Re: [PATCH 6/6] mpg123: set status for CVE-2006-3355

[Benjamin Robin <benjamin.robin@bootlin.com>]

On Monday, April 13, 2026 at 11:23 PM, Marko, Peter wrote:
> Benjamin,
> 
> This one is weird
> How can someone debug the sbom-cve-check script to figure out why the match is positive or negative?
> That would be great feature if there would be some option to print the comparisons.

Yeah, this is in the backlog, sbom-cve-check should have an "audit log".
But this is not that simple, and I have other priorities :)

> Peter

> > From: Peter Marko <peter.marko@siemens.com>
> > 
> > This seems to be a bug in sbom-cve-check.
> > I could get a clean report with following fkie change:
> > 
> >            "cpeMatch": [
> > +            {
> > +              "vulnerable": true,
> > +              "criteria": "cpe:2.3:a:mpg123:mpg123:0.59r:*:*:*:*:*:*:*",
> > +              "matchCriteriaId": "1F8EEF7E-C6BB-4669-81D2-68AABF8A7686"
> > +            },
> >              {
> >                "vulnerable": true,
> >                "criteria": "cpe:2.3:a:mpg123:mpg123:pre0.59s_r11:*:*:*:*:*:*:*",
> >                "matchCriteriaId": "9765C6AD-E1F0-421C-B7B1-C09AD83A3DB7"
> >              }
> >            ]

The algorithm is described here:
https://sbom-cve-check.readthedocs.io/en/latest/design.html#compute-vex-assessment

But in summary, the CVE is found "applicable" (associated with mpg123 component),
but no valide version range was found (pre0.59s_r11 is not a valid version).
So as documented: "In the end if no assessment could be computed, generate a
default assessment indicating that databases do not contain enough version
information. This default assessment considers that the component is affected
(vulnerable) by this CVE".

> > 
> > However I'm not sure why adding another vulnerable version should switch
> > the vulnerability flag from true to false...

Adding a new valid cpeMatch entry is going to fix it. But maybe not exactly
this one, I guess we need to express that version range <= 0.59

For information, I am currently working on a big improvement for the
generation of VEX assessment (statement and status notes).

-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com