RE: [poky] CVE CHECK scorev3

Ross,

That fix seems to be already be implemented within 4.2.3. I thought it would be the solution but still running into the issue.

Regards,
Grant

-----Original Message-----
From: [email protected] <[email protected]> On Behalf Of Ross Burton
Sent: Friday, October 13, 2023 8:20 AM
To: Smith, Grant [US] (MS) <[email protected]>
Cc: [email protected]
Subject: EXT :Re: [poky] CVE CHECK scorev3

On 12 Oct 2023, at 01:19, Grant.Smith3 via lists.yoctoproject.org <[email protected]> wrote:
>   In the poky layer (yocto-4.2.3 branch) I am using the built in cve-checker and running into an issue where it is unable to produce the scorev3 metric. All CVEs have a scorev3 equivalent to 0.0. When looking at poky (yocto-4.0.9 branch) I noticed that the cve-checker uses the 1.1 version of the NVD database and can successfully produce scorev3 when running a test build. The yocto-4.2.3 branch uses version 2 of the database. There have also been several patches that affect the way these scores are produced. I am just wondering if anyone might have any insight to this issue or maybe have a solution.

I’ve not tested anything but this sounds like it might be the fix you’re missing:

https://git.openembedded.org/openembedded-core/commit/?id=61a5857efdcc0f49c69c0deb24fce99007aeef19

If you can confirm that then we can backport as needed.

Cheers,
Ross