Re: [poky] CVE CHECK scorev3

On Wed, Oct 11, 2023 at 2:19 PM <[email protected]> wrote:
>
> All,
>
>
>
> In the poky layer (yocto-4.2.3 branch) I am using the built in cve-checker and running into an issue where it is unable to produce the scorev3 metric. All CVEs have a scorev3 equivalent to 0.0. When looking at poky (yocto-4.0.9 branch) I noticed that the cve-checker uses the 1.1 version of the NVD database and can successfully produce scorev3 when running a test build.

You are using an old version of kirkstone (4.0.9), the current version
is 4.0.13.  The current version now uses the new version of the
cve-checker.  I just checked and the code is identical in kirkstone
and mickledore, with the exception of this commit which is required
for some older distros which are supported by kirkstone but not
mickledore:

https://git.yoctoproject.org/poky/commit/?h=kirkstone&id=cd1d34d5106c4484372552bb3cf93198f7b25d76

So kirkstone and mickledore should be producing identical results
(assuming the same recipe versions of course)

Looking at a random sampling of json files though, I also see
"scorev3": "0.0" in all of them.

So I suspect that there is a bug, and it is present in all branches
(master, mickledore, kirkstone, dunfell)

Steve