Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 1 | # This class is used to check recipes against public CVEs. |
| 2 | # |
| 3 | # In order to use this class just inherit the class in the |
| 4 | # local.conf file and it will add the cve_check task for |
| 5 | # every recipe. The task can be used per recipe, per image, |
| 6 | # or using the special cases "world" and "universe". The |
| 7 | # cve_check task will print a warning for every unpatched |
| 8 | # CVE found and generate a file in the recipe WORKDIR/cve |
| 9 | # directory. If an image is build it will generate a report |
| 10 | # in DEPLOY_DIR_IMAGE for all the packages used. |
| 11 | # |
| 12 | # Example: |
| 13 | # bitbake -c cve_check openssl |
| 14 | # bitbake core-image-sato |
| 15 | # bitbake -k -c cve_check universe |
| 16 | # |
| 17 | # DISCLAIMER |
| 18 | # |
| 19 | # This class/tool is meant to be used as support and not |
| 20 | # the only method to check against CVEs. Running this tool |
| 21 | # doesn't guarantee your packages are free of CVEs. |
| 22 | |
Patrick Williams | 213cb26 | 2021-08-07 19:21:33 -0500 | [diff] [blame] | 23 | # The product name that the CVE database uses defaults to BPN, but may need to |
Brad Bishop | 37a0e4d | 2017-12-04 01:01:44 -0500 | [diff] [blame] | 24 | # be overriden per recipe (for example tiff.bb sets CVE_PRODUCT=libtiff). |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 25 | CVE_PRODUCT ??= "${BPN}" |
Brad Bishop | 316dfdd | 2018-06-25 12:45:53 -0400 | [diff] [blame] | 26 | CVE_VERSION ??= "${PV}" |
Brad Bishop | 37a0e4d | 2017-12-04 01:01:44 -0500 | [diff] [blame] | 27 | |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 28 | CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" |
Andrew Geissler | 82c905d | 2020-04-13 13:39:40 -0500 | [diff] [blame] | 29 | CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_1.1.db" |
Andrew Geissler | c9f7865 | 2020-09-18 14:11:35 -0500 | [diff] [blame] | 30 | CVE_CHECK_DB_FILE_LOCK ?= "${CVE_CHECK_DB_FILE}.lock" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 31 | |
Brad Bishop | 316dfdd | 2018-06-25 12:45:53 -0400 | [diff] [blame] | 32 | CVE_CHECK_LOG ?= "${T}/cve.log" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 33 | CVE_CHECK_TMP_FILE ?= "${TMPDIR}/cve_check" |
Andrew Geissler | b7d2861 | 2020-07-24 16:15:54 -0500 | [diff] [blame] | 34 | CVE_CHECK_SUMMARY_DIR ?= "${LOG_DIR}/cve" |
| 35 | CVE_CHECK_SUMMARY_FILE_NAME ?= "cve-summary" |
| 36 | CVE_CHECK_SUMMARY_FILE ?= "${CVE_CHECK_SUMMARY_DIR}/${CVE_CHECK_SUMMARY_FILE_NAME}" |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 37 | CVE_CHECK_SUMMARY_FILE_NAME_JSON = "cve-summary.json" |
| 38 | CVE_CHECK_SUMMARY_INDEX_PATH = "${CVE_CHECK_SUMMARY_DIR}/cve-summary-index.txt" |
| 39 | |
| 40 | CVE_CHECK_LOG_JSON ?= "${T}/cve.json" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 41 | |
| 42 | CVE_CHECK_DIR ??= "${DEPLOY_DIR}/cve" |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 43 | CVE_CHECK_RECIPE_FILE ?= "${CVE_CHECK_DIR}/${PN}" |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 44 | CVE_CHECK_RECIPE_FILE_JSON ?= "${CVE_CHECK_DIR}/${PN}_cve.json" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 45 | CVE_CHECK_MANIFEST ?= "${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.cve" |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 46 | CVE_CHECK_MANIFEST_JSON ?= "${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.json" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 47 | CVE_CHECK_COPY_FILES ??= "1" |
| 48 | CVE_CHECK_CREATE_MANIFEST ??= "1" |
| 49 | |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 50 | CVE_CHECK_REPORT_PATCHED ??= "1" |
| 51 | |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 52 | # Provide text output |
| 53 | CVE_CHECK_FORMAT_TEXT ??= "1" |
| 54 | |
| 55 | # Provide JSON output |
| 56 | CVE_CHECK_FORMAT_JSON ??= "1" |
| 57 | |
| 58 | # Check for packages without CVEs (no issues or missing product name) |
| 59 | CVE_CHECK_COVERAGE ??= "1" |
| 60 | |
| 61 | # Skip CVE Check for packages (PN) |
Andrew Geissler | 7e0e3c0 | 2022-02-25 20:34:39 +0000 | [diff] [blame] | 62 | CVE_CHECK_SKIP_RECIPE ?= "" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 63 | |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 64 | # Ingore the check for a given list of CVEs. If a CVE is found, |
| 65 | # then it is considered patched. The value is a string containing |
| 66 | # space separated CVE values: |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 67 | # |
Andrew Geissler | 7e0e3c0 | 2022-02-25 20:34:39 +0000 | [diff] [blame] | 68 | # CVE_CHECK_IGNORE = 'CVE-2014-2524 CVE-2018-1234' |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 69 | # |
Andrew Geissler | 7e0e3c0 | 2022-02-25 20:34:39 +0000 | [diff] [blame] | 70 | CVE_CHECK_IGNORE ?= "" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 71 | |
Andrew Geissler | d1e8949 | 2021-02-12 15:35:20 -0600 | [diff] [blame] | 72 | # Layers to be excluded |
| 73 | CVE_CHECK_LAYER_EXCLUDELIST ??= "" |
| 74 | |
Patrick Williams | 213cb26 | 2021-08-07 19:21:33 -0500 | [diff] [blame] | 75 | # Layers to be included |
Andrew Geissler | d1e8949 | 2021-02-12 15:35:20 -0600 | [diff] [blame] | 76 | CVE_CHECK_LAYER_INCLUDELIST ??= "" |
| 77 | |
| 78 | |
Patrick Williams | 213cb26 | 2021-08-07 19:21:33 -0500 | [diff] [blame] | 79 | # set to "alphabetical" for version using single alphabetical character as increment release |
Andrew Geissler | d1e8949 | 2021-02-12 15:35:20 -0600 | [diff] [blame] | 80 | CVE_VERSION_SUFFIX ??= "" |
| 81 | |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 82 | def generate_json_report(d, out_path, link_path): |
| 83 | if os.path.exists(d.getVar("CVE_CHECK_SUMMARY_INDEX_PATH")): |
| 84 | import json |
| 85 | from oe.cve_check import cve_check_merge_jsons |
| 86 | |
| 87 | bb.note("Generating JSON CVE summary") |
| 88 | index_file = d.getVar("CVE_CHECK_SUMMARY_INDEX_PATH") |
| 89 | summary = {"version":"1", "package": []} |
| 90 | with open(index_file) as f: |
| 91 | filename = f.readline() |
| 92 | while filename: |
| 93 | with open(filename.rstrip()) as j: |
| 94 | data = json.load(j) |
| 95 | cve_check_merge_jsons(summary, data) |
| 96 | filename = f.readline() |
| 97 | |
| 98 | with open(out_path, "w") as f: |
| 99 | json.dump(summary, f, indent=2) |
| 100 | |
| 101 | if link_path != out_path: |
| 102 | if os.path.exists(os.path.realpath(link_path)): |
| 103 | os.remove(link_path) |
| 104 | os.symlink(os.path.basename(out_path), link_path) |
| 105 | |
Andrew Geissler | b7d2861 | 2020-07-24 16:15:54 -0500 | [diff] [blame] | 106 | python cve_save_summary_handler () { |
| 107 | import shutil |
| 108 | import datetime |
| 109 | |
| 110 | cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE") |
| 111 | |
| 112 | cve_summary_name = d.getVar("CVE_CHECK_SUMMARY_FILE_NAME") |
| 113 | cvelogpath = d.getVar("CVE_CHECK_SUMMARY_DIR") |
| 114 | bb.utils.mkdirhier(cvelogpath) |
| 115 | |
| 116 | timestamp = datetime.datetime.now().strftime('%Y%m%d%H%M%S') |
| 117 | cve_summary_file = os.path.join(cvelogpath, "%s-%s.txt" % (cve_summary_name, timestamp)) |
| 118 | |
Andrew Geissler | c9f7865 | 2020-09-18 14:11:35 -0500 | [diff] [blame] | 119 | if os.path.exists(cve_tmp_file): |
| 120 | shutil.copyfile(cve_tmp_file, cve_summary_file) |
Andrew Geissler | b7d2861 | 2020-07-24 16:15:54 -0500 | [diff] [blame] | 121 | |
Andrew Geissler | c9f7865 | 2020-09-18 14:11:35 -0500 | [diff] [blame] | 122 | if cve_summary_file and os.path.exists(cve_summary_file): |
| 123 | cvefile_link = os.path.join(cvelogpath, cve_summary_name) |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 124 | # if the paths are the same don't create the link |
| 125 | if cvefile_link != cve_summary_file: |
| 126 | if os.path.exists(os.path.realpath(cvefile_link)): |
| 127 | os.remove(cvefile_link) |
| 128 | os.symlink(os.path.basename(cve_summary_file), cvefile_link) |
Andrew Geissler | b7d2861 | 2020-07-24 16:15:54 -0500 | [diff] [blame] | 129 | |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 130 | if d.getVar("CVE_CHECK_FORMAT_JSON") == "1": |
| 131 | json_summary_link_name = os.path.join(cvelogpath, d.getVar("CVE_CHECK_SUMMARY_FILE_NAME_JSON")) |
| 132 | json_summary_name = os.path.join(cvelogpath, "%s-%s.json" % (cve_summary_name, timestamp)) |
| 133 | generate_json_report(d, json_summary_name, json_summary_link_name) |
| 134 | bb.plain("Complete CVE JSON report summary created at: %s" % json_summary_link_name) |
Andrew Geissler | b7d2861 | 2020-07-24 16:15:54 -0500 | [diff] [blame] | 135 | } |
| 136 | |
| 137 | addhandler cve_save_summary_handler |
| 138 | cve_save_summary_handler[eventmask] = "bb.event.BuildCompleted" |
| 139 | |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 140 | python do_cve_check () { |
| 141 | """ |
| 142 | Check recipe for patched and unpatched CVEs |
| 143 | """ |
Patrick Williams | 0ca19cc | 2021-08-16 14:03:13 -0500 | [diff] [blame] | 144 | from oe.cve_check import get_patched_cves |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 145 | |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 146 | if os.path.exists(d.getVar("CVE_CHECK_DB_FILE")): |
Andrew Geissler | 82c905d | 2020-04-13 13:39:40 -0500 | [diff] [blame] | 147 | try: |
Patrick Williams | 0ca19cc | 2021-08-16 14:03:13 -0500 | [diff] [blame] | 148 | patched_cves = get_patched_cves(d) |
Andrew Geissler | 82c905d | 2020-04-13 13:39:40 -0500 | [diff] [blame] | 149 | except FileNotFoundError: |
| 150 | bb.fatal("Failure in searching patches") |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 151 | ignored, patched, unpatched, status = check_cves(d, patched_cves) |
| 152 | if patched or unpatched or (d.getVar("CVE_CHECK_COVERAGE") == "1" and status): |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 153 | cve_data = get_cve_info(d, patched + unpatched) |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 154 | cve_write_data(d, patched, unpatched, ignored, cve_data, status) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 155 | else: |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 156 | bb.note("No CVE database found, skipping CVE check") |
| 157 | |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 158 | } |
| 159 | |
Patrick Williams | 03907ee | 2022-05-01 06:28:52 -0500 | [diff] [blame] | 160 | addtask cve_check before do_build |
Andrew Geissler | c9f7865 | 2020-09-18 14:11:35 -0500 | [diff] [blame] | 161 | do_cve_check[depends] = "cve-update-db-native:do_fetch" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 162 | do_cve_check[nostamp] = "1" |
| 163 | |
| 164 | python cve_check_cleanup () { |
| 165 | """ |
| 166 | Delete the file used to gather all the CVE information. |
| 167 | """ |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 168 | bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE")) |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 169 | bb.utils.remove(e.data.getVar("CVE_CHECK_SUMMARY_INDEX_PATH")) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 170 | } |
| 171 | |
| 172 | addhandler cve_check_cleanup |
| 173 | cve_check_cleanup[eventmask] = "bb.cooker.CookerExit" |
| 174 | |
| 175 | python cve_check_write_rootfs_manifest () { |
| 176 | """ |
| 177 | Create CVE manifest when building an image |
| 178 | """ |
| 179 | |
| 180 | import shutil |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 181 | from oe.cve_check import cve_check_merge_jsons |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 182 | |
Brad Bishop | d7bf8c1 | 2018-02-25 22:55:05 -0500 | [diff] [blame] | 183 | if d.getVar("CVE_CHECK_COPY_FILES") == "1": |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 184 | deploy_file = d.getVar("CVE_CHECK_RECIPE_FILE") |
Brad Bishop | d7bf8c1 | 2018-02-25 22:55:05 -0500 | [diff] [blame] | 185 | if os.path.exists(deploy_file): |
| 186 | bb.utils.remove(deploy_file) |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 187 | deploy_file_json = d.getVar("CVE_CHECK_RECIPE_FILE_JSON") |
| 188 | if os.path.exists(deploy_file_json): |
| 189 | bb.utils.remove(deploy_file_json) |
Brad Bishop | d7bf8c1 | 2018-02-25 22:55:05 -0500 | [diff] [blame] | 190 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 191 | if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")): |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 192 | bb.note("Writing rootfs CVE manifest") |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 193 | deploy_dir = d.getVar("DEPLOY_DIR_IMAGE") |
| 194 | link_name = d.getVar("IMAGE_LINK_NAME") |
| 195 | manifest_name = d.getVar("CVE_CHECK_MANIFEST") |
| 196 | cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE") |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 197 | |
Andrew Geissler | 7e0e3c0 | 2022-02-25 20:34:39 +0000 | [diff] [blame] | 198 | bb.utils.mkdirhier(os.path.dirname(manifest_name)) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 199 | shutil.copyfile(cve_tmp_file, manifest_name) |
| 200 | |
| 201 | if manifest_name and os.path.exists(manifest_name): |
| 202 | manifest_link = os.path.join(deploy_dir, "%s.cve" % link_name) |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 203 | # if they are the same don't create the link |
| 204 | if manifest_link != manifest_name: |
| 205 | # If we already have another manifest, update symlinks |
| 206 | if os.path.exists(os.path.realpath(manifest_link)): |
| 207 | os.remove(manifest_link) |
| 208 | os.symlink(os.path.basename(manifest_name), manifest_link) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 209 | bb.plain("Image CVE report stored in: %s" % manifest_name) |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 210 | |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 211 | if d.getVar("CVE_CHECK_FORMAT_JSON") == "1": |
| 212 | link_path = os.path.join(deploy_dir, "%s.json" % link_name) |
| 213 | manifest_path = d.getVar("CVE_CHECK_MANIFEST_JSON") |
| 214 | bb.note("Generating JSON CVE manifest") |
| 215 | generate_json_report(d, manifest_path, link_path) |
| 216 | bb.plain("Image CVE JSON report stored in: %s" % link_path) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 217 | } |
| 218 | |
Patrick Williams | 213cb26 | 2021-08-07 19:21:33 -0500 | [diff] [blame] | 219 | ROOTFS_POSTPROCESS_COMMAND:prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}" |
Brad Bishop | d7bf8c1 | 2018-02-25 22:55:05 -0500 | [diff] [blame] | 220 | do_rootfs[recrdeptask] += "${@'do_cve_check' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}" |
Andrew Geissler | d583833 | 2022-05-27 11:33:10 -0500 | [diff] [blame] | 221 | do_populate_sdk[recrdeptask] += "${@'do_cve_check' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 222 | |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 223 | def check_cves(d, patched_cves): |
| 224 | """ |
Brad Bishop | f3fd288 | 2019-06-21 08:06:37 -0400 | [diff] [blame] | 225 | Connect to the NVD database and find unpatched cves. |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 226 | """ |
Andrew Geissler | d1e8949 | 2021-02-12 15:35:20 -0600 | [diff] [blame] | 227 | from oe.cve_check import Version |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 228 | |
Andrew Geissler | 6ce62a2 | 2020-11-30 19:58:47 -0600 | [diff] [blame] | 229 | pn = d.getVar("PN") |
| 230 | real_pv = d.getVar("PV") |
Andrew Geissler | d1e8949 | 2021-02-12 15:35:20 -0600 | [diff] [blame] | 231 | suffix = d.getVar("CVE_VERSION_SUFFIX") |
Andrew Geissler | 6ce62a2 | 2020-11-30 19:58:47 -0600 | [diff] [blame] | 232 | |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 233 | cves_unpatched = [] |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 234 | cves_status = [] |
| 235 | cves_in_recipe = False |
Brad Bishop | f3fd288 | 2019-06-21 08:06:37 -0400 | [diff] [blame] | 236 | # CVE_PRODUCT can contain more than one product (eg. curl/libcurl) |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 237 | products = d.getVar("CVE_PRODUCT").split() |
Brad Bishop | 316dfdd | 2018-06-25 12:45:53 -0400 | [diff] [blame] | 238 | # If this has been unset then we're not scanning for CVEs here (for example, image recipes) |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 239 | if not products: |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 240 | return ([], [], [], {}) |
Brad Bishop | 316dfdd | 2018-06-25 12:45:53 -0400 | [diff] [blame] | 241 | pv = d.getVar("CVE_VERSION").split("+git")[0] |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 242 | |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 243 | # If the recipe has been skipped/ignored we return empty lists |
Andrew Geissler | 7e0e3c0 | 2022-02-25 20:34:39 +0000 | [diff] [blame] | 244 | if pn in d.getVar("CVE_CHECK_SKIP_RECIPE").split(): |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 245 | bb.note("Recipe has been skipped by cve-check") |
| 246 | return ([], [], [], []) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 247 | |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 248 | cve_ignore = d.getVar("CVE_CHECK_IGNORE").split() |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 249 | |
Brad Bishop | f3fd288 | 2019-06-21 08:06:37 -0400 | [diff] [blame] | 250 | import sqlite3 |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 251 | db_file = d.expand("file:${CVE_CHECK_DB_FILE}?mode=ro") |
| 252 | conn = sqlite3.connect(db_file, uri=True) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 253 | |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 254 | # For each of the known product names (e.g. curl has CPEs using curl and libcurl)... |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 255 | for product in products: |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 256 | cves_in_product = False |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 257 | if ":" in product: |
| 258 | vendor, product = product.split(":", 1) |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 259 | else: |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 260 | vendor = "%" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 261 | |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 262 | # Find all relevant CVE IDs. |
| 263 | for cverow in conn.execute("SELECT DISTINCT ID FROM PRODUCTS WHERE PRODUCT IS ? AND VENDOR LIKE ?", (product, vendor)): |
| 264 | cve = cverow[0] |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 265 | |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 266 | if cve in cve_ignore: |
| 267 | bb.note("%s-%s has been ignored for %s" % (product, pv, cve)) |
| 268 | # TODO: this should be in the report as 'ignored' |
Brad Bishop | 64c979e | 2019-11-04 13:55:29 -0500 | [diff] [blame] | 269 | patched_cves.add(cve) |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 270 | continue |
Brad Bishop | f3fd288 | 2019-06-21 08:06:37 -0400 | [diff] [blame] | 271 | elif cve in patched_cves: |
| 272 | bb.note("%s has been patched" % (cve)) |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 273 | continue |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 274 | # Write status once only for each product |
| 275 | if not cves_in_product: |
| 276 | cves_status.append([product, True]) |
| 277 | cves_in_product = True |
| 278 | cves_in_recipe = True |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 279 | |
| 280 | vulnerable = False |
| 281 | for row in conn.execute("SELECT * FROM PRODUCTS WHERE ID IS ? AND PRODUCT IS ? AND VENDOR LIKE ?", (cve, product, vendor)): |
| 282 | (_, _, _, version_start, operator_start, version_end, operator_end) = row |
| 283 | #bb.debug(2, "Evaluating row " + str(row)) |
| 284 | |
Andrew Geissler | 82c905d | 2020-04-13 13:39:40 -0500 | [diff] [blame] | 285 | if (operator_start == '=' and pv == version_start) or version_start == '-': |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 286 | vulnerable = True |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 287 | else: |
| 288 | if operator_start: |
| 289 | try: |
Andrew Geissler | d1e8949 | 2021-02-12 15:35:20 -0600 | [diff] [blame] | 290 | vulnerable_start = (operator_start == '>=' and Version(pv,suffix) >= Version(version_start,suffix)) |
| 291 | vulnerable_start |= (operator_start == '>' and Version(pv,suffix) > Version(version_start,suffix)) |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 292 | except: |
Brad Bishop | 64c979e | 2019-11-04 13:55:29 -0500 | [diff] [blame] | 293 | bb.warn("%s: Failed to compare %s %s %s for %s" % |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 294 | (product, pv, operator_start, version_start, cve)) |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 295 | vulnerable_start = False |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 296 | else: |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 297 | vulnerable_start = False |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 298 | |
| 299 | if operator_end: |
| 300 | try: |
Andrew Geissler | d1e8949 | 2021-02-12 15:35:20 -0600 | [diff] [blame] | 301 | vulnerable_end = (operator_end == '<=' and Version(pv,suffix) <= Version(version_end,suffix) ) |
| 302 | vulnerable_end |= (operator_end == '<' and Version(pv,suffix) < Version(version_end,suffix) ) |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 303 | except: |
Brad Bishop | 64c979e | 2019-11-04 13:55:29 -0500 | [diff] [blame] | 304 | bb.warn("%s: Failed to compare %s %s %s for %s" % |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 305 | (product, pv, operator_end, version_end, cve)) |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 306 | vulnerable_end = False |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 307 | else: |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 308 | vulnerable_end = False |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 309 | |
| 310 | if operator_start and operator_end: |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 311 | vulnerable = vulnerable_start and vulnerable_end |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 312 | else: |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 313 | vulnerable = vulnerable_start or vulnerable_end |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 314 | |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 315 | if vulnerable: |
Andrew Geissler | 6ce62a2 | 2020-11-30 19:58:47 -0600 | [diff] [blame] | 316 | bb.note("%s-%s is vulnerable to %s" % (pn, real_pv, cve)) |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 317 | cves_unpatched.append(cve) |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 318 | break |
| 319 | |
| 320 | if not vulnerable: |
Andrew Geissler | 6ce62a2 | 2020-11-30 19:58:47 -0600 | [diff] [blame] | 321 | bb.note("%s-%s is not vulnerable to %s" % (pn, real_pv, cve)) |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 322 | # TODO: not patched but not vulnerable |
| 323 | patched_cves.add(cve) |
| 324 | |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 325 | if not cves_in_product: |
| 326 | bb.note("No CVE records found for product %s, pn %s" % (product, pn)) |
| 327 | cves_status.append([product, False]) |
| 328 | |
Brad Bishop | f3fd288 | 2019-06-21 08:06:37 -0400 | [diff] [blame] | 329 | conn.close() |
| 330 | |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 331 | if not cves_in_recipe: |
| 332 | bb.note("No CVE records for products in recipe %s" % (pn)) |
| 333 | |
| 334 | return (list(cve_ignore), list(patched_cves), cves_unpatched, cves_status) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 335 | |
| 336 | def get_cve_info(d, cves): |
| 337 | """ |
Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 338 | Get CVE information from the database. |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 339 | """ |
| 340 | |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 341 | import sqlite3 |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 342 | |
| 343 | cve_data = {} |
Andrew Geissler | 7e0e3c0 | 2022-02-25 20:34:39 +0000 | [diff] [blame] | 344 | db_file = d.expand("file:${CVE_CHECK_DB_FILE}?mode=ro") |
| 345 | conn = sqlite3.connect(db_file, uri=True) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 346 | |
Brad Bishop | 6dbb316 | 2019-11-25 09:41:34 -0500 | [diff] [blame] | 347 | for cve in cves: |
| 348 | for row in conn.execute("SELECT * FROM NVD WHERE ID IS ?", (cve,)): |
| 349 | cve_data[row[0]] = {} |
| 350 | cve_data[row[0]]["summary"] = row[1] |
| 351 | cve_data[row[0]]["scorev2"] = row[2] |
| 352 | cve_data[row[0]]["scorev3"] = row[3] |
| 353 | cve_data[row[0]]["modified"] = row[4] |
| 354 | cve_data[row[0]]["vector"] = row[5] |
| 355 | |
| 356 | conn.close() |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 357 | return cve_data |
| 358 | |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 359 | def cve_write_data_text(d, patched, unpatched, ignored, cve_data): |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 360 | """ |
| 361 | Write CVE information in WORKDIR; and to CVE_CHECK_DIR, and |
| 362 | CVE manifest if enabled. |
| 363 | """ |
| 364 | |
Brad Bishop | 316dfdd | 2018-06-25 12:45:53 -0400 | [diff] [blame] | 365 | cve_file = d.getVar("CVE_CHECK_LOG") |
Andrew Geissler | d1e8949 | 2021-02-12 15:35:20 -0600 | [diff] [blame] | 366 | fdir_name = d.getVar("FILE_DIRNAME") |
