Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 665120 - dev-util/pkgcheck-0.5.4 false positives in TreeVulnerabilitiesReport
Summary: dev-util/pkgcheck-0.5.4 false positives in TreeVulnerabilitiesReport
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Tim Harder
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-09-02 18:56 UTC by Ulrich Müller
Modified: 2018-09-15 11:59 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ulrich Müller gentoo-dev 2018-09-02 18:56:40 UTC 
$ pkgcheck --checks=TreeVulnerabilitiesReport app-editors/emacs

app-editors/emacs
  VulnerablePackage: version 18.59-r12: vulnerable via glsa(201801-07) ( ( ver-rev < 23.4-r16 || ver-rev < 24.5-r4 || ver-rev < 25.2-r1 ) ), keywords: amd64, x86
  VulnerablePackage: version 23.4-r18: vulnerable via glsa(201801-07) ( ( ver-rev < 23.4-r16 || ver-rev < 24.5-r4 || ver-rev < 25.2-r1 ) ), keywords: alpha, amd64, amd64-fbsd, amd64-linux, arm, hppa, ia64, mips, ppc, ppc-macos, ppc64, sh, sparc, x86, x86-fbsd, x86-linux, x86-macos
  VulnerablePackage: version 24.3-r8: vulnerable via glsa(201801-07) ( ( ver-rev < 23.4-r16 || ver-rev < 24.5-r4 || ver-rev < 25.2-r1 ) ), keywords: 
  VulnerablePackage: version 24.5-r5: vulnerable via glsa(201801-07) ( ( ver-rev < 23.4-r16 || ver-rev < 24.5-r4 || ver-rev < 25.2-r1 ) ), keywords: alpha, amd64, amd64-fbsd, amd64-linux, arm, hppa, ia64, mips, ppc, ppc-macos, ppc64, sh, sparc, x64-macos, x86, x86-fbsd, x86-linux, x86-macos
  VulnerablePackage: version 24.5-r7: vulnerable via glsa(201801-07) ( ( ver-rev < 23.4-r16 || ver-rev < 24.5-r4 || ver-rev < 25.2-r1 ) ), keywords: alpha, amd64, amd64-fbsd, amd64-linux, arm, hppa, ia64, mips, ppc, ppc-macos, ppc64, sh, sparc, x64-macos, x86, x86-fbsd, x86-linux, x86-macos


All of the above are false positive. glsa-201801-07.xml actually contains this information about affected versions:

  <affected>
    <package name="app-editors/emacs" auto="yes" arch="*">
      <unaffected range="ge" slot="23">23.4-r16</unaffected>
      <unaffected range="ge" slot="24">24.5-r4</unaffected>
      <unaffected range="ge" slot="25">25.2-r1</unaffected>
      <vulnerable range="lt" slot="23">23.4-r16</vulnerable>
      <vulnerable range="lt" slot="24">24.5-r4</vulnerable>
      <vulnerable range="lt" slot="25">25.2-r1</vulnerable>
    </package>
  </affected>

None of which matches any of the versions in the pkgcheck output (nor any version in the tree).
Comment 1 Tim Harder gentoo-dev 2018-09-15 11:59:31 UTC 
Fixed in https://github.com/pkgcore/pkgcore/commit/f3bd1bce.