MIRRORS/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky.git synced 2025-07-19 21:09:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

cve-check: add support for cvss v4.0

Browse Source 
https://nvd.nist.gov/general/news/cvss-v4-0-official-support

CVSS v4.0 was released in November 2023
NVD announced support for it in June 2024

Current stats are:
* cvss v4 provided, but also v3, so cve-check showed a value
sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 != 0.0;
2069
* only cvss v4 provided, so cve-check did not show any
sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 = 0.0;
260

(From OE-Core rev: 7ce34ce58f83bc02fa2c04bec54e358e8614157e)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 358dbfcd80ae1fa414d294c865dd293670c287f0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko 2024-10-23 11:45:22 +02:00 committed by Steve Sakoman
parent 6a44d7c078
commit a99c033f4c
4 changed files with 19 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
meta/classes/cve-check.bbclass
View File

@ -31,7 +31,7 @@
CVE_PRODUCT ??= "${BPN}" CVE_PRODUCT ??= "${BPN}"
CVE_VERSION ??= "${PV}" CVE_VERSION ??= "${PV}"
CVE_CHECK_DB_FILENAME ?= "nvdcve_2-1.db" CVE_CHECK_DB_FILENAME ?= "nvdcve_2-2.db"
CVE_CHECK_DB_DIR ?= "${STAGING_DIR}/CVE_CHECK" CVE_CHECK_DB_DIR ?= "${STAGING_DIR}/CVE_CHECK"
CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/${CVE_CHECK_DB_FILENAME}" CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/${CVE_CHECK_DB_FILENAME}"
CVE_CHECK_DB_FILE_LOCK ?= "${CVE_CHECK_DB_FILE}.lock" CVE_CHECK_DB_FILE_LOCK ?= "${CVE_CHECK_DB_FILE}.lock"
@ -445,9 +445,10 @@ def get_cve_info(d, cve_data):
cve_data[row[0]]["NVD-summary"] = row[1] cve_data[row[0]]["NVD-summary"] = row[1]
cve_data[row[0]]["NVD-scorev2"] = row[2] cve_data[row[0]]["NVD-scorev2"] = row[2]
cve_data[row[0]]["NVD-scorev3"] = row[3] cve_data[row[0]]["NVD-scorev3"] = row[3]
cve_data[row[0]]["NVD-modified"] = row[4] cve_data[row[0]]["NVD-scorev4"] = row[4]
cve_data[row[0]]["NVD-vector"] = row[5] cve_data[row[0]]["NVD-modified"] = row[5]
cve_data[row[0]]["NVD-vectorString"] = row[6] cve_data[row[0]]["NVD-vector"] = row[6]
cve_data[row[0]]["NVD-vectorString"] = row[7]
cursor.close() cursor.close()
conn.close() conn.close()
@ -534,6 +535,7 @@ def cve_write_data_json(d, cve_data, cve_status):
cve_item["summary"] = cve_data[cve]["NVD-summary"] cve_item["summary"] = cve_data[cve]["NVD-summary"]
cve_item["scorev2"] = cve_data[cve]["NVD-scorev2"] cve_item["scorev2"] = cve_data[cve]["NVD-scorev2"]
cve_item["scorev3"] = cve_data[cve]["NVD-scorev3"] cve_item["scorev3"] = cve_data[cve]["NVD-scorev3"]
cve_item["scorev4"] = cve_data[cve]["NVD-scorev4"]
cve_item["modified"] = cve_data[cve]["NVD-modified"] cve_item["modified"] = cve_data[cve]["NVD-modified"]
cve_item["vector"] = cve_data[cve]["NVD-vector"] cve_item["vector"] = cve_data[cve]["NVD-vector"]
cve_item["vectorString"] = cve_data[cve]["NVD-vectorString"] cve_item["vectorString"] = cve_data[cve]["NVD-vectorString"]

1
meta/classes/vex.bbclass
View File

@ -282,6 +282,7 @@ def cve_write_data_json(d, cve_data, cve_status):
cve_item["summary"] = cve_data[cve]["NVD-summary"] cve_item["summary"] = cve_data[cve]["NVD-summary"]
cve_item["scorev2"] = cve_data[cve]["NVD-scorev2"] cve_item["scorev2"] = cve_data[cve]["NVD-scorev2"]
cve_item["scorev3"] = cve_data[cve]["NVD-scorev3"] cve_item["scorev3"] = cve_data[cve]["NVD-scorev3"]
cve_item["scorev4"] = cve_data[cve]["NVD-scorev4"]
cve_item["vector"] = cve_data[cve]["NVD-vector"] cve_item["vector"] = cve_data[cve]["NVD-vector"]
cve_item["vectorString"] = cve_data[cve]["NVD-vectorString"] cve_item["vectorString"] = cve_data[cve]["NVD-vectorString"]
if 'status' in cve_data[cve]: if 'status' in cve_data[cve]:

14
meta/recipes-core/meta/cve-update-nvd2-native.bb
View File

@ -255,7 +255,7 @@ def initialize_db(conn):
c.execute("CREATE TABLE IF NOT EXISTS META (YEAR INTEGER UNIQUE, DATE TEXT)") c.execute("CREATE TABLE IF NOT EXISTS META (YEAR INTEGER UNIQUE, DATE TEXT)")
c.execute("CREATE TABLE IF NOT EXISTS NVD (ID TEXT UNIQUE, SUMMARY TEXT, \ c.execute("CREATE TABLE IF NOT EXISTS NVD (ID TEXT UNIQUE, SUMMARY TEXT, \
SCOREV2 TEXT, SCOREV3 TEXT, MODIFIED INTEGER, VECTOR TEXT, VECTORSTRING TEXT)") SCOREV2 TEXT, SCOREV3 TEXT, SCOREV4 TEXT, MODIFIED INTEGER, VECTOR TEXT, VECTORSTRING TEXT)")
c.execute("CREATE TABLE IF NOT EXISTS PRODUCTS (ID TEXT, \ c.execute("CREATE TABLE IF NOT EXISTS PRODUCTS (ID TEXT, \
VENDOR TEXT, PRODUCT TEXT, VERSION_START TEXT, OPERATOR_START TEXT, \ VENDOR TEXT, PRODUCT TEXT, VERSION_START TEXT, OPERATOR_START TEXT, \
@ -361,12 +361,18 @@ def update_db(conn, elt):
cvssv3 = cvssv3 or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['baseScore'] cvssv3 = cvssv3 or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['baseScore']
except KeyError: except KeyError:
pass pass
cvssv3 = cvssv3 or 0.0
try:
accessVector = accessVector or elt['cve']['metrics']['cvssMetricV40'][0]['cvssData']['attackVector']
vectorString = vectorString or elt['cve']['metrics']['cvssMetricV40'][0]['cvssData']['vectorString']
cvssv4 = elt['cve']['metrics']['cvssMetricV40'][0]['cvssData']['baseScore']
except KeyError:
cvssv4 = 0.0
accessVector = accessVector or "UNKNOWN" accessVector = accessVector or "UNKNOWN"
vectorString = vectorString or "UNKNOWN" vectorString = vectorString or "UNKNOWN"
cvssv3 = cvssv3 or 0.0
conn.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?, ?)", conn.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?, ?, ?)",
[cveId, cveDesc, cvssv2, cvssv3, date, accessVector, vectorString]).close() [cveId, cveDesc, cvssv2, cvssv3, cvssv4, date, accessVector, vectorString]).close()
try: try:
# Remove any pre-existing CVE configuration. Even for partial database # Remove any pre-existing CVE configuration. Even for partial database

2
scripts/cve-json-to-text.py
View File

@ -125,6 +125,8 @@ def process_data(filename, data):
lines += "CVSS v2 BASE SCORE: %s\n" % issue["scorev2"] lines += "CVSS v2 BASE SCORE: %s\n" % issue["scorev2"]
if "scorev3" in issue: if "scorev3" in issue:
lines += "CVSS v3 BASE SCORE: %s\n" % issue["scorev3"] lines += "CVSS v3 BASE SCORE: %s\n" % issue["scorev3"]
if "scorev4" in issue:
lines += "CVSS v4 BASE SCORE: %s\n" % issue["scorev4"]
if "vector" in issue: if "vector" in issue:
lines += "VECTOR: %s\n" % issue["vector"] lines += "VECTOR: %s\n" % issue["vector"]
if "vectorString" in issue: if "vectorString" in issue: