Bug 13366

Summary:	make pkg-stats: unrelated CVEs linked to linux package
Product:	buildroot	Reporter:	Aleksandr Makarov <seems.deviant>
Component:	Other	Assignee:	unassigned
Status:	RESOLVED MOVED
Severity:	normal	CC:	buildroot, yann.morin.1998
Priority:	P5
Version:	2020.11
Target Milestone:	---
Hardware:	All
OS:	Linux
Host:		Target:
Build:
Attachments:	hypertext

Description Aleksandr Makarov 2020-12-08 12:57:56 UTC

Created attachment 8701 [details]
hypertext

Steps to reproduce:

$ cat <<EOF > .config
> BR2_LINUX_KERNEL=y
> BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
> EOF

$ make pkg-stats

In my case, there are 110 CVEs linked to linux package, while most of them or none at all are related.

The last three entries in CVEs column:

https://security-tracker.debian.org/tracker/CVE-2013-2032 - mediawiki
https://security-tracker.debian.org/tracker/CVE-2014-3250 - puppet
https://security-tracker.debian.org/tracker/CVE-2014-4909 - transmission

Comment 1 Thomas Petazzoni 2020-12-08 13:40:58 UTC

Thanks a lot for your bug report! Could you try with the patch series at https://patchwork.ozlabs.org/project/buildroot/list/?series=218648 applied, and see if it improves things ?

Comment 2 Aleksandr Makarov 2020-12-08 14:47:04 UTC

The mentioned patch series seems to help with the CVEs flood for linux package.

However, I find it odd to see in which order the CVEs column gets sorted now: 

- In ascending order: "yellow - orange - green", but i'd expect "orange - yellow - green"
- In descending order: "green - orange - yellow" instead of "green - yellow - orange"

(See attached image for illustration)

Comment 3 Aleksandr Makarov 2020-12-08 14:53:14 UTC

(The screenshot is 0.5M, attaching the link to external storage)
https://imgur.com/a/LNEyaHR

Comment 4 Thomas Petazzoni 2020-12-09 09:33:42 UTC

Thanks for your feedback. This sorting is just doing alphabetic sorting I believe, so it doesn't make much sense for CVEs. It's a bit like sorting the "Current version" or "Latest version" columns: it doesn't do anything useful. We should perhaps disable the sorting on some columns.

Comment 5 Yann E. MORIN 2024-06-15 14:55:49 UTC

Thank you for your report.

The issue tracker for the Buildroot project has been moved to
the Gitlab.com issue tracker:
    https://gitlab.com/buildroot.org/buildroot/-/issues

We are taking this opportunity to close old issues in this old
tracker. If you believe your issue is still relevant, please
open one in the new issue tracker.

Thank you!