From d06bf960977a95df9e6da9523ffbbd93fa7f920c Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Mon, 12 Apr 2021 21:41:25 +0200 Subject: [PATCH] support/scripts/cve.py: use proper CPE ID version when available Signed-off-by: Thomas Petazzoni --- support/scripts/cve.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/support/scripts/cve.py b/support/scripts/cve.py index 965fc2a466..13c29fabe0 100755 --- a/support/scripts/cve.py +++ b/support/scripts/cve.py @@ -229,6 +229,11 @@ class CVE: # if we don't have a cpeid, build one based on name and version if not cpeid: cpeid = "cpe:2.3:*:*:%s:%s:*:*:*:*:*:*:*" % (name, version) + # if we have a cpeid, use its version instead of the package + # version, as they might be different due to + # _CPE_ID_VERSION + else: + pkg_version = distutils.version.LooseVersion(cpe_version(cpeid)) for cpe in self.each_cpe(): if not cpe_matches(cpe['id'], cpeid):