Re: [Buildroot] [RFC PATCH 08/14] package/python-pip: add detail to vulnerability

[Fiona Klute via buildroot <buildroot@buildroot.org>]

Hi Thomas!

Am 24.06.26 um 16:06 schrieb Thomas Perale via buildroot:
> The vulnerability is marked as fixed as it work as expected according to
> the upstream project.
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>   package/python-pip/python-pip.mk | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/package/python-pip/python-pip.mk b/package/python-pip/python-pip.mk
> index d12bea3225..ae9a4225eb 100644
> --- a/package/python-pip/python-pip.mk
> +++ b/package/python-pip/python-pip.mk
> @@ -12,9 +12,10 @@ PYTHON_PIP_LICENSE = MIT
>   PYTHON_PIP_LICENSE_FILES = LICENSE.txt
>   PYTHON_PIP_CPE_ID_VENDOR = pypa
>   PYTHON_PIP_CPE_ID_PRODUCT = pip
> -# Disputed CVE: things work as designed, and only affects the
> -# --extra-index-url option. This CVE will never be fixed.
> +
>   PYTHON_PIP_IGNORE_CVES += CVE-2018-20225
> +PYTHON_PIP_CVE-2018-20225_STATUS = fixed
> +PYTHON_PIP_CVE-2018-20225_DETAIL = Disputed CVE: things work as designed, and only affects the --extra-index-url option. This CVE will never be fixed.

I don't like using "fixed" for "upstream maintainers don't see this as a 
problem". Nothing was fixed, the dispute is whether anything needs fixing.

Looking at the OpenVEX status labels "not_affected" or 
"under_investigation" seem to fit better (depending on whether we agree 
with upstream or not, I guess if we don't adding to IGNORE_CVES would be 
questionable), but I don't see any way to clearly express "disputed" 
among those options.

Best regards,
Fiona

>   
>   $(eval $(python-package))
>   $(eval $(host-python-package))

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot