Re: [poky] CVE CHECK scorev3
Ross Burton <[email protected]>
| Newsgroups | org.yoctoproject.lists.poky |
|---|---|
| Message-ID | <[email protected]> |
On 12 Oct 2023, at 01:19, Grant.Smith3 via lists.yoctoproject.org <[email protected]> wrote: > In the poky layer (yocto-4.2.3 branch) I am using the built in cve-checker and running into an issue where it is unable to produce the scorev3 metric. All CVEs have a scorev3 equivalent to 0.0. When looking at poky (yocto-4.0.9 branch) I noticed that the cve-checker uses the 1.1 version of the NVD database and can successfully produce scorev3 when running a test build. The yocto-4.2.3 branch uses version 2 of the database. There have also been several patches that affect the way these scores are produced. I am just wondering if anyone might have any insight to this issue or maybe have a solution. I’ve not tested anything but this sounds like it might be the fix you’re missing: https://git.openembedded.org/openembedded-core/commit/?id=61a5857efdcc0f49c69c0deb24fce99007aeef19 If you can confirm that then we can backport as needed. Cheers, Ross