cve-check.bbclass: make warning contain CVE IDs

PATCH Superseded Chen Qi 2 participants 4 messages May 9, 2017

lore

Share & tools

lore

Chen Qi

author

2017-05-09 09:11 UTC #0 lore raw

cover cve-check.bbclass: make warning contain CVE IDs

The following changes since commit 381897c64069ea43d595380a3ae913bcc79cf7e1:

build-appliance-image: Update to master head revision (2017-05-01 08:56:47 +0100)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib ChenQi/cve-check-warning
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=ChenQi/cve-check-warning

Chen Qi (1):
cve-check.bbclass: make warning contain CVE IDs

 meta/classes/cve-check.bbclass | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Signature · 1 line

1.9.1

Chen Qi

author

2017-05-09 09:11 UTC #1 lore raw

PATCH 1/1 cve-check.bbclass: make warning contain CVE IDs

When warning users about unpatched CVE, we'd better put CVE IDs into the warning message, so that it would be more straight forward for the user to know which CVEs are not patched.

So instead of:
WARNING: gnutls-3.5.9-r0 do_cve_check: Found unpatched CVE, for more information check /path/to/workdir/cve/cve.log.
We should have:
WARNING: gnutls-3.5.9-r0 do_cve_check: Found unpatched CVE (CVE-2017-7869), for more information check /path/to/workdir/cve/cve.log.

Signed-off-by Chen Qi <[email protected]>

---
 meta/classes/cve-check.bbclass | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

meta/classes/cve-check.bbclass +7 -4

index 0e4294f..496d744 100644
@@ -234,7 +234,8 @@ def cve_write_data(d, patched, unpatched, cve_data):
     cve_file = d.getVar("CVE_CHECK_LOCAL_FILE")
     nvd_link = "https://web.nvd.nist.gov/view/vuln/detail?vulnId="
     write_string = ""
-    first_alert = True
+    has_unpatched_cve = False
+    unpatched_cves = []
     bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR"))
 
     for cve in sorted(cve_data):

@@ -244,15 +245,17 @@ def cve_write_data(d, patched, unpatched, cve_data):
         if cve in patched:
             write_string += "CVE STATUS: Patched\n"
         else:
+            unpatched_cves.append(cve)
             write_string += "CVE STATUS: Unpatched\n"
-            if first_alert:
-                bb.warn("Found unpatched CVE, for more information check %s" % cve_file)
-                first_alert = False
+            has_unpatched_cve = True
         write_string += "CVE SUMMARY: %s\n" % cve_data[cve]["summary"]
         write_string += "CVSS v2 BASE SCORE: %s\n" % cve_data[cve]["score"]
         write_string += "VECTOR: %s\n" % cve_data[cve]["vector"]
         write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link, cve)
 
+    if has_unpatched_cve:
+        bb.warn("Found unpatched CVE (%s), for more information check %s" % (" ".join(unpatched_cves),cve_file))
+
     with open(cve_file, "w") as f:
         bb.note("Writing file %s with CVE information" % cve_file)
         f.write(write_string)

Signature · 1 line

1.9.1

Joshua Lock

2017-05-09 09:17 UTC #2 lore raw

Quoted 46 lines · Chen Qi

When warning users about unpatched CVE, we'd better put CVE IDs into the warning message, so that it would be more straight forward for the
user to know which CVEs are not patched.
So instead of:
WARNING: gnutls-3.5.9-r0 do_cve_check: Found unpatched CVE, for more information check /path/to/workdir/cve/cve.log.
We should have:
WARNING: gnutls-3.5.9-r0 do_cve_check: Found unpatched CVE (CVE- 2017-7869), for more information check /path/to/workdir/cve/cve.log.
Signed-off-by Chen Qi <[email protected]>
---
meta/classes/cve-check.bbclass | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)
meta/classes/cve- renamed from meta/classes/cve-check.bbclass +0 -0
check.bbclass
index 0e4294f..496d744 100644
meta/classes/cve-check.bbclass +0 -0
@@ -234,7 +234,8 @@ def cve_write_data(d, patched, unpatched,
cve_data):
     cve_file = d.getVar("CVE_CHECK_LOCAL_FILE") nvd_link = "https://web.nvd.nist.gov/view/vuln/detail?vulnId=" write_string = ""
-    first_alert = True
+    has_unpatched_cve = False
+    unpatched_cves = [] bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR"))
     for cve in sorted(cve_data):
meta/classes/cve-check.bbclass +0 -0
@@ -244,15 +245,17 @@ def cve_write_data(d, patched, unpatched,
cve_data):
         if cve in patched:
             write_string += "CVE STATUS: Patched\n" else:
+            unpatched_cves.append(cve)
             write_string += "CVE STATUS: Unpatched\n"
-            if first_alert:
-                bb.warn("Found unpatched CVE, for more information check %s" % cve_file)
-                first_alert = False
+            has_unpatched_cve = True
         write_string += "CVE SUMMARY: %s\n" %

