mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-19 22:03:45 -09:00
56ea5a0226
The NVD database contains some CPEs that are wrongly not associated with any version number. They are for example sometimes associated with very old CVEs. Those CPEs are annoying, because they pollute our pkg-stat CVE results with CVE entries which actually don't affect us. The proper way to solve it is, and should remain, to fix the NVD database by reporting these issues. Having to deal with a lot of CVEs/CPEs, the NVD database is however slow to be updated. To reduce the noise in our pkg-stats results in the meantime, one possibility is to add <PKG_IGNORE_CVES> entries for those CVEs. This however comes with the downside that even once the NVD database gets fixed, those ignored entries risk remaining in Buildroot forever because they are undetected. This commit tries to address this downside by checking for and reporting CVEs that are ignored in Buildroot, but where the NVD reports our package version as unaffected. Those CVEs will appear in the 'CVEs Ignored' column as '(stale)', and the cell will be colored the same way warnings are. This should allow us to detect and remove those entries. It can be tested for example by adding the following variable to the apache package (for a CVE that was recently fixed in the NVD database): APACHE_IGNORE_CVES = CVE-1999-0236 Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>