Re: [Buildroot] [PATCH] package/drogon: add CPE information

[Thomas Perale via buildroot <buildroot@buildroot.org>]

In reply of:
> On Tue, Oct 27, 2026 at 06:38:53PM +0100, Thomas Perale wrote:
> 
> > Also need to include the following
> > 
> > DROGON_CPE_ID_VERSION = $(subst v,,$(DROGON_VERSION))
> 
> Makes sense, but...
> 
> > 
> > To strip out the 'v' prefix. As seen in [1], the prefix isn't used.
> > 
> > After applying those changes I ran
> > 
> > ```
> > make drogon-show-info | utils/generate-cyclonedx | support/scripts/cve-check --include-resolved
> > ```
> > 
> > Which correctly output:
> 
> ... I'm already getting the two CVEs with just my patch, i.e with
> tweaking DROGON_CPE_ID_VERSION. Any reason for that?
> 
> Thanks!
> 
> Thomas
> -- 
> Thomas Petazzoni, co-owner and CEO, Bootlin
> Embedded Linux and Kernel engineering and training
> https://bootlin.com

Ha yes, I remember this issue from the time I worked on fixing the cve.py logic
in [1]. There are some weird things happening with the `--include-resolved`
option and `distutils.version.LooseVersion` throwing error. iirc with
`--include-resolved` currenlty they are correctly marked as resolved but in an
hypothetical case where the vulnerability would be exploitable the comparison
between "vX.Y.Z" and "X.Y.Z" would be marked as resolved as well.

I can further go into the detail of where this logic error happen but I don't
think it's necessary.

The fixed version present in [1] doesn't include this logic error. If you give
it a try it won't work with the "v" prefix.
I still need to send those changes to the list but there was some minor things
I wanted to refactor before sending.
The fixed `cve-check` in [1] is the version I use to generate the report for
`security.buildroot.org`.

Best regards,
PERALE Thomas

[1] https://gitlab.com/essensium-mind/buildroot/-/commits/fix-cve-check
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot