Re: [PATCH 1/6] sudo: set status of CVE-2025-64170 and CVE-2025-64517

[Benjamin Robin <benjamin.robin@bootlin.com>]

Hello Peter,

On Wednesday, April 29, 2026 at 7:13 PM, Marko, Peter wrote:

> > > Hello Benjamin,
> > >
> > > I will sent CVE_PRODUCT update to get rid of some older sudo-rs CVE.
> > >
> > > However for these two CVEs, I can still only see "sudo-rs" as product, not "sudo",
> > also via link you have provided from cveawg.org/api.
> > 
> > Yes, but this is not a CPE. As explained previously (see the steps detailed
> > above in the previous email), using the vendor/product names extracted from
> > the associated field, we look in the products database for an associated CPE:
> > https://github.com/bootlin/sbom-cve-
> > check/blob/v1.3.0/src/sbom_cve_check/products/products.toml#L1688
> 
> Thanks for the explanation.
> Finally, I'm starting to understand how some CVEs get assigned to components where I'd not expect them.
> 
> How was that toml file created? Manual work?
> For sudo I think the table is correct (although I don't understand NVD motivation for that).

This is a mix of an automated script and of a manual work...
 
> However for SDL (CVE-2026-35444) it looks wrong:
> https://github.com/bootlin/sbom-cve-check/blob/v1.3.0/src/sbom_cve_check/products/products.toml#L1608
> Why does it map sdl and sdl_image and simple_directmedia_layer together?
> There are distinctive CPEs for both sdl and sdl_image in NVD DB...

From my understanding this was the same component, but it is clearly
not the case...

- https://nvd.nist.gov/vuln/detail/CVE-2019-7573 use this CPE
  "cpe:2.3:a:libsdl:simple_directmedia_layer:*:*:*:*:*:*:*:*"
  and refer to both SDL 1 and 2. The referenced code looks like it is:
  https://github.com/libsdl-org/SDL/blob/main/src/audio/SDL_wave.c#L376

- https://nvd.nist.gov/vuln/detail/CVE-2008-0544 use this CPE
  "cpe:2.3:a:sdl:sdl_image:1.2.6:*:*:*:*:*:*:*"
   and refer to SDL_image 1. The referenced code looks like it is:
   https://github.com/libsdl-org/SDL_image/blob/SDL-1.2/IMG_lbm.c

> Peter

I expected to make several mistakes. This is a first version, and it is
going to be improved and fixed in the long run (at least this was my plan).

-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com