[Buildroot] [PATCH] package/drogon: add CPE information

[Buildroot] [PATCH] package/drogon: add CPE information

[Thomas Petazzoni via buildroot]

See:

  https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:drogon:drogon

With this, cve-check properly reports CVE-2023-26137 and
CVE-2023-26138 as affecting the package.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
---
 package/drogon/drogon.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/drogon/drogon.mk b/package/drogon/drogon.mk
index 8c51d16ac0..4772228960 100644
--- a/package/drogon/drogon.mk
+++ b/package/drogon/drogon.mk
@@ -10,6 +10,7 @@ DROGON_SITE_METHOD = git
 DROGON_GIT_SUBMODULES = YES
 DROGON_LICENSE = MIT
 DROGON_LICENSE_FILES = LICENSE
+DROGON_CPE_ID_VENDOR = drogon
 DROGON_INSTALL_STAGING = YES
 
 DROGON_DEPENDENCIES = jsoncpp util-linux zlib
-- 
2.56.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/drogon: add CPE information

[Thomas Perale via buildroot]

Hi Thomas,

In reply of:
> See:
> 
>   https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:drogon:drogon
> 
> With this, cve-check properly reports CVE-2023-26137 and
> CVE-2023-26138 as affecting the package.
> 
> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

> ---
>  package/drogon/drogon.mk | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/package/drogon/drogon.mk b/package/drogon/drogon.mk
> index 8c51d16ac0..4772228960 100644
> --- a/package/drogon/drogon.mk
> +++ b/package/drogon/drogon.mk
> @@ -10,6 +10,7 @@ DROGON_SITE_METHOD = git
>  DROGON_GIT_SUBMODULES = YES
>  DROGON_LICENSE = MIT
>  DROGON_LICENSE_FILES = LICENSE
> +DROGON_CPE_ID_VENDOR = drogon

Also need to include the following

DROGON_CPE_ID_VERSION = $(subst v,,$(DROGON_VERSION))

To strip out the 'v' prefix. As seen in [1], the prefix isn't used.

After applying those changes I ran

```
make drogon-show-info | utils/generate-cyclonedx | support/scripts/cve-check --include-resolved
```

Which correctly output:

```
{
  ...
  "vulnerabilities": [
    {
      "id": "CVE-2023-26137",
      "analysis": {
        "state": "resolved_with_pedigree",
        "detail": "The CVE 'CVE-2023-26137' has been marked as ignored by Buildroot"
      },
      "affects": [ { "ref": "drogon" } ],
    },
    {
      "id": "CVE-2023-26138",
      "analysis": {
        "state": "resolved_with_pedigree",
        "detail": "The CVE 'CVE-2023-26138' has been marked as ignored by Buildroot"
      },
      "affects": [ { "ref": "drogon" } ],
    },
    {
      "id": "CVE-2021-35397",
      "analysis": {
        "state": "resolved"
      },
      "affects": [
        {
          "ref": "drogon"
        }
      ]
    },
    {
      "id": "CVE-2022-3959",
      "analysis": { "state": "resolved" },
      "affects": [ { "ref": "drogon" } ]
    },
    {
      "id": "CVE-2022-25297",
      "analysis": { "state": "resolved" },
      "affects": [ { "ref": "drogon" } ]
    }
  ]
}
```

>  DROGON_INSTALL_STAGING = YES
>  

Also make sure to rebase to include [2] or it won't apply.

Otherwise:

>  DROGON_DEPENDENCIES = jsoncpp util-linux zlib

Acked-By: Thomas Perale <thomas.perale@mind.be>

[1] https://nvd.nist.gov/vuln/detail/cve-2022-25297
[2] https://gitlab.com/buildroot.org/buildroot/-/commit/89fcc7132a9b4f94d082fb9936b4335d28d91b43

Best regards,
PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/drogon: add CPE information

[Thomas Petazzoni via buildroot]

On Tue, Oct 27, 2026 at 06:38:53PM +0100, Thomas Perale wrote:

> Also need to include the following
> 
> DROGON_CPE_ID_VERSION = $(subst v,,$(DROGON_VERSION))

Makes sense, but...

> 
> To strip out the 'v' prefix. As seen in [1], the prefix isn't used.
> 
> After applying those changes I ran
> 
> ```
> make drogon-show-info | utils/generate-cyclonedx | support/scripts/cve-check --include-resolved
> ```
> 
> Which correctly output:

... I'm already getting the two CVEs with just my patch, i.e with
tweaking DROGON_CPE_ID_VERSION. Any reason for that?

Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/drogon: add CPE information

[Thomas Perale via buildroot]

In reply of:
> On Tue, Oct 27, 2026 at 06:38:53PM +0100, Thomas Perale wrote:
> 
> > Also need to include the following
> > 
> > DROGON_CPE_ID_VERSION = $(subst v,,$(DROGON_VERSION))
> 
> Makes sense, but...
> 
> > 
> > To strip out the 'v' prefix. As seen in [1], the prefix isn't used.
> > 
> > After applying those changes I ran
> > 
> > ```
> > make drogon-show-info | utils/generate-cyclonedx | support/scripts/cve-check --include-resolved
> > ```
> > 
> > Which correctly output:
> 
> ... I'm already getting the two CVEs with just my patch, i.e with
> tweaking DROGON_CPE_ID_VERSION. Any reason for that?
> 
> Thanks!
> 
> Thomas
> -- 
> Thomas Petazzoni, co-owner and CEO, Bootlin
> Embedded Linux and Kernel engineering and training
> https://bootlin.com

Ha yes, I remember this issue from the time I worked on fixing the cve.py logic
in [1]. There are some weird things happening with the `--include-resolved`
option and `distutils.version.LooseVersion` throwing error. iirc with
`--include-resolved` currenlty they are correctly marked as resolved but in an
hypothetical case where the vulnerability would be exploitable the comparison
between "vX.Y.Z" and "X.Y.Z" would be marked as resolved as well.

I can further go into the detail of where this logic error happen but I don't
think it's necessary.

The fixed version present in [1] doesn't include this logic error. If you give
it a try it won't work with the "v" prefix.
I still need to send those changes to the list but there was some minor things
I wanted to refactor before sending.
The fixed `cve-check` in [1] is the version I use to generate the report for
`security.buildroot.org`.

Best regards,
PERALE Thomas

[1] https://gitlab.com/essensium-mind/buildroot/-/commits/fix-cve-check
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot