mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-08 23:51:08 -09:00
2bf75464d6
We currently check the CPE database to see if the CPE ID we use (including the version) is already in the database. However, the version part of the CPE ID is not actually used for CVE matching. Instead, the CVEs have a range of versions associated with them and we match against those ranges. In addition, NVD is moving to a new API for accessing the CPE database. It will not longer be possible to simply download all the CPE IDs, and due to rate limiting, the download will have to be done in several queries. Since all of this is anyway of limited use, drop the CPE database lookup entirely. Instead, as long as a CPE ID is defined in a package, it is considered OK, without any checks. Signed-off-by: Arnout Vandecappelle <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>