker.debian.org/tracker/CVE-2010-4756
> >  GLIBC_IGNORE_CVES += CVE-2010-4756
> > +GLIBC_CVE-2010-4756_STATUS = fixed
> > +GLIBC_CVE-2010-4756_DETAIL = This CVE is considered as not being security issues by upstream glibc: https://security-tracker.debian.org/tracker/CVE-2010-4756
> >  
> >  # glibc is part of the toolchain so disable the toolchain dependency
> >  GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot


_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [RFC PATCH 08/14] package/python-pip: add detail to vulnerability

[Fiona Klute via buildroot]

Hi Thomas!

Am 24.06.26 um 16:06 schrieb Thomas Perale via buildroot:
> The vulnerability is marked as fixed as it work as expected according to
> the upstream project.
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>   package/python-pip/python-pip.mk | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/package/python-pip/python-pip.mk b/package/python-pip/python-pip.mk
> index d12bea3225..ae9a4225eb 100644
> --- a/package/python-pip/python-pip.mk
> +++ b/package/python-pip/python-pip.mk
> @@ -12,9 +12,10 @@ PYTHON_PIP_LICENSE = MIT
>   PYTHON_PIP_LICENSE_FILES = LICENSE.txt
>   PYTHON_PIP_CPE_ID_VENDOR = pypa
>   PYTHON_PIP_CPE_ID_PRODUCT = pip
> -# Disputed CVE: things work as designed, and only affects the
> -# --extra-index-url option. This CVE will never be fixed.
> +
>   PYTHON_PIP_IGNORE_CVES += CVE-2018-20225
> +PYTHON_PIP_CVE-2018-20225_STATUS = fixed
> +PYTHON_PIP_CVE-2018-20225_DETAIL = Disputed CVE: things work as designed, and only affects the --extra-index-url option. This CVE will never be fixed.

I don't like using "fixed" for "upstream maintainers don't see this as a 
problem". Nothing was fixed, the dispute is whether anything needs fixing.

Looking at the OpenVEX status labels "not_affected" or 
"under_investigation" seem to fit better (depending on whether we agree 
with upstream or not, I guess if we don't adding to IGNORE_CVES would be 
questionable), but I don't see any way to clearly express "disputed" 
among those options.

Best regards,
Fiona

>   
>   $(eval $(python-package))
>   $(eval $(host-python-package))

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [RFC PATCH 04/14] utils/generate-cyclonedx: support vulnerability details

[Fiona Klute via buildroot]

Am 24.06.26 um 16:06 schrieb Thomas Perale via buildroot:
> Translate the OpenVex notation used to describe the vulnerabilities that
> aren't patched in Buildroot into the CycloneDX format.
> 
> - fixed -> resolved
> - not-affected-component-not-present -> false_positive
> - not-affected-vulnerable-code-not-present -> not_affected &
>    code_not_present
> - not-affected-vulnerable-code-not-in-execute-path -> not_affected &
>    code_not_reachable
> - not-affected-vulnerable-code-cannot-be-controlled-by-adversary -> not_affected &
>    protected_by_mitigating_control
> 
> See https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_analysis
> for more information
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>   utils/generate-cyclonedx | 83 +++++++++++++++++++++++++++++++++-------
>   1 file changed, 69 insertions(+), 14 deletions(-)
> 
> diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
> index df12ee84c0..c1aa1f980d 100755
> --- a/utils/generate-cyclonedx
> +++ b/utils/generate-cyclonedx
> @@ -403,6 +403,43 @@ def cyclonedx_dependency(ref, depends):
>           "dependsOn": sorted(depends),
>       }
>   
> +def openvex_to_cyclonedx_analysis(state) -> dict:
> +    """Convert an OpenVex vulnerability state into a CycloneDX analysis.
> +
> +    Supported:
> +      - fixed
> +      - not-affected-component-not-present
> +      - not-affected-vulnerable-code-not-present
> +      - not-affected-vulnerable-code-not-in-execute-path
> +      - not-affected-vulnerable-code-cannot-be-controlled-by-adversary
> +
> +    Args:
> +        state (str): OpenVex status string.
> +
> +    Returns:
> +        dict: CycloneDX analysis dict with 'state' and optional 'justification'.
> +    """
> +    MAPPING = {
> +        "fixed": {
> +            "state": "resolved",
> +        },
> +        "not-affected-component-not-present": {
> +            "state": "false_positive",
> +        },
> +        "not-affected-vulnerable-code-not-present": {
> +            "state": "not_affected",
> +            "justification": "code_not_present",
> +        },
> +        "not-affected-vulnerable-code-not-in-execute-path": {
> +            "state": "not_affected",
> +            "justification": "code_not_reachable",
> +        },
> +        "not-affected-vulnerable-code-cannot-be-controlled-by-adversary": {
> +            "state": "not_affected",
> +            "justification": "protected_by_mitigating_control",
> +        },
> +    }
> +    return MAPPING.get(state, {"state": "in_triage"})

Maybe a bit nitpicky for an RFC, but MAPPING is a constant, so it should 
probably be at module level (with a prefix added to the name) instead of 
recreating it on every call to this function.

