mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-10-24 01:42:07 -09:00
d3ad19688d
If a vulnerability is present in multiple components and only one of
them has a patch that addresses that vulnerability, all components will
currently have that vulnerability marked as `resolved_with_pedigree`.
Right now, this issue does not affect any packages, but in the future it
might affect packages that provide multiple version options (e.g.
gnupg and gnupg2).
There is a small chance this happens in a real-world use case, but it
may occur in the context of maintenance when running
`make show-info-all`.
This commit changes how vulnerabilities fixed by a patch are stored.
Instead of placing all vulnerabilities into a single set, it now keeps an
index of the component for which the patch has been applied.
When generating the vulnerability list, the component reference is
checked instead of only the vulnerability ID. If a vulnerability ID has
multiple states for different references, multiple vulnerability
entries are created with distinct analyses.
Consider the hypothetical case where gnupg ignores a vulnerability
because it was introduced in a later version, while gnupg2 has patched
that vulnerability. This would result in the following JSON:
```json
[
{
"id": "CVE-1234-1234",
"analysis": {
"state": "in_triage",
"detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
},
"affects": [
{"ref": "gnupg"}
]
},
{
"id": "CVE-1234-1234",
"analysis": {
"state": "resolved_with_pedigree",
"detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
},
"affects": [
{"ref": "gnupg2"}
]
}
]
```
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout:
- update the VULN_WITH_PEDIGREE comment to match the code
- use set() as default instead of {}]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 345c8ffc96)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches