| Re: [oniro-dev] CVE status for 2.0 |
|
Ok reviewed the sheet. My recommendation (which is also a question of feasibility / time) would be to try a kirkstone update see where it takes us in terms of breaking builds / tests if it takes us far with minimum damage see how many are left
to fix and focus on CVSS score above 8. If a kirkstone update breaks all things – then focus on select resolution of CVEs with CVSS score greater than 8. My 2 cents. Cheers D From: oniro-dev <oniro-dev-bounces@xxxxxxxxxxx>
On Behalf Of Davide Ricci Stupid me, An excel sheet was attached … I am reviewing it now. D From: oniro-dev <oniro-dev-bounces@xxxxxxxxxxx>
On Behalf Of Davide Ricci Since we are aware of the issues, we ought to try to fix the most sever ones – do we have the breakdown and know how many CVEs per CVSS severity class do we have? Thanks D From: Marta Rybczynska <marta.rybczynska@xxxxxxxxxx>
Dear all, I have first results of CVE checks for the upcoming 2.0. For simplification, you have the details from the qemu x86-64 image (rootfs only, excluding SDK). With the database of yesterday, we have 378 issues. Out of that: 4 at or above CVSSv3 9.0 (curl, libpam, 2xlinux) 122 at or above CVSSv3 7.5 (including the openssl issue that made the news, expat, python, dropbear) Apart from the Linux kernel, most should go away with a kirkstone update. The question is if we release like that or we spend time to fix issues above certain CVSS (like 9.0 or 8.0)? Kind regards, Marta |