search

clearlinux / cve-check-tool

Original Automated CVE Checking Tool
GNU General Public License v2.0
204 stars 78 forks source link

Added CVEs with NULL or dash at product version #51

Closed emaliv closed 7 years ago

emaliv commented 7 years ago

Added CVEs with NULL or dash at product version into the report. These CVEs should be taken into account because in some cases they are valid for the scanned product.

ikeydoherty commented 7 years ago

What's the performance impact of this change.. ?

emaliv commented 7 years ago

The performance impact is negligible. You can find below a comparison between the default sql query, without dash and null, and the sql query proposed.

$sqlite3 /NVDS/nvd.db sqlite> .timer on sqlite> .stats on

sqlite> SELECT ID FROM PRODUCTS WHERE PRODUCT = 'linux_kernel' AND (VERSION = '3.8.0' OR VERSION IS NULL OR VERSION = '-') COLLATE NOCASE;

sqlite> SELECT ID FROM PRODUCTS WHERE PRODUCT = 'linux_kernel' AND VERSION = '3.8.0' COLLATE NOCASE;

Memory used (with NULL, dash) Runtime (with NULL, dash) Memory used Runtime
2620280 bytes real 0.047 2619784 bytes real 0.055
2620280 bytes real 0.062 2619784 bytes real 0.033
2620280 bytes real 0.096 2619784 bytes real 0.073
2620280 bytes real 0.076 2619784 bytes real 0.058
2620280 bytes real 0.090 2619784 bytes real 0.041
2620280 bytes real 0.074 2619784 bytes real 0.045
2620280 bytes real 0.055 2619784 bytes real 0.034