Best regards,
Fiona

>   
>   def cyclonedx_vulnerabilities(show_info_dict):
>       """Create a JSON list of vulnerabilities ignored by buildroot and associate
> @@ -421,20 +458,38 @@ def cyclonedx_vulnerabilities(show_info_dict):
>           for cve in comp.get('ignore_cves', []):
>               cves.setdefault(cve, []).append(name)
>   
> -    return [{
> -        "id": cve,
> -        "source": {
> -            "name": "NVD",
> -            "url": "https://nvd.nist.gov/vuln/detail/" + cve
> -        },
> -        "analysis": {
> -            "state": "resolved_with_pedigree" if cve in VULN_WITH_PEDIGREE else "in_triage",
> -            "detail": f"The CVE '{cve}' has been marked as ignored by Buildroot"
> -        },
> -        "affects": [
> -            {"ref": bomref} for bomref in components
> -        ]
> -    } for cve, components in cves.items()]
> +    ret = []
> +    for cve, components in cves.items():
> +        # retrieve first occurance of the "cves_status" for this CVE.
> +        cve_status = next(
> +            (status for comp_name in components
> +             if (status := show_info_dict.get(comp_name, {}).get("cves_status", {}).get(cve, {}))),
> +            {}
> +        )
> +
> +        if cve in VULN_WITH_PEDIGREE:
> +            state = {"state": "resolved_with_pedigree"}
> +        else:
> +            state = openvex_to_cyclonedx_analysis(cve_status.get("status"))
> +
> +        detail = cve_status.get("detail", f"The CVE '{cve}' has been marked as ignored by Buildroot")
> +
> +        ret.append({
> +            "id": cve,
> +            "source": {
> +                "name": "NVD",
> +                "url": "https://nvd.nist.gov/vuln/detail/" + cve
> +            },
> +            "analysis": {
> +                **state,
> +                "detail": detail
> +            },
> +            "affects": [
> +                {"ref": bomref} for bomref in components
> +            ]
> +        })
> +
> +    return ret
>   
>   
>   def br2_virtual_is_provided_by(ref, show_info_dict) -> list:

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [RFC PATCH 08/14] package/python-pip: add detail to vulnerability

[Thomas Perale via buildroot]

Hi Fiona,

Thanks for already taking the time to look at this series.

In reply of:
> Hi Thomas!
> 
> Am 24.06.26 um 16:06 schrieb Thomas Perale via buildroot:
> > The vulnerability is marked as fixed as it work as expected according to
> > the upstream project.
> > > Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> > ---
> >   package/python-pip/python-pip.mk | 5 +++--
> >   1 file changed, 3 insertions(+), 2 deletions(-)
> > > diff --git a/package/python-pip/python-pip.mk b/package/python-pip/python-pip.mk
> > index d12bea3225..ae9a4225eb 100644
> > --- a/package/python-pip/python-pip.mk
> > +++ b/package/python-pip/python-pip.mk
> > @@ -12,9 +12,10 @@ PYTHON_PIP_LICENSE = MIT
> >   PYTHON_PIP_LICENSE_FILES = LICENSE.txt
> >   PYTHON_PIP_CPE_ID_VENDOR = pypa
> >   PYTHON_PIP_CPE_ID_PRODUCT = pip
> > -# Disputed CVE: things work as designed, and only affects the
> > -# --extra-index-url option. This CVE will never be fixed.
> > +
> >   PYTHON_PIP_IGNORE_CVES += CVE-2018-20225
> > +PYTHON_PIP_CVE-2018-20225_STATUS = fixed
> > +PYTHON_PIP_CVE-2018-20225_DETAIL = Disputed CVE: things work as designed, and only affects the --extra-index-url option. This CVE will never be fixed.
> 
> I don't like using "fixed" for "upstream maintainers don't see this as a problem". Nothing was fixed, the dispute is whether anything needs fixing.
> 

I definitely agree and I don't like it either but I feel that the options
OpenVex and CycloneDX provides are limited for that specific case.

If I understand correctly it's because you need to actually put the upstream
project justification in a category.

For example for the flex example the project disputed the vulnerability by
claiming it doesn't produce a vulnerable code so I used the
"not-affected-vulnerable-code-not-present" category.

Here my logic was that since it's the expected behavior it's not a
vulnerability at all and then could mark it as fixed. But indeed I
over-interpret the "fixed" category.

> Looking at the OpenVEX status labels "not_affected" or "under_investigation" seem to fit better (depending on whether we agree with upstream or not, I guess if we don't adding to IGNORE_CVES would be questionable), but I don't see any way to clearly express "disputed" among those options.

For the "under_investigation", it means this would map to "in_triage" for
CycloneDX and that's what I'm trying to remove with this series to be able to
filter any vulnerabilities that don't provide a "status".

For "not_affected" the spec specify that we need to provide a justification
with it [1]. But I don't see a justification that really suits this specific
case.

To be honest, the more I look at the categories and the one I already assigned
to the packages the more I think other categories could be used as a
justification. It's really confusing.