| 367 | layer = fdir_name.split("/")[-3] |
| 368 | |
| 369 | include_layers = d.getVar("CVE_CHECK_LAYER_INCLUDELIST").split() |
| 370 | exclude_layers = d.getVar("CVE_CHECK_LAYER_EXCLUDELIST").split() |
| 371 | |
| 372 | if exclude_layers and layer in exclude_layers: |
| 373 | return |
| 374 | |
| 375 | if include_layers and layer not in include_layers: |
| 376 | return |
| 377 | |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 378 | # Early exit, the text format does not report packages without CVEs |
| 379 | if not patched+unpatched: |
| 380 | return |
| 381 | |
Patrick Williams | 213cb26 | 2021-08-07 19:21:33 -0500 | [diff] [blame] | 382 | nvd_link = "https://nvd.nist.gov/vuln/detail/" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 383 | write_string = "" |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 384 | unpatched_cves = [] |
Brad Bishop | 316dfdd | 2018-06-25 12:45:53 -0400 | [diff] [blame] | 385 | bb.utils.mkdirhier(os.path.dirname(cve_file)) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 386 | |
| 387 | for cve in sorted(cve_data): |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 388 | is_patched = cve in patched |
| 389 | if is_patched and (d.getVar("CVE_CHECK_REPORT_PATCHED") != "1"): |
| 390 | continue |
Andrew Geissler | d1e8949 | 2021-02-12 15:35:20 -0600 | [diff] [blame] | 391 | write_string += "LAYER: %s\n" % layer |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 392 | write_string += "PACKAGE NAME: %s\n" % d.getVar("PN") |
Andrew Geissler | 4ed12e1 | 2020-06-05 18:00:41 -0500 | [diff] [blame] | 393 | write_string += "PACKAGE VERSION: %s%s\n" % (d.getVar("EXTENDPE"), d.getVar("PV")) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 394 | write_string += "CVE: %s\n" % cve |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 395 | if cve in ignored: |
| 396 | write_string += "CVE STATUS: Ignored\n" |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 397 | elif is_patched: |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 398 | write_string += "CVE STATUS: Patched\n" |
| 399 | else: |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 400 | unpatched_cves.append(cve) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 401 | write_string += "CVE STATUS: Unpatched\n" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 402 | write_string += "CVE SUMMARY: %s\n" % cve_data[cve]["summary"] |
Brad Bishop | f3fd288 | 2019-06-21 08:06:37 -0400 | [diff] [blame] | 403 | write_string += "CVSS v2 BASE SCORE: %s\n" % cve_data[cve]["scorev2"] |
| 404 | write_string += "CVSS v3 BASE SCORE: %s\n" % cve_data[cve]["scorev3"] |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 405 | write_string += "VECTOR: %s\n" % cve_data[cve]["vector"] |
| 406 | write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link, cve) |
| 407 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 408 | if unpatched_cves: |
| 409 | bb.warn("Found unpatched CVE (%s), for more information check %s" % (" ".join(unpatched_cves),cve_file)) |
| 410 | |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 411 | if write_string: |
| 412 | with open(cve_file, "w") as f: |
| 413 | bb.note("Writing file %s with CVE information" % cve_file) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 414 | f.write(write_string) |
| 415 | |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 416 | if d.getVar("CVE_CHECK_COPY_FILES") == "1": |
| 417 | deploy_file = d.getVar("CVE_CHECK_RECIPE_FILE") |
| 418 | bb.utils.mkdirhier(os.path.dirname(deploy_file)) |
| 419 | with open(deploy_file, "w") as f: |
| 420 | f.write(write_string) |
Andrew Geissler | b7d2861 | 2020-07-24 16:15:54 -0500 | [diff] [blame] | 421 | |
Andrew Geissler | c3d88e4 | 2020-10-02 09:45:00 -0500 | [diff] [blame] | 422 | if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1": |
| 423 | cvelogpath = d.getVar("CVE_CHECK_SUMMARY_DIR") |
| 424 | bb.utils.mkdirhier(cvelogpath) |
| 425 | |
| 426 | with open(d.getVar("CVE_CHECK_TMP_FILE"), "a") as f: |
| 427 | f.write("%s" % write_string) |
Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame] | 428 | |
| 429 | def cve_check_write_json_output(d, output, direct_file, deploy_file, manifest_file): |
