Re: [PATCH 0/3] sbom-cve-check: Update to version 1.3.3 and update CVE databases

[Benjamin Robin <benjamin.robin@bootlin.com>]

Hello Peter,

On Wednesday, August 5, 2026 at 12:00 PM, Marko, Peter wrote:
> I have noticed that right after merging this commit, 9 historical CVEs were newly reported in Yocto master metrics.
> (which is higher number than what was resolved by this update, which was 3 or 4).
> 
> All are caused by "no-version-ranges":
> 
> gnutls CVE-2023-0361
> glibc CVE-2011-0536 
> glibc CVE-2025-0577 (was "Fixed from version >2.40-17.fc41")

For the CVE-2025-0577:
 - The NVD database does not provide any version range.
 - The CVE List database only provides the following ranges:
   - >= 2.39-28.fc40 , <= 2.39-33.fc40
   - >= 2.40-12.fc41 , <= 2.40-17.fc41

These ranges are no longer used, since the range contains a packaging distro
version. It is not possible (programmatically) to know that version
2.44 contains the fix for this CVE. Indeed the 2.40-17.fc41 may provide
an additional patch to fix that particular CVE.

See associated issue [1]

> ovmf CVE-2017-5731
> ovmf CVE-2019-14584
> pulseaudio CVE-2020-15710
> pulseaudio CVE-2020-16123
> openssl CVE-2015-3216
> ppp CVE-2020-15704 (was "Fixed from version 2.4.7-2\\+2ubuntu1.3")

For the CVE-2020-15704 this is exactly the same case as CVE-2025-0577.

> 
> I guess the two above which I extra commented are something which in theory could be looked at and handled in code?
> The rest are unfortunately all data source issues.
> 
> I'll send annotations for all anyway...

The proper way is to send an email to the CNA to fix these version ranges.
Most of the CNA that we contacted fixed the CVE entry pretty quickly.

CVE-2025-0577 and CVE-2020-15704 do not provide proper version ranges
(with upstream version). This is why sbom-cve-check indicates
"no-version-ranges".


[1] https://github.com/bootlin/sbom-cve-check/issues/26

Best regards,
-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com