Best regards,
PERALE Thomas

[1] https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_analysis_justification
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [RFC PATCH 01/14] docs/manual: add vulnerability status and justification

[Thomas Petazzoni via buildroot]

Hello Thomas,

On Wed, Jun 24, 2026 at 04:06:32PM +0200, Thomas Perale via buildroot wrote:
> In Buildroot, we can put the ignore CVEs entries in different
> categories:
> 
> - Vulnerability fixed by a patch.
> - Vulnerability ignored because the internal tooling detect it as a
>   false positive
> - Vulnerability ignored because the database is wrong or not up-to-date.
> - Vulnerability ignored because it doesn't apply to Buildroot
>   (platform/hardware specific, ...).
> - Vulnerability ignored because Buildroot is using an upstream fixed
>   version (based on a hash for instance) while the CPE metadata
>   reference the latest known version.
> 
> Since the introduction of `_IGNORE_CVES` the justification for the
> vulnerability were added as a comment on top of the ignored
> vulnerability. With the introduction of the rule for the `CVE:` trailer
> it's now possible to distinguish the vulnerabilities that are patched
> from the one that are not-applicable for another unknown reason.
> 
> This commit add documentation to introduce two new variables:
> 
> - `<pkg>_<vuln-id>_STATUS`
> - `<pkg>_<vuln-id>_DETAIL`
> 
> This allows to have machine readable variables that are exposed and
> contains the reasons why a vulnerability is set as ignored instead of
> storing this knowledge in a comment on top of the `_IGNORE_CVES` entry.
> 
> The `<pkg>_<vuln-id>_STATUS` syntax is based on OpenVex statuses syntax
> [1][2]. This varialbe only needs to be used if a patch on the Buildroot
> tree isn't present.
> 
> The `<pkg>_<vuln-id>_DETAIL` is a free text field that allows to add
> more information to justify the status.
> 
> [1] https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-labels
> [2] https://github.com/openvex/ospec/blob/main/OPENVEX-SPEC.md#status-justifications
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Thanks for this proposal. Overall I find it nice and well-aligned with
the Buildroot spirit.

Two comments below.

> +* +LIBFOO_<VULN-ID>_STATUS+ informs about the impact of the vulnerability

Shouldn't you indicate that these properties only make sense when
<VULN-ID> is in <pkg>_IGNORE_CVES ?

> +  +<VULN-ID>+. This variable needs to be set only if the referenced +<VULN-ID>+
> +  is not fixed by a patch present in the Buildroot tree. It support different
> +  labels based on
> +  https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-labels[OpenVex
> +  statuses] and
> +  https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-justifications[justification]:
> +  ** +fixed+: referenced by the package Makefile already includes the fix but

I'm sorry but here I'm unable to parse this sentence "referenced by
the package Makefile already includes the fix", is my English too
limited, or does the sentence really has an issue?

Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [RFC PATCH 03/14] package/pkg-utils: show-info expose vuln details

[Thomas Petazzoni via buildroot]

Hello,

On Wed, Jun 24, 2026 at 04:06:34PM +0200, Thomas Perale via buildroot wrote:
> For each `_IGNORE_CVES` entries the status and details are exported if
> present.

Perhaps this wording could be a bit nicer?

"This commit expands show-info so that for each CVE listed in the
<pk>_IGNORE_CVES variable, additional information will be provided:
the status and details, according to the information provided by the
following variables:

> 
> - `<pkg>_<vuln-id>_STATUS`
> - `<pkg>_<vuln-id>_DETAIL`
> 
> For a hypotetical 'CVE-2025-1234' that affects the package 'foo' with
            ^^^^ h missing somewhere here ?
      ^^ an ?

> the following declaration:
> 
> ```
> FOO_CVE-2025-1234_STATUS = fixed
> FOO_CVE-2025-1234_DETAIL = some details
> ```
> 
> Will result in the following show info output.

The sentence doesn't work:

"""
For an hypothetical CVE that affects package foo with the following
declaration will result in the following show info output.
"""

You want to change the last part so that it gives:

"""
For an hypothetical CVE that affects package foo with the following
declaration, the show-info output will look like:
"""

> diff --git a/package/pkg-utils.mk b/package/pkg-utils.mk
> index 17b0aa1760..c6e509e9d1 100644
> --- a/package/pkg-utils.mk
> +++ b/package/pkg-utils.mk
> @@ -154,6 +154,25 @@ define _json-info-pkg
>  				) \
>  			)
>  		]
> +		$(comma) "cves_status": {
> +			$(foreach cve,$(sort $($(1)_IGNORE_CVES)), \
> +				$(call _json-info-pkg-cve,$(1),$(cve)) \
> +			) \
> +		}

Don't know how we do this for the other show-info stuff, but do we
want to enclose this in an $(if $($(1)_IGNORE_CVES),...) test so that
we don't have an empty "cves_status" property for all packages, and
instead only have one for packages that actually have ignored CVEs?
(Even though admittedly it could still end up being empty, as we might
have ignored CVES but no status/details).

Thanks,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot