From fa7fac09854b753cbce26298dd07622e65b1c4f0 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 7 Dec 2025 10:28:20 +0100 Subject: [PATCH] support/scripts/cve-check: don't fail with unknown CVE The NVD database has CVE entries that are not present but may be referenced in other security trackers. For instance the CVE-2024-12455 is documented in the Debian security tracker [1]. However, the NVD page is empty [2] and this entry is not present in the NVD database mirror. The following command would make the script fail: ``` echo '{ "vulnerabilities": [ { "id": "CVE-2024-12455" } ] }' | support/scripts/cve-check --enrich-only ``` No CVEs present in Buildroot ignored CVEs are affected. But when enriching an SBOM with legitimate CVE not present on NVD, the script will fail. This patch change the behavior to just log to stderr unknown CVEs instead of making the script fail. [1] https://security-tracker.debian.org/tracker/CVE-2024-12455 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-12455 Signed-off-by: Thomas Perale [Peter: Tweak warning message] Signed-off-by: Peter Korsgaard --- support/scripts/cve-check | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/support/scripts/cve-check b/support/scripts/cve-check index a72547ab38..ff14e4b238 100755 --- a/support/scripts/cve-check +++ b/support/scripts/cve-check @@ -271,10 +271,13 @@ def enrich_vulnerabilities(nvd_path: Path, sbom): if vuln_id is None or not vuln_id.upper().startswith("CVE-"): continue - cve = cvecheck.CVE.read_nvd_entry(nvd_path, vuln["id"]) + cve = cvecheck.CVE.read_nvd_entry(nvd_path, vuln_id) + + if cve is None: + print(f"Warning: '{vuln_id}' doesn't exist in NVD database.", file=sys.stderr) + continue vulnerability = nvd_cve_to_cdx_vulnerability(cve.nvd_cve) - vuln_append_or_update_affects_if_exists(vulnerabilities, vulnerability)