| 430 | """ |
| 431 | Write CVE information in the JSON format: to WORKDIR; and to |
| 432 | CVE_CHECK_DIR, if CVE manifest if enabled, write fragment |
| 433 | files that will be assembled at the end in cve_check_write_rootfs_manifest. |
| 434 | """ |
| 435 | |
| 436 | import json |
| 437 | |
| 438 | write_string = json.dumps(output, indent=2) |
| 439 | with open(direct_file, "w") as f: |
| 440 | bb.note("Writing file %s with CVE information" % direct_file) |
| 441 | f.write(write_string) |
| 442 | |
| 443 | if d.getVar("CVE_CHECK_COPY_FILES") == "1": |
| 444 | bb.utils.mkdirhier(os.path.dirname(deploy_file)) |
| 445 | with open(deploy_file, "w") as f: |
| 446 | f.write(write_string) |
| 447 | |
| 448 | if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1": |
| 449 | cvelogpath = d.getVar("CVE_CHECK_SUMMARY_DIR") |
| 450 | index_path = d.getVar("CVE_CHECK_SUMMARY_INDEX_PATH") |
| 451 | bb.utils.mkdirhier(cvelogpath) |
| 452 | fragment_file = os.path.basename(deploy_file) |
| 453 | fragment_path = os.path.join(cvelogpath, fragment_file) |
| 454 | with open(fragment_path, "w") as f: |
| 455 | f.write(write_string) |
| 456 | with open(index_path, "a+") as f: |
| 457 | f.write("%s\n" % fragment_path) |
| 458 | |
| 459 | def cve_write_data_json(d, patched, unpatched, ignored, cve_data, cve_status): |
| 460 | """ |
| 461 | Prepare CVE data for the JSON format, then write it. |
| 462 | """ |
| 463 | |
| 464 | output = {"version":"1", "package": []} |
| 465 | nvd_link = "https://nvd.nist.gov/vuln/detail/" |
| 466 | |
| 467 | fdir_name = d.getVar("FILE_DIRNAME") |
| 468 | layer = fdir_name.split("/")[-3] |
| 469 | |
| 470 | include_layers = d.getVar("CVE_CHECK_LAYER_INCLUDELIST").split() |
| 471 | exclude_layers = d.getVar("CVE_CHECK_LAYER_EXCLUDELIST").split() |
| 472 | |
| 473 | if exclude_layers and layer in exclude_layers: |
| 474 | return |
| 475 | |
| 476 | if include_layers and layer not in include_layers: |
| 477 | return |
| 478 | |
| 479 | unpatched_cves = [] |
| 480 | |
| 481 | product_data = [] |
| 482 | for s in cve_status: |
| 483 | p = {"product": s[0], "cvesInRecord": "Yes"} |
| 484 | if s[1] == False: |
| 485 | p["cvesInRecord"] = "No" |
| 486 | product_data.append(p) |
| 487 | |
| 488 | package_version = "%s%s" % (d.getVar("EXTENDPE"), d.getVar("PV")) |
| 489 | package_data = { |
| 490 | "name" : d.getVar("PN"), |
| 491 | "layer" : layer, |
| 492 | "version" : package_version, |
| 493 | "products": product_data |
| 494 | } |
| 495 | cve_list = [] |
| 496 | |
| 497 | for cve in sorted(cve_data): |
| 498 | is_patched = cve in patched |
| 499 | status = "Unpatched" |
| 500 | if is_patched and (d.getVar("CVE_CHECK_REPORT_PATCHED") != "1"): |
| 501 | continue |
| 502 | if cve in ignored: |
| 503 | status = "Ignored" |
| 504 | elif is_patched: |
| 505 | status = "Patched" |
| 506 | else: |
| 507 | # default value of status is Unpatched |
| 508 | unpatched_cves.append(cve) |
| 509 | |
| 510 | issue_link = "%s%s" % (nvd_link, cve) |
| 511 | |
| 512 | cve_item = { |
| 513 | "id" : cve, |
| 514 | "summary" : cve_data[cve]["summary"], |
| 515 | "scorev2" : cve_data[cve]["scorev2"], |
| 516 | "scorev3" : cve_data[cve]["scorev3"], |
| 517 | "vector" : cve_data[cve]["vector"], |
| 518 | "status" : status, |
| 519 | "link": issue_link |
| 520 | } |
| 521 | cve_list.append(cve_item) |
| 522 | |
| 523 | package_data["issue"] = cve_list |
| 524 | output["package"].append(package_data) |
| 525 | |
| 526 | direct_file = d.getVar("CVE_CHECK_LOG_JSON") |
| 527 | deploy_file = d.getVar("CVE_CHECK_RECIPE_FILE_JSON") |
| 528 | manifest_file = d.getVar("CVE_CHECK_SUMMARY_FILE_NAME_JSON") |
| 529 | |
| 530 | cve_check_write_json_output(d, output, direct_file, deploy_file, manifest_file) |
| 531 | |
| 532 | def cve_write_data(d, patched, unpatched, ignored, cve_data, status): |
| 533 | """ |
| 534 | Write CVE data in each enabled format. |
| 535 | """ |
| 536 | |
| 537 | if d.getVar("CVE_CHECK_FORMAT_TEXT") == "1": |
| 538 | cve_write_data_text(d, patched, unpatched, ignored, cve_data) |
| 539 | if d.getVar("CVE_CHECK_FORMAT_JSON") == "1": |
| 540 | cve_write_data_json(d, patched, unpatched, ignored, cve_data, status) |