* OE-core CVE metrics for master on Sun 10 Apr 2022 02:00:01 AM HST
@ 2022-04-10 12:02 steve
2022-04-12 10:52 ` [yocto-security] " Richard Purdie
0 siblings, 1 reply; 3+ messages in thread
From: steve @ 2022-04-10 12:02 UTC (permalink / raw)
To: openembedded-core, yocto-security
Branch: master
New this week: 4 CVEs
CVE-2019-1010238 (CVSS3: 9.8 CRITICAL): pango:pango-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010238 *
CVE-2022-1050 (CVSS3: 8.8 HIGH): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1050 *
CVE-2022-1056 (CVSS3: 5.5 MEDIUM): tiff https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1056 *
CVE-2022-26280 (CVSS3: 9.1 CRITICAL): libarchive:libarchive-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-26280 *
Removed this week: 1 CVEs
CVE-2022-0943 (CVSS3: 7.8 HIGH): vim https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0943 *
Full list: Found 12 unpatched CVEs
CVE-2019-1010238 (CVSS3: 9.8 CRITICAL): pango:pango-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010238 *
CVE-2019-12067 (CVSS3: 6.5 MEDIUM): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12067 *
CVE-2020-18974 (CVSS3: 3.3 LOW): nasm:nasm-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-18974 *
CVE-2021-20255 (CVSS3: 5.5 MEDIUM): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20255 *
CVE-2021-44647 (CVSS3: 5.5 MEDIUM): lua:lua-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44647 *
CVE-2022-0529 (CVSS3: 7.8 HIGH): unzip:unzip-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0529 *
CVE-2022-0530 (CVSS3: 7.8 HIGH): unzip:unzip-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0530 *
CVE-2022-1050 (CVSS3: 8.8 HIGH): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1050 *
CVE-2022-1056 (CVSS3: 5.5 MEDIUM): tiff https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1056 *
CVE-2022-24975 (CVSS3: 7.5 HIGH): git https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24975 *
CVE-2022-26280 (CVSS3: 9.1 CRITICAL): libarchive:libarchive-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-26280 *
CVE-2022-27191 (CVSS3: 7.5 HIGH): go https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-27191 *
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [yocto-security] OE-core CVE metrics for master on Sun 10 Apr 2022 02:00:01 AM HST
2022-04-10 12:02 OE-core CVE metrics for master on Sun 10 Apr 2022 02:00:01 AM HST steve
@ 2022-04-12 10:52 ` Richard Purdie
2022-04-12 14:23 ` Steve Sakoman
0 siblings, 1 reply; 3+ messages in thread
From: Richard Purdie @ 2022-04-12 10:52 UTC (permalink / raw)
To: Steve Sakoman, openembedded-core, yocto-security
I thought I'd update on a quick check through the status of the CVEs this is
reporting for master/kirkstone.
On Sun, 2022-04-10 at 02:02 -1000, Steve Sakoman wrote:
> Branch: master
>
> Full list: Found 12 unpatched CVEs
> CVE-2019-1010238 (CVSS3: 9.8 CRITICAL): pango:pango-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010238 *
Steve is questioning the version restrictions on this, we don't think it applies
to us.
> CVE-2019-12067 (CVSS3: 6.5 MEDIUM): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12067 *
No movement upstream, not a priority for qemu maintainers.
> CVE-2020-18974 (CVSS3: 3.3 LOW): nasm:nasm-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-18974 *
> CVE-2021-20255 (CVSS3: 5.5 MEDIUM): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20255 *
No movement upstream, not a priority for qemu maintainers.
> CVE-2021-44647 (CVSS3: 5.5 MEDIUM): lua:lua-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44647 *
I believe this is fixed in lua 5.4.4, have requested a version restriction on
the CVE.
> CVE-2022-0529 (CVSS3: 7.8 HIGH): unzip:unzip-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0529 *
> CVE-2022-0530 (CVSS3: 7.8 HIGH): unzip:unzip-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0530 *
RH bugs are restricted, no public patches to fix, not much we can do.
