|
@@ -41,14 +41,16 @@ CVE_CHECK_MANIFEST ?= "${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.cve
|
|
|
CVE_CHECK_COPY_FILES ??= "1"
|
|
|
CVE_CHECK_CREATE_MANIFEST ??= "1"
|
|
|
|
|
|
+CVE_CHECK_REPORT_PATCHED ??= "1"
|
|
|
+
|
|
|
# Whitelist for packages (PN)
|
|
|
CVE_CHECK_PN_WHITELIST ?= ""
|
|
|
|
|
|
# Whitelist for CVE. If a CVE is found, then it is considered patched.
|
|
|
# The value is a string containing space separated CVE values:
|
|
|
-#
|
|
|
+#
|
|
|
# CVE_CHECK_WHITELIST = 'CVE-2014-2524 CVE-2018-1234'
|
|
|
-#
|
|
|
+#
|
|
|
CVE_CHECK_WHITELIST ?= ""
|
|
|
|
|
|
python cve_save_summary_handler () {
|
|
@@ -332,12 +334,15 @@ def cve_write_data(d, patched, unpatched, whitelisted, cve_data):
|
|
|
bb.utils.mkdirhier(os.path.dirname(cve_file))
|
|
|
|
|
|
for cve in sorted(cve_data):
|
|
|
+ is_patched = cve in patched
|
|
|
+ if is_patched and (d.getVar("CVE_CHECK_REPORT_PATCHED") != "1"):
|
|
|
+ continue
|
|
|
write_string += "PACKAGE NAME: %s\n" % d.getVar("PN")
|
|
|
write_string += "PACKAGE VERSION: %s%s\n" % (d.getVar("EXTENDPE"), d.getVar("PV"))
|
|
|
write_string += "CVE: %s\n" % cve
|
|
|
if cve in whitelisted:
|
|
|
write_string += "CVE STATUS: Whitelisted\n"
|
|
|
- elif cve in patched:
|
|
|
+ elif is_patched:
|
|
|
write_string += "CVE STATUS: Patched\n"
|
|
|
else:
|
|
|
unpatched_cves.append(cve)
|
|
@@ -351,19 +356,20 @@ def cve_write_data(d, patched, unpatched, whitelisted, cve_data):
|
|
|
if unpatched_cves:
|
|
|
bb.warn("Found unpatched CVE (%s), for more information check %s" % (" ".join(unpatched_cves),cve_file))
|
|
|
|
|
|
- with open(cve_file, "w") as f:
|
|
|
- bb.note("Writing file %s with CVE information" % cve_file)
|
|
|
- f.write(write_string)
|
|
|
-
|
|
|
- if d.getVar("CVE_CHECK_COPY_FILES") == "1":
|
|
|
- deploy_file = d.getVar("CVE_CHECK_RECIPE_FILE")
|
|
|
- bb.utils.mkdirhier(os.path.dirname(deploy_file))
|
|
|
- with open(deploy_file, "w") as f:
|
|
|
+ if write_string:
|
|
|
+ with open(cve_file, "w") as f:
|
|
|
+ bb.note("Writing file %s with CVE information" % cve_file)
|
|
|
f.write(write_string)
|
|
|
|
|
|
- if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1":
|
|
|
- cvelogpath = d.getVar("CVE_CHECK_SUMMARY_DIR")
|
|
|
- bb.utils.mkdirhier(cvelogpath)
|
|
|
+ if d.getVar("CVE_CHECK_COPY_FILES") == "1":
|
|
|
+ deploy_file = d.getVar("CVE_CHECK_RECIPE_FILE")
|
|
|
+ bb.utils.mkdirhier(os.path.dirname(deploy_file))
|
|
|
+ with open(deploy_file, "w") as f:
|
|
|
+ f.write(write_string)
|
|
|
+
|
|
|
+ if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1":
|
|
|
+ cvelogpath = d.getVar("CVE_CHECK_SUMMARY_DIR")
|
|
|
+ bb.utils.mkdirhier(cvelogpath)
|
|
|
|
|
|
- with open(d.getVar("CVE_CHECK_TMP_FILE"), "a") as f:
|
|
|
- f.write("%s" % write_string)
|
|
|
+ with open(d.getVar("CVE_CHECK_TMP_FILE"), "a") as f:
|
|
|
+ f.write("%s" % write_string)
|