diff options
Diffstat (limited to 'documentation/dev-manual/vulnerabilities.rst')
-rw-r--r-- | documentation/dev-manual/vulnerabilities.rst | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/documentation/dev-manual/vulnerabilities.rst b/documentation/dev-manual/vulnerabilities.rst index f8dac5edc6..0ee3ec52c5 100644 --- a/documentation/dev-manual/vulnerabilities.rst +++ b/documentation/dev-manual/vulnerabilities.rst | |||
@@ -27,8 +27,9 @@ patches to fix them, see ":ref:`dev-manual/changes:submitting a change to the yo | |||
27 | Vulnerability check at build time | 27 | Vulnerability check at build time |
28 | ================================= | 28 | ================================= |
29 | 29 | ||
30 | To enable a check for CVE security vulnerabilities using :ref:`cve-check <ref-classes-cve-check>` in the specific image | 30 | To enable a check for CVE security vulnerabilities using |
31 | or target you are building, add the following setting to your configuration:: | 31 | :ref:`ref-classes-cve-check` in the specific image or target you are building, |
32 | add the following setting to your configuration:: | ||
32 | 33 | ||
33 | INHERIT += "cve-check" | 34 | INHERIT += "cve-check" |
34 | 35 | ||
@@ -100,7 +101,7 @@ It is also possible to check the CVE status of individual packages as follows:: | |||
100 | Fixing CVE product name and version mappings | 101 | Fixing CVE product name and version mappings |
101 | ============================================ | 102 | ============================================ |
102 | 103 | ||
103 | By default, :ref:`cve-check <ref-classes-cve-check>` uses the recipe name :term:`BPN` as CVE | 104 | By default, :ref:`ref-classes-cve-check` uses the recipe name :term:`BPN` as CVE |
104 | product name when querying the CVE database. If this mapping contains false positives, e.g. | 105 | product name when querying the CVE database. If this mapping contains false positives, e.g. |
105 | some reported CVEs are not for the software component in question, or false negatives like | 106 | some reported CVEs are not for the software component in question, or false negatives like |
106 | some CVEs are not found to impact the recipe when they should, then the problems can be | 107 | some CVEs are not found to impact the recipe when they should, then the problems can be |
@@ -167,8 +168,7 @@ the :term:`CVE_CHECK_SKIP_RECIPE` variable. | |||
167 | Implementation details | 168 | Implementation details |
168 | ====================== | 169 | ====================== |
169 | 170 | ||
170 | Here's what the :ref:`cve-check <ref-classes-cve-check>` class does to | 171 | Here's what the :ref:`ref-classes-cve-check` class does to find unpatched CVE IDs. |
171 | find unpatched CVE IDs. | ||
172 | 172 | ||
173 | First the code goes through each patch file provided by a recipe. If a valid CVE ID | 173 | First the code goes through each patch file provided by a recipe. If a valid CVE ID |
174 | is found in the name of the file, the corresponding CVE is considered as patched. | 174 | is found in the name of the file, the corresponding CVE is considered as patched. |