[Openembedded-architecture] [RFC] Mark of upstream CVE patches

[Richard Purdie]

On Tue, 2015-12-15 at 11:15 -0600, Mariano Lopez wrote:
> There is an initiative to track vulnerable software being built (see 
> bugs 8119 and 7515). The idea is to have a testing tool that would
> check 
> the recipe versions against CVEs. In order to accomplish such task
> there 
> is need to reliable mark the patches from upstream that solve CVEs.
> 
> There have been two options to mark the patches that solve CVEs:
> 
> 1. Have  "CVE" and the CVE number as the patch filename.
>    Pros:
>      Doesn't require a new tag.
>    Cons:
>      It is not flexible to add more information, for example two CVEs
> in 
> the same patch
> 
> 2. Add a new tag in the patch that have the CVE information.
>    Pros:
>      It is flexible and can add more information.
>    Cons:
>      Require a change in the patch metadata.
> 
> What I would recommend is to add a new tag in the patch, it must
> contain 
> the CVE ID. With this it would be possible to look for the CVE 
> information easily in the testing tool or in NIST, MITRE, or another
> web 
> page. For example, this would be part of the patch for CVE-2013-6435,
> currently in OE-Core:
> 
> -- snip --
> 
> Upstream-Status: Backport
> CVE: CVE-2013-6435
> 
> Reference:
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6435
> 
> -- snip --
> 
> The expected output of this discussion is a standard format for CVE 
> patches that most, if not all, of community members agree on.
> 
> Please let me know your comments.

FWIW I like the proposal as above adding a tag to the patches.

If nobody objects to that we need to update the patch submission
guidelines so that everyone is aware of this and then we can ask people
to follow the guidelines when they don't put the field in, much as we
do with Upstream-Status already.

Cheers,

Richard