Quoted 8 lines

cve_data[cve]["summary"]
         write_string += "CVSS v2 BASE SCORE: %s\n" % cve_data[cve]["score"]
         write_string += "VECTOR: %s\n" % cve_data[cve]["vector"] write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link, cve)

+    if has_unpatched_cve:

There's no need for the has_unpatched_cve variable, you can just test whether the unpatched_cves list is empty:

Quoted 3 lines

Quoted 3 lines
Quoted 3 lines
foo = []
bar = [1, 2, 3]
if foo:

... print("foo")
...

Quoted 1 line

Quoted 1 line
Quoted 1 line
if bar:

... print("bar")
...
bar

Your conditional can just be:

+ if unpatched_cve:

Quoted 9 lines

+        bb.warn("Found unpatched CVE (%s), for more information check %s" % (" ".join(unpatched_cves),cve_file))
+
     with open(cve_file, "w") as f:
         bb.note("Writing file %s with CVE information" % cve_file) f.write(write_string)
--
1.9.1

ChenQi

author

2017-05-09 09:23 UTC #3 lore raw

Quoted 63 lines · Joshua Lock

Quoted 47 lines · Chen Qi
When warning users about unpatched CVE, we'd better put CVE IDs into the warning message, so that it would be more straight forward for the
user to know which CVEs are not patched.
So instead of:
WARNING: gnutls-3.5.9-r0 do_cve_check: Found unpatched CVE, for
more information check /path/to/workdir/cve/cve.log.
We should have:
WARNING: gnutls-3.5.9-r0 do_cve_check: Found unpatched CVE (CVE-
2017-7869), for more information check /path/to/workdir/cve/cve.log.
Signed-off-by Chen Qi <[email protected]>
---
  meta/classes/cve-check.bbclass | 11 +++++++----
  1 file changed, 7 insertions(+), 4 deletions(-)
meta/classes/cve- renamed from meta/classes/cve-check.bbclass +0 -0
check.bbclass
index 0e4294f..496d744 100644
meta/classes/cve-check.bbclass +0 -0
@@ -234,7 +234,8 @@ def cve_write_data(d, patched, unpatched,
cve_data):
cve_file = d.getVar("CVE_CHECK_LOCAL_FILE") nvd_link = "https://web.nvd.nist.gov/view/vuln/detail?vulnId=" write_string = ""
meta/classes/cve-check.bbclass +2 -1
-    first_alert = True
+    has_unpatched_cve = False
+    unpatched_cves = []
      bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR"))
 
      for cve in sorted(cve_data):
@@ -244,15 +245,17 @@ def cve_write_data(d, patched, unpatched,
cve_data):
if cve in patched:
write_string += "CVE STATUS: Patched\n"
else:
meta/classes/cve-check.bbclass +1 -2
+            unpatched_cves.append(cve)
              write_string += "CVE STATUS: Unpatched\n"
-            if first_alert:
-                bb.warn("Found unpatched CVE, for more information
check %s" % cve_file)
meta/classes/cve-check.bbclass +1 -1
-                first_alert = False
+            has_unpatched_cve = True
          write_string += "CVE SUMMARY: %s\n" %
cve_data[cve]["summary"]
Quoted 7 lines
          write_string += "CVSS v2 BASE SCORE: %s\n" %
cve_data[cve]["score"]
          write_string += "VECTOR: %s\n" % cve_data[cve]["vector"]
          write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link,
cve)
+ if has_unpatched_cve:
There's no need for the has_unpatched_cve variable, you can just test whether the unpatched_cves list is empty:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
foo = []
bar = [1, 2, 3]
if foo:
... print("foo")
...

Quoted 8 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
if bar:
... print("bar")
...
bar
Your conditional can just be:
+ if unpatched_cve:

Thanks a lot.
I'll send out V2.

Best Regards,
Chen Qi

Quoted 9 lines

Quoted 9 lines
+ bb.warn("Found unpatched CVE (%s), for more information
check %s" % (" ".join(unpatched_cves),cve_file))
+
with open(cve_file, "w") as f:
bb.note("Writing file %s with CVE information" % cve_file) f.write(write_string)
Signature · 1 line
1.9.1