diff mbox series

[v3,6/8] cve-check: optionally allow to force update

Message ID 20250429143904.634082-7-daniel.turull@ericsson.com
State New
Headers show
Series Check compiled files to filter kernel CVEs | expand

Commit Message

Daniel Turull April 29, 2025, 2:39 p.m. UTC 
From: Daniel Turull <daniel.turull@ericsson.com>

When introducing multiple sources of CVE potentially it could be the
case that the answers are different due to data quality.

Allow to override CVE information from the scan from Unpatched to patched

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 meta/classes/cve-check.bbclass | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index cce10c70ee..81512c255d 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -277,7 +277,7 @@  def cve_is_patched(d, cve_data, cve):
         return True
     return False
 
-def cve_update(d, cve_data, cve, entry):
+def cve_update(d, cve_data, cve, entry, force_update=False):
     # If no entry, just add it
     if cve not in cve_data:
         cve_data[cve] = entry
@@ -297,7 +297,11 @@  def cve_update(d, cve_data, cve, entry):
             bb.debug(1, "CVE entry %s update from Patched to Unpatched from the scan result" % cve)
             return
     if entry['abbrev-status'] == "Patched" and cve_data[cve]['abbrev-status'] == "Unpatched":
-        if entry['status'] == "version-not-in-range" and cve_data[cve]['status'] == "version-in-range":
+        if force_update:
+            cve_data[cve] = entry
+            bb.debug(1, "CVE entry %s forced to update from Patched to Unpatched from the scan result" % cve)
+            return
+        elif entry['status'] == "version-not-in-range" and cve_data[cve]['status'] == "version-in-range":
             # Range does not match the scan, but we already have a vulnerable match, ignore
             bb.debug(1, "CVE entry %s update from Patched to Unpatched from the scan result - not applying" % cve)
             return
@@ -416,7 +420,7 @@  def check_cves(d, cve_data):
 
             if not vulnerable:
                 bb.note("%s-%s is not vulnerable to %s" % (pn, real_pv, cve))
-                cve_update(d, cve_data, cve, {"abbrev-status": "Patched", "status": "version-not-in-range"})
+                cve_update(d, cve_data, cve, {"abbrev-status": "Patched", "status": "version-not-in-range"}, force_update=True)
         cve_cursor.close()
 
         if not cves_in_product: