Re: [PATCH] improve_kernel_cve_report: use numeric versions instead of cpeApplicability

[Benjamin Robin <benjamin.robin@bootlin.com>]

Hello Daniel,

On Friday, April 17, 2026 at 3:24 PM, daniel.turull@ericsson.com wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
> 
> git shas or versions should be use instead of cpeApplicability.
> Reuse the same logic as generate-cve-exclusions, so outputs are consistent.
> 
> cpeApplicability does not provide accurate version information and for some
>  CVEs the information is not the same. This came from a discussion that
> we had with Greg Kroah-Hartma, member of the Linux security team.

Indeed "cpeApplicability" does not provide the same kind of information that
the "versions" node.
In sbom-cve-check (the latest version in main branch) we are using both
sources of information.
But you are saying that "cpeApplicability" does not provide accurate version
information. Could you elaborate and give various examples? I never saw
something invalid in "cpeApplicability".
 
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
>  scripts/contrib/improve_kernel_cve_report.py | 247 ++++++++-----------
>  1 file changed, 104 insertions(+), 143 deletions(-)


-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com