Re: [RFC] Mark of upstream CVE patches

[Philip Balister <philip@balister.org>]

I also suggest copying the

https://lists.yoctoproject.org/listinfo/yocto-security

list.

Philip

On 12/15/2015 11:03 AM, Mariano Lopez wrote:
> There is an initiative to track vulnerable software being built (see
> bugs 8119 and 7515). The idea is to have a testing tool that would check
> the recipe versions against CVEs. In order to accomplish such task there
> is need to reliable mark the patches from upstream that solve CVEs.
> 
> There have been two options to mark the patches that solve CVEs:
> 
> 1. Have  "CVE" and the CVE number as the patch filename.
>   Pros:
>     Doesn't require a new tag.
>   Cons:
>     It is not flexible to add more information, for example two CVEs in
> the same patch
> 
> 2. Add a new tag in the patch that have the CVE information.
>   Pros:
>     It is flexible and can add more information.
>   Cons:
>     Require a change in the patch metadata.
> 
> What I would recommend is to add a new tag in the patch, it must contain
> the CVE ID. With this it would be possible to look for the CVE
> information easily in the testing tool or in NIST, MITRE, or another web
> page. For example, this would be part of the patch for CVE-2013-6435,
> currently in OE-Core:
> 
> -- snip --
> 
> Upstream-Status: Backport
> CVE: CVE-2013-6435
> 
> Reference:
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6435
> 
> -- snip --
> 
> The expected output of this discussion is a standard format for CVE
> patches that most, if not all, of community members agree on.
> 
> Please let me know your comments.
> 
> Cheers,
> 
> Mariano Lopez