<div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr"><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Not sure which of the changes is responsible, but this is new:<br>
WARNING: flex-native-2.6.0-r0 do_cve_check: Found unpatched CVE (CVE-2015-1773)<br>
<br>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2015-1773" rel="noreferrer" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2015-1773</a><br>
<br>
Note that the flex tool is completely unrelated to Apache Flex.<br>
<br></blockquote><div><br></div><div>I see, the 4/4 patch is responsible for that (Consider CVE that affects versions with less than operator). It takes into account the comparison operator in the json NVD file (new 'version_affected' field that was not in the XML data feed). So this CVE matches because 2.6.0 <= 4.14.0. But it should not match because it concerns another product (flex_project/flex vs Apache/flex).</div><div><br></div><div>There is indeed a problem I didn't manage. The CVE_PRODUCT variable we use in cve-check only takes the product name (here 'flex') into account, we should also consider the vendor name (here 'flex_project').</div><div><br></div><div>Without this patch (4/4), the behaviour should be the same as before.</div><div><br></div><div>Pierre<br></div> </div></div>