Your daily results for 2020-10-25
A message that is not in the archive (sent off-list or not yet received): mid:2841
Hi all,
The CVE listed below appears only to relate to openjdk6 and openjdk7. The current package builds openjdk11.0.8 or openjdk14.0.2.
openjdk6 and 7 are incredibly old now and predate both buildroot and OpenJDK's LTS versions. Are they not outside the buildroot support window?
Cheers,
Tudor.
Quoted 14 lines · Thomas Petazzoni
Hello,
Packages with CVEs
==================This is the list of packages for which a known CVE is affecting them, which means a security vulnerability exists for those packages.
name | CVE |
link
-------------------------------+------------------+--------------------------------------------------------------openjdk | CVE-2013-0169 |
Tudor,
Quoted 6 lines · Tudor Holton
Hi all,
The CVE listed below appears only to relate to openjdk6 and openjdk7. The current package builds openjdk11.0.8 or openjdk14.0.2.
The vulnerability database must not be mapping the impacted versions correctly (ie. CVE is applicable to which CPE or range of CPE
versions). When I look at
https://nvd.nist.gov/vuln/detail/CVE-2013-0169 , I see specific entries for 1.6 / 1.7 / 1.8 and an entry of cpe:2.3:a:oracle:openjdk:-:*:*:*:*:*:*:* . I wonder if we are incorrectly string matching that "-" as a version? +Gregory any ideas?
Tudor, you can definitely send a patch to ignore this CVE but I believe we may have a matching issue with our scripts. As the following are the listed CPE matches which according to the CVE text look correct.
cpe:2.3:a:oracle:openjdk:-:*:*:*:*:*:*:* cpe:2.3:a:oracle:openjdk:1.6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:openjdk:1.7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:openjdk:1.8.0:*:*:*:*:*:*:*
Best Regards,
Matt
Quoted 11 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Matthew" == Matthew Weber <[email protected]> writes:
Tudor,
Quoted 6 lines · Tudor Holton
Hi all,
The CVE listed below appears only to relate to openjdk6 and openjdk7. The current package builds openjdk11.0.8 or openjdk14.0.2.
Quoted 8 lines
The vulnerability database must not be mapping the impacted versions correctly (ie. CVE is applicable to which CPE or range of CPE
versions). When I look at
https://nvd.nist.gov/vuln/detail/CVE-2013-0169 , I see specific entries for 1.6 / 1.7 / 1.8 and an entry of cpe:2.3:a:oracle:openjdk:-:*:*:*:*:*:*:* . I wonder if we are incorrectly string matching that "-" as a version? +Gregory any ideas?
Yes, I believe we do so since:
commit 008ca2c583cb9dc70cd30c5318b3b1cbef57b06a
Author: Thomas Petazzoni <[email protected]> Date: Thu Aug 27 18:55:08 2020 +0200
support/scripts/pkg-stats: consider "-" as a wildcard when doing CVE version matching
Some CVE entries in the NVD database have version_value set to "-", which seems to indicate that it applies to all versions of the software project, or that they don't really know which versions are affected, and which are not.
So, for the benefit of doubt, it seems more appropriate to consider such CVEs as affecting our packages.
This makes the total number of CVEs affecting our next branch jump from 141 CVEs to 658 CVEs, but that number will go back down once we switch to the JSON 1.1 schema. Indeed, in the JSON 1.0 schema, there are often cases where a version_value is set to "=" *and* specific versions are set to.
How should a '-' be interpreted?
Signature · 1 line
Bye, Peter Korsgaard
Peter,
Quoted 43 lines · Peter Korsgaard
Quoted 12 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
"Matthew" == Matthew Weber <[email protected]> writes:
Tudor,
Quoted 6 lines · Tudor Holton
Hi all,
The CVE listed below appears only to relate to openjdk6 and openjdk7. The current package builds openjdk11.0.8 or openjdk14.0.2.
Quoted 8 lines
The vulnerability database must not be mapping the impacted versions correctly (ie. CVE is applicable to which CPE or range of CPE
versions). When I look at
https://nvd.nist.gov/vuln/detail/CVE-2013-0169 , I see specific entries for 1.6 / 1.7 / 1.8 and an entry of cpe:2.3:a:oracle:openjdk:-:*:*:*:*:*:*:* . I wonder if we are incorrectly string matching that "-" as a version? +Gregory any ideas?Yes, I believe we do so since:
commit
008ca2c583cb9dc70cd30c5318b3b1cbef57b06aAuthor: Thomas Petazzoni <[email protected]> Date: Thu Aug 27 18:55:08 2020 +0200support/scripts/pkg-stats: consider "-" as a wildcard when doing CVE version matching
Some CVE entries in the NVD database have
version_valueset to "-", which seems to indicate that it applies to all versions of the software project, or that they don't really know which versions are affected, and which are not.So, for the benefit of doubt, it seems more appropriate to consider such CVEs as affecting our packages.
This makes the total number of CVEs affecting our next branch jump from 141 CVEs to 658 CVEs, but that number will go back down once we switch to the JSON 1.1 schema. Indeed, in the JSON 1.0 schema, there are often cases where a
version_valueis set to "=" *and* specific versions are set to.
Quoted 5 lines
Signed-off-by Thomas Petazzoni <[email protected]>How should a '-' be interpreted?
Buildroot is doing it correctly by assuming all versions. In the CVE dictionary entry they should be listing out all impacted versions if there is a subset and not all. I believe sometimes they set '-' just to be sure someone will look at it and narrow down to the applicable set.
Matt