Re: [poky] [PATCH] Fix parsing of FKIE CVEs

Hello,

the patches should be sent with 'git send-email' to openembedded-core list.

Alex

On Wed, 30 Jul 2025 at 14:42, jonathan.schnitzler via
lists.yoctoproject.org
<[email protected]> wrote:
>
> Hi all,
>
> I noticed issues with the parsing of CVEs from the FKIE-CAD feed (update_db_fkie() in cve-update-db-native.bb)s:
> - It tries to read an accessVector for CVSS v3 & v4 while the attribute is actually called attackVector.
> - It ignores metrics with type "Secondary" even if there is no"Primary".
>
> This leads to a lot of CVEs with accessVector, vectorString and score set to  UNKNOWN/None/0.
> The bug is in master and has been there since FKIE was introduced.
> I attached patches to fix the issue.
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#13702): https://lists.yoctoproject.org/g/poky/message/13702
> Mute This Topic: https://lists.yoctoproject.org/mt/114447585/1686489
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/poky/unsub [[email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
>