package/bind: drop CVE-2017-3139 from IGNORE_CVES
PATCH v2 1/1 package/bind: drop CVE-2017-3139 from IGNORE_CVES
As of 2021-05-14 CVE-2017-3139 is no longer listed as affecting bind, only RHEL.
---
v1 -> v2:
add Signed-off-by
--- package/bind/bind.mk | 2 -- 1 file changed, 2 deletions(-)
package/bind/bind.mk +0 -2
@@ -14,8 +14,6 @@ BIND_LICENSE = MPL-2.0 BIND_LICENSE_FILES = COPYRIGHT BIND_CPE_ID_VENDOR = isc BIND_SELINUX_MODULES = bind -# Only applies to RHEL6.x with DNSSEC validation on -BIND_IGNORE_CVES = CVE-2017-3139 # Library CVE and not used by bind but used by ISC DHCP BIND_IGNORE_CVES += CVE-2019-6470 BIND_TARGET_SERVER_SBIN = arpaname ddns-confgen dnssec-checkds dnssec-coverage
Signature · 6 lines
2.42.0 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Hello Daniel,
Quoted 3 lines · On Wed, 20 Sep 2023 06:31:12 +0200 Daniel Lang <[email protected]> wrote:
As of 2021-05-14 CVE-2017-3139 is no longer listed as affecting bind, only RHEL.
Signed-off-by Daniel Lang <[email protected]>
This makes me think that the pkg-stats script should detect this: if a package has CVE-2023-12345 in its ignore list, but CVE-2023-12345 is not known to affect the package (in its current version) according to the NVD database, we should flag this.
Thomas
Signature · 7 lines
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Thomas, Daniel, All,
On 2023-09-20 09:12 +0200, Thomas Petazzoni via buildroot spake thusly:
Quoted 8 lines
Quoted 2 lines · On Wed, 20 Sep 2023 06:31:12 +0200 Daniel Lang <[email protected]> wrote:
As of 2021-05-14 CVE-2017-3139 is no longer listed as affecting bind, only RHEL.
Signed-off-by Daniel Lang <[email protected]>This makes me think that the pkg-stats script should detect this: if a package has CVE-2023-12345 in its ignore list, but CVE-2023-12345 is not known to affect the package (in its current version) according to the NVD database, we should flag this.
Ideally, we would also like that it be done in check-package, but this is going to be a bit more involved...
Regards,
Yann E. MORIN.
Signature · 10 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------' _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Hey Yann, Thomas,
Quoted 11 lines · Yann E. MORIN
Thomas, Daniel, All,
On 2023-09-20 09:12 +0200, Thomas Petazzoni via buildroot spake thusly:
Quoted 8 lines
Quoted 2 lines · On Wed, 20 Sep 2023 06:31:12 +0200 Daniel Lang <[email protected]> wrote:
As of 2021-05-14 CVE-2017-3139 is no longer listed as affecting bind, only RHEL.
Signed-off-by Daniel Lang <[email protected]>This makes me think that the pkg-stats script should detect this: if a package has CVE-2023-12345 in its ignore list, but CVE-2023-12345 is not known to affect the package (in its current version) according to the NVD database, we should flag this.
Not sure pkg-stats would be the right place as, at least in my uses of it, I simply expect it to collect information and present it to me. Just like it doesn't flag outdated packages, I wouldn't expect it to flag mismatched CVEs or outdated CPEs for that matter.
Quoted 3 lines
Ideally, we would also like that it be done in check-package, but this is going to be a bit more involved...
I haven't looked at check-package closely, but the actual checking should be doable.
The problem that I see is NVD's new API, because the initial download of all CVEs now takes ~30 minutes or so. Seeing as check-package is run on Gitlab CI for every push, the database needs to somehow be kept between runs to avoid re-downloading everything.
I will see if I can come up with a solution.
Quoted 4 lines
Regards,
Yann E. MORIN.
Regards
Daniel
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 4 lines · On Thu, 21 Sep 2023 06:09:38 +0200 Daniel Lang <[email protected]> wrote:
Not sure pkg-stats would be the right place as, at least in my uses of it, I simply expect it to collect information and present it to me. Just like it doesn't flag outdated packages, I wouldn't expect it to flag mismatched CVEs or outdated CPEs for that matter.
I'm not sure to follow you here. pkg-stats is a general tool to help with package maintenance. It provides things like the number of check-package warnings, the number of patches, the list of CVEs affecting the package, so it's a perfect fit to also list the CVEs ignored but not affecting the package.
Quoted 6 lines
I haven't looked at check-package closely, but the actual checking should be doable.
The problem that I see is NVD's new API, because the initial download of all CVEs now takes ~30 minutes or so. Seeing as check-package is run on Gitlab CI for every push, the database needs to somehow be kept between runs to avoid re-downloading everything.
I don't think putting this logic in check-package is reasonable. There is nothing CVE related in check-package right, and like you point out, the fact that it needs the CVE database is a big change that is going to be annoying.
I maintain my position that this should be done in pkg-stats, where we already do all the CVE matching dance, as it's a simple addition to pkg-stats.
Thomas
Signature · 7 lines
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Yann E. MORIN
AppliedDaniel, All,
On 2023-09-20 06:31 +0200, Daniel Lang spake thusly:
Quoted 3 lines
As of 2021-05-14 CVE-2017-3139 is no longer listed as affecting bind, only RHEL.
Signed-off-by Daniel Lang <[email protected]>
Applied to master, thanks.
Regards,
Yann E. MORIN.
Quoted 27 lines
---
v1 -> v2:
add Signed-off-by--- package/bind/bind.mk | 2 -- 1 file changed, 2 deletions(-)package/bind/bind.mk +0
-2@@ -14,8 +14,6 @@ BIND_LICENSE = MPL-2.0 BIND_LICENSE_FILES = COPYRIGHT BIND_CPE_ID_VENDOR = isc BIND_SELINUX_MODULES = bind -# Only applies to RHEL6.x with DNSSEC validation on -BIND_IGNORE_CVES = CVE-2017-3139 # Library CVE and not used by bind but used by ISC DHCP BIND_IGNORE_CVES += CVE-2019-6470 BIND_TARGET_SERVER_SBIN = arpaname ddns-confgen dnssec-checkds dnssec-coverageSignature · 6 lines
2.42.0 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Signature · 10 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------' _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot