Re: [Buildroot] [PATCH] package/skopeo: ignore un-applicable CVE

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello Yann,

On Tue, 17 Sep 2024 12:17:17 +0200
<yann.morin@orange.com> wrote:

> From: "Yann E. MORIN" <yann.morin@orange.com>
> 
> The CVE tracker detects that CVE-2019-10214 impacts skopeo, but this is
> a false positive. Indeed, that CVE applies to containers/image (which is
> vendored in skopeo), and is matched for un-versioned skopeo (notice the
> dash '-' in the CPE ID):
> 
>     https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:skopeo_project:skopeo:-:*:*:*:*:*:*:*
> 
> and does not apply to any versioned skopeo (1.16.1 and "any version" for
> example; notice the star '*' or the version instead of the dash, in the
> CPE ID):
> 
>     https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:skopeo_project:skopeo:*:*:*:*:*:*:*:*
>     https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:skopeo_project:skopeo:1.16.1:*:*:*:*:*:*:*

Wow, it took me a while to process the explanation here. Let me
rephrase what I understood:

- The NVD database entry for CVE-2019-10214 indicates that one of the
  affected CPE IDs is cpe:2.3:a:skopeo_project:skopeo:-:*:*:*:*:*:*:*

- The CPE ID generated by Buildroot for the skopeo package is
  cpe:2.3:a:skopeo_project:skopeo:1.16.0:*:*:*:*:*:*:*

- Because pkg-stats handles "-" as "any version is affected", then it
  causes CVE-2019-10214 to be assumed to affect our version of skopeo

> This was fixed in containers/image in upstream commit a3d69a4a (Use the
> same HTTP client for contacting the bearer token server and the
> registry, 2019-08-01) which has been released in containers/image
> v3.0.0 (2019-08-02), which has been vendored in skopeo since commit
> bebcb94653cc (vendor github.com/containers/image@v3.0.0) released the
> same day in skopeo 0.1.38 (2019-02-08).

So I agree, but then the proper course of action we recommend to our
contributors in this situation, is to contact the NVD people and have
them update their database entry. In this case, you already have the
needed information, as you tracked which exact version fixed the issue.
Could you contact the NVD database maintainers to get this fixed
upstream?

Thanks a lot!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot