mirror of
git://git.yoctoproject.org/yocto-autobuilder-helper.git
synced 2025-07-19 20:59:02 +02:00
2aad3d2c6d
Backport the recent CVE script changes from the master branch and add in cvelayer.bbclass as a way to exclude specific paths from the CVE check. Master can use the layer overrides to do this but these are not present on kirkstone. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
31 lines
758 B
Python
Executable File
31 lines
758 B
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
import os, sys
|
|
import json
|
|
|
|
jsonfile = sys.argv[1]
|
|
|
|
#ignored_recipes = ("linux-yocto", "db", "db-native")
|
|
ignored_recipes = []
|
|
|
|
with open(jsonfile) as f:
|
|
cvedata = json.load(f)
|
|
|
|
cves = dict()
|
|
|
|
for recipe in cvedata['package']:
|
|
if recipe['name'] in ignored_recipes:
|
|
continue
|
|
if 'issue' not in recipe:
|
|
continue
|
|
for i in recipe['issue']:
|
|
if i['status'] == "Unpatched":
|
|
if i["id"] in cves:
|
|
cves[i["id"]] += ":" + recipe['name']
|
|
else:
|
|
cves[i["id"]] = recipe['name']
|
|
|
|
print("Found %d unpatched CVEs" % len(cves))
|
|
for cve in sorted(cves.keys()):
|
|
print("%s: %s https://web.nvd.nist.gov/view/vuln/detail?vulnId=%s *" % (cve, cves[cve], cve))
|