* [Buildroot] [PATCH] package/drogon: add CPE information @ 2026-10-27 17:06 Thomas Petazzoni via buildroot 2026-10-27 17:38 ` Thomas Perale via buildroot 0 siblings, 1 reply; 4+ messages in thread From: Thomas Petazzoni via buildroot @ 2026-10-27 17:06 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, Dario Binacchi See: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:drogon:drogon With this, cve-check properly reports CVE-2023-26137 and CVE-2023-26138 as affecting the package. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> --- package/drogon/drogon.mk | 1 + 1 file changed, 1 insertion(+) diff --git a/package/drogon/drogon.mk b/package/drogon/drogon.mk index 8c51d16ac0..4772228960 100644 --- a/package/drogon/drogon.mk +++ b/package/drogon/drogon.mk @@ -10,6 +10,7 @@ DROGON_SITE_METHOD = git DROGON_GIT_SUBMODULES = YES DROGON_LICENSE = MIT DROGON_LICENSE_FILES = LICENSE +DROGON_CPE_ID_VENDOR = drogon DROGON_INSTALL_STAGING = YES DROGON_DEPENDENCIES = jsoncpp util-linux zlib -- 2.56.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH] package/drogon: add CPE information 2026-10-27 17:06 [Buildroot] [PATCH] package/drogon: add CPE information Thomas Petazzoni via buildroot @ 2026-10-27 17:38 ` Thomas Perale via buildroot 2026-10-27 19:23 ` Thomas Petazzoni via buildroot 0 siblings, 1 reply; 4+ messages in thread From: Thomas Perale via buildroot @ 2026-10-27 17:38 UTC (permalink / raw) To: Thomas Petazzoni; +Cc: Thomas Perale, buildroot, Dario Binacchi Hi Thomas, In reply of: > See: > > https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:drogon:drogon > > With this, cve-check properly reports CVE-2023-26137 and > CVE-2023-26138 as affecting the package. > > Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> > --- > package/drogon/drogon.mk | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/package/drogon/drogon.mk b/package/drogon/drogon.mk > index 8c51d16ac0..4772228960 100644 > --- a/package/drogon/drogon.mk > +++ b/package/drogon/drogon.mk > @@ -10,6 +10,7 @@ DROGON_SITE_METHOD = git > DROGON_GIT_SUBMODULES = YES > DROGON_LICENSE = MIT > DROGON_LICENSE_FILES = LICENSE > +DROGON_CPE_ID_VENDOR = drogon Also need to include the following DROGON_CPE_ID_VERSION = $(subst v,,$(DROGON_VERSION)) To strip out the 'v' prefix. As seen in [1], the prefix isn't used. After applying those changes I ran ``` make drogon-show-info | utils/generate-cyclonedx | support/scripts/cve-check --include-resolved ``` Which correctly output: ``` { ... "vulnerabilities": [ { "id": "CVE-2023-26137", "analysis": { "state": "resolved_with_pedigree", "detail": "The CVE 'CVE-2023-26137' has been marked as ignored by Buildroot" }, "affects": [ { "ref": "drogon" } ], }, { "id": "CVE-2023-26138", "analysis": { "state": "resolved_with_pedigree", "detail": "The CVE 'CVE-2023-26138' has been marked as ignored by Buildroot" }, "affects": [ { "ref": "drogon" } ], }, { "id": "CVE-2021-35397", "analysis": { "state": "resolved" }, "affects": [ { "ref": "drogon" } ] }, { "id": "CVE-2022-3959", "analysis": { "state": "resolved" }, "affects": [ { "ref": "drogon" } ] }, { "id": "CVE-2022-25297", "analysis": { "state": "resolved" }, "affects": [ { "ref": "drogon" } ] } ] } ``` > DROGON_INSTALL_STAGING = YES > Also make sure to rebase to include [2] or it won't apply. Otherwise: > DROGON_DEPENDENCIES = jsoncpp util-linux zlib Acked-By: Thomas Perale <thomas.perale@mind.be> [1] https://nvd.nist.gov/vuln/detail/cve-2022-25297 [2] https://gitlab.com/buildroot.org/buildroot/-/commit/89fcc7132a9b4f94d082fb9936b4335d28d91b43 