Skip to content

CHANGELOG.md

Latest commit

 

History

History
211 lines (173 loc) · 8.83 KB

CHANGELOG.md

File metadata and controls

211 lines (173 loc) · 8.83 KB
Raw

v1.3.3

Added or Changed

  • Updated the version of the CVE databases used for testing.
  • Generate a "not affected" assessment if the vulnerability is disputed.
  • Handle CVE List version field with multiple version expressions: a version prefixed by a comparison operator (<, <=, >, >=, or =).
  • Added support for uv and updated the Developer Guide.
  • Added a contributing guide.

Fixed

  • Fixed CVE database git repository update when initially cloned from a tag and updated to a new tag.
  • Ignore version range if a boundary is a date (YYYY-MM-DD) and the component version is not a date (e.g., a semver).
  • Ignore in some cases the version range if a boundary has a distro packaging version (e.g., with a .el7 suffix), as documented in the design section.

v1.3.2

Added or Changed

  • Improved ZSTD compression support by adding support for the backports.zstd and zstandard Python packages, which are now optional dependencies.
  • Improved the simple annotation file format by adding support for new YAML keys as described in the database documentation.
  • Updated spdx_python_model to version 0.0.6.

Fixed

  • Filtered out Makefile and Kconfig files from the affected files list when checking if a component is affected by compiled files.
  • Filtered the list of compiled sources provided by a component by ignoring source files if the path contains <internal> or <built-in>, or ends with a slash.
  • Detected incomplete lists of compiled kernel sources. The list of compiled sources is only used if it contains either init/main.c, include/linux/module.h, or a file ending with .mod.c.

v1.3.1

Added or Changed

  • Changed license from GPL-2.0-only to GPL-2.0-or-later.
  • Added ty static type checker and fixed associated warnings.
  • Added support for passing multiple --set-db-cfg flags for the same database ID: In this case the configuration options are merged.

Fixed

  • Removed incorrect product database entry associating "sdl_image" with "simple_directmedia_layer", as they are distinct software components.
  • Fixed database deadlock issues when running multiple sbom-cve-check instances in parallel. A unique global lock is now used, as documented in the database locking section.
  • Fixed detection of the last database update when max_age_since_last_commit = false. Previously, the database might have been updated too frequently.
  • Prevented unnecessary recreation of the database index, which could occur when multiple sbom-cve-check instances run in parallel.
  • Avoided taking the global lock to create the database index if the index does not need to be saved to disk (cached).

v1.3.0

Added or Changed

  • Relative Paths in TOML: Paths in TOML configuration files can now be relative to the current working directory. By default, paths remain relative to the directory containing the TOML file.
  • Products Database: Added a products database to map vendor and product names to Component Identifiers, addressing cases where the CVEList database lacks CPEs.
  • CNA Database: Added a CNA database for improved CNA/ADP identification and handling.
  • ADP Entry Exclusion: Outdated ADP entries are now excluded if a CNA has updated its entry more recently.
  • Enhanced VEX Assessment: Improved VEX assessment generation with clearer messages indicating the version in which vulnerabilities were fixed. See the design documentation for details.
  • Version Parsing: Updated version parsing to support formats like 5-1.3.4.
  • Dependency Compatibility: Updated code to ensure compatibility with spdx_python_model==0.0.5 (generated by shacl2code 1.0.1).
  • Deprecated Options: Removed deprecated option flags.
  • New CLI Flag: Added the --set-db-cfg argument flag for database configuration from the command line.

Fixed

  • Linux Kernel CVE Ranges: Fixed handling of version ranges for Linux kernel CVEs provided by kernel.org CNA. Ranges are now ignored if the component version does not belong to the branch described by the version range.

v1.2.1

Added or Changed

  • N/A

Fixed

  • Fixed CVE matching in cvelistV5 using packageName by also considering the vendor field to avoid name collisions across vendors (#16)
  • Fixed dependency: sbom-cve-check is compatible with spdx_python_model in version 0.0.4, but it is likely not compatible with next version of spdx_python_model without code change.

v1.2.0

Added or Changed

  • Added --disable-auto-updates flag to disable automatic updates for all Git databases. This allows running sbom-cve-check without network access.
  • Added --export-process-native flag to process only target and/or native components.
  • Added --export-spdx-pkg-include-vex flag. For SPDX 3 exports, this flag links VEX information directly to binary (install) package outputs. If omitted, VEX information is linked only to the common recipe generating the binary packages, provided the SPDX 3 document includes such an object (specification package).
  • Added summary text report exporter type (#11).
  • Exported files can now be generated to stdout.
  • Updated the method for extracting packages from an SPDX 3.0 SBOM. The SBOM no longer requires a build_Build object, and support for specification packages has been added.
  • Yocto cve-check export files can now include the Yocto Project layer, extracted from the PURL if present.
  • Annotations are now only considered if the component identifier and version (from the CPE or package version) in the SBOM match the annotation information. Previously if the annotation version did not match, we would still use the annotation information to associate the CVE id to the tested component.
  • Added extraction of patches associated with a VEX "fixed" assessment relationship from SPDX 3.0 SBOMs.
  • Added support for compression for input and exported files. Files with the .zst extension are automatically handled.

Fixed

  • Improved version parsing and range checking (#12, #13).
  • Fixed generation of the TOM file produced by --gen-repro-config when auto_update_max_age= was set to 0.
  • Fixed handling of the cpeApplicability property in cvelistV5 entries if invalid (#15).

v1.1.0

Added or Changed

  • Added missing project URLs to the PyPI project page.
  • Added support for Python 3.10.
  • Added experimental support for Windows.
  • Replaced "CVE" terminology with the more generic term "vulnerability" where applicable. This includes renaming various classes and modules.
  • Deprecated the following option flags:
    • --export-filter-cve-without-cvss-score
    • --export-filter-cve-min-cvss-score
    • --export-filter-cve-without-versions
    • --export-list-rejected-cve
  • Improved performance when removing outdated assessments or CVSS metrics associated with vulnerabilities.
  • Enhanced logging messages for better clarity.
  • Added statement and justification fields to the exported Yocto VEX manifest.
  • Introduced the arch= database option and the arch-only YAML key for simple annotations.
  • Included package version alongside component version in exported files, as the two may differ during vulnerability analysis.
  • Added the ability to generate a TOML configuration file to reproduce the current tool execution. Use the --gen-repro-config flag to generate this file.
  • Improved code and user documentation.

Fixed

  • Fixed handling of build_Build objects without a name in SPDX3 files.
  • Restored support for parallel analysis execution, which was broken prior to the first release.
  • Resolved issues with annotations in SPDX3 files when duplicate vulnerability objects (multiple objects with the same CVE identifier) are present.
  • Fixed compatibility with python-dateutil 2.8.1 for Python 3.10 users.
  • Ensured plugins are loaded in the correct namespace, as documented: sbom_cve_check.plugins.

v1.0.1

First released version