From 5d46fcafe60f216126d3f396f73c60a0df694e6a Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Sat, 23 Aug 2025 16:38:42 +0200 Subject: [PATCH] support/scripts/cve.py: handle CVEs with 'configurations' but no 'nodes' inside The each_cpe() method is careful that some CVEs have no "configurations", but some CVEs such as https://nvd.nist.gov/vuln/detail/CVE-2025-32915 apparently have a "configurations" node, but no "nodes" inside the "configurations", causing an exception: Traceback (most recent call last): File "/home/buildroot/buildroot-stats/./support/scripts/pkg-stats", line 1382, in __main__() File "/home/buildroot/buildroot-stats/./support/scripts/pkg-stats", line 1371, in __main__ check_package_cves(args.nvd_path, packages) File "/home/buildroot/buildroot-stats/./support/scripts/pkg-stats", line 679, in check_package_cves check_package_cve_affects(cve, cpe_product_pkgs) File "/home/buildroot/buildroot-stats/./support/scripts/pkg-stats", line 638, in check_package_cve_affects for product in cve.affected_products: ^^^^^^^^^^^^^^^^^^^^^ File "/home/buildroot/buildroot-stats/support/scripts/cve.py", line 185, in affected_products return set(cpe_product(p['id']) for p in self.each_cpe()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/buildroot/buildroot-stats/support/scripts/cve.py", line 185, in return set(cpe_product(p['id']) for p in self.each_cpe()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/buildroot/buildroot-stats/support/scripts/cve.py", line 173, in each_cpe for node in nodes['nodes']: ~~~~~^^^^^^^^^ KeyError: 'nodes' Fixes: 54f8d97c91 ("support/scripts/pkg-stats: adapt to NVD v2 json format") Signed-off-by: Thomas Petazzoni [Romain: - add reference to buildroot commit introducing the issue - a similar patch was sent by Daniel Lang (thanks!) - needed on 2025.05.x to fix "Daily results" email] (cherry picked from commit 67422b9d9cd02d29393081d83af4dd16093c43b1) Signed-off-by: Romain Naour --- support/scripts/cve.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/support/scripts/cve.py b/support/scripts/cve.py index 1cbe24c02d..ba41762fa0 100755 --- a/support/scripts/cve.py +++ b/support/scripts/cve.py @@ -170,7 +170,7 @@ class CVE: def each_cpe(self): for nodes in self.nvd_cve.get('configurations', []): - for node in nodes['nodes']: + for node in nodes.get('nodes', []): for cpe in self.parse_node(node): yield cpe