> CVE-2022-1050 (CVSS3: 8.8 HIGH): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1050 *
Have sent a patch for this.
> CVE-2022-1056 (CVSS3: 5.5 MEDIUM): tiff https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1056 *
Already fixed by patches we apply, have sent an update for our metadata.
> CVE-2022-24975 (CVSS3: 7.5 HIGH): git https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24975 *
This issue isn't particularly relevant to us, sent an ignore for it.
> CVE-2022-26280 (CVSS3: 9.1 CRITICAL): libarchive:libarchive-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-26280 *
Have merged an upgrade for this containing the fix.
> CVE-2022-27191 (CVSS3: 7.5 HIGH): go https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-27191 *
No patches for 1.17.X and upgrading to 1.18 not an option for kirkstone.
Cheers,
Richard
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [yocto-security] OE-core CVE metrics for master on Sun 10 Apr 2022 02:00:01 AM HST
2022-04-12 10:52 ` [yocto-security] " Richard Purdie
@ 2022-04-12 14:23 ` Steve Sakoman
0 siblings, 0 replies; 3+ messages in thread
From: Steve Sakoman @ 2022-04-12 14:23 UTC (permalink / raw)
To: Richard Purdie; +Cc: openembedded-core, yocto-security
On Tue, Apr 12, 2022 at 12:52 AM Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
>
> I thought I'd update on a quick check through the status of the CVEs this is
> reporting for master/kirkstone.
>
> On Sun, 2022-04-10 at 02:02 -1000, Steve Sakoman wrote:
> > Branch: master
> >
> > Full list: Found 12 unpatched CVEs
> > CVE-2019-1010238 (CVSS3: 9.8 CRITICAL): pango:pango-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010238 *
>
> Steve is questioning the version restrictions on this, we don't think it applies
> to us.
After a little back and forth it appears that they will be updating
the CVE affected versions this week. So this CVE should no longer be
an issue for master and dunfell.
Steve
> > CVE-2019-12067 (CVSS3: 6.5 MEDIUM): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12067 *
>
> No movement upstream, not a priority for qemu maintainers.
>
> > CVE-2020-18974 (CVSS3: 3.3 LOW): nasm:nasm-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-18974 *
> > CVE-2021-20255 (CVSS3: 5.5 MEDIUM): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20255 *
>
> No movement upstream, not a priority for qemu maintainers.
>
> > CVE-2021-44647 (CVSS3: 5.5 MEDIUM): lua:lua-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44647 *
>
> I believe this is fixed in lua 5.4.4, have requested a version restriction on
> the CVE.
>
> > CVE-2022-0529 (CVSS3: 7.8 HIGH): unzip:unzip-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0529 *
> > CVE-2022-0530 (CVSS3: 7.8 HIGH): unzip:unzip-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0530 *
>
> RH bugs are restricted, no public patches to fix, not much we can do.
>
> > CVE-2022-1050 (CVSS3: 8.8 HIGH): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1050 *
>
> Have sent a patch for this.
>
> > CVE-2022-1056 (CVSS3: 5.5 MEDIUM): tiff https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1056 *
>
> Already fixed by patches we apply, have sent an update for our metadata.
>
> > CVE-2022-24975 (CVSS3: 7.5 HIGH): git https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24975 *
>
> This issue isn't particularly relevant to us, sent an ignore for it.
>
> > CVE-2022-26280 (CVSS3: 9.1 CRITICAL): libarchive:libarchive-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-26280 *
>
> Have merged an upgrade for this containing the fix.
>
> > CVE-2022-27191 (CVSS3: 7.5 HIGH): go https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-27191 *
>
> No patches for 1.17.X and upgrading to 1.18 not an option for kirkstone.
>
> Cheers,
>
> Richard
>
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-04-12 16:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-10 12:02 OE-core CVE metrics for master on Sun 10 Apr 2022 02:00:01 AM HST steve
2022-04-12 10:52 ` [yocto-security] " Richard Purdie
2022-04-12 14:23 ` Steve Sakoman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.