From 6ed83c91aaa2e7d540d0fc3ba4be6e5348a2b38b Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Thu, 28 Aug 2025 15:44:26 +0200 Subject: [PATCH] package/pkg-generic.mk: use more sensible default value for _CPE_ID_UPDATE Setting the "update" field in the CPE ID to * doesn't actually make much sense, as * is a wildcard. Instead, this field should really reflect the "subrelease" / "update" of the package, which unless specified explicitly by the package .mk file, is empty. Using a wildcard causes a few CVEs to be incorrectly identified as affecting some of our packages. For example https://nvd.nist.gov/vuln/detail/CVE-2013-1428 has a CPE configuration that goes like this: cpe:2.3:a:tinc-vpn:tinc:*:pre6:*:*:*:*:*:* up to including 1.1 and this CPE configuration is currently identified as affecting our package. This isn't correct as our package is using 1.0.36, not a "pre6" version. But because the CPE ID generated by Buildroot uses * as the "update" field, and * is the wildcard, it does match with this CPE configuration. After this change, two CVEs are no longer identified as affecting Buildroot packages: https://nvd.nist.gov/vuln/detail/CVE-2013-1428 https://nvd.nist.gov/vuln/detail/CVE-2017-9454 and in both cases they are indeed CVEs not affecting our package. Reported-by: Titouan Christophe Cc: Titouan Christophe Cc: Thomas Perale Signed-off-by: Thomas Petazzoni Reviewed-by: Titouan Christophe Signed-off-by: Arnout Vandecappelle (cherry picked from commit 53a8616460e5730abe703ca5a46bae0039d548aa) Signed-off-by: Thomas Perale --- package/pkg-generic.mk | 2 -- 1 file changed, 2 deletions(-) diff --git a/package/pkg-generic.mk b/package/pkg-generic.mk index 95ff9135bd..cf55101265 100644 --- a/package/pkg-generic.mk +++ b/package/pkg-generic.mk @@ -727,8 +727,6 @@ ifeq ($$($(2)_CPE_ID_VALID),YES) ifndef $(2)_CPE_ID_UPDATE ifdef $(3)_CPE_ID_UPDATE $(2)_CPE_ID_UPDATE = $$($(3)_CPE_ID_UPDATE) - else - $(2)_CPE_ID_UPDATE = * endif endif