Best regards, PERALE Thomas _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH] package/drogon: add CPE information 2026-10-27 17:38 ` Thomas Perale via buildroot @ 2026-10-27 19:23 ` Thomas Petazzoni via buildroot 2026-10-27 19:47 ` Thomas Perale via buildroot 0 siblings, 1 reply; 4+ messages in thread From: Thomas Petazzoni via buildroot @ 2026-10-27 19:23 UTC (permalink / raw) To: Thomas Perale; +Cc: buildroot, Dario Binacchi On Tue, Oct 27, 2026 at 06:38:53PM +0100, Thomas Perale wrote: > Also need to include the following > > DROGON_CPE_ID_VERSION = $(subst v,,$(DROGON_VERSION)) Makes sense, but... > > To strip out the 'v' prefix. As seen in [1], the prefix isn't used. > > After applying those changes I ran > > ``` > make drogon-show-info | utils/generate-cyclonedx | support/scripts/cve-check --include-resolved > ``` > > Which correctly output: ... I'm already getting the two CVEs with just my patch, i.e with tweaking DROGON_CPE_ID_VERSION. Any reason for that? Thanks! Thomas -- Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH] package/drogon: add CPE information 2026-10-27 19:23 ` Thomas Petazzoni via buildroot @ 2026-10-27 19:47 ` Thomas Perale via buildroot 0 siblings, 0 replies; 4+ messages in thread From: Thomas Perale via buildroot @ 2026-10-27 19:47 UTC (permalink / raw) To: Thomas Petazzoni; +Cc: Thomas Perale, buildroot, Dario Binacchi In reply of: > On Tue, Oct 27, 2026 at 06:38:53PM +0100, Thomas Perale wrote: > > > Also need to include the following > > > > DROGON_CPE_ID_VERSION = $(subst v,,$(DROGON_VERSION)) > > Makes sense, but... > > > > > To strip out the 'v' prefix. As seen in [1], the prefix isn't used. > > > > After applying those changes I ran > > > > ``` > > make drogon-show-info | utils/generate-cyclonedx | support/scripts/cve-check --include-resolved > > ``` > > > > Which correctly output: > > ... I'm already getting the two CVEs with just my patch, i.e with > tweaking DROGON_CPE_ID_VERSION. Any reason for that? > > Thanks! > > Thomas > -- > Thomas Petazzoni, co-owner and CEO, Bootlin > Embedded Linux and Kernel engineering and training > https://bootlin.com Ha yes, I remember this issue from the time I worked on fixing the cve.py logic in [1]. There are some weird things happening with the `--include-resolved` option and `distutils.version.LooseVersion` throwing error. iirc with `--include-resolved` currenlty they are correctly marked as resolved but in an hypothetical case where the vulnerability would be exploitable the comparison between "vX.Y.Z" and "X.Y.Z" would be marked as resolved as well. I can further go into the detail of where this logic error happen but I don't think it's necessary. The fixed version present in [1] doesn't include this logic error. If you give it a try it won't work with the "v" prefix. I still need to send those changes to the list but there was some minor things I wanted to refactor before sending. The fixed `cve-check` in [1] is the version I use to generate the report for `security.buildroot.org`. Best regards, PERALE Thomas [1] https://gitlab.com/essensium-mind/buildroot/-/commits/fix-cve-check _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-27 19:47 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-10-27 17:06 [Buildroot] [PATCH] package/drogon: add CPE information Thomas Petazzoni via buildroot 2026-10-27 17:38 ` Thomas Perale via buildroot 2026-10-27 19:23 ` Thomas Petazzoni via buildroot 2026-10-27 19:47 ` Thomas Perale via buildroot
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.