Failed to check CVE about cvehound

[evdenis]

Do you have coccinelle installed? If you will add --verbose flag it will output additionally the failed coccinelle run.

[evdenis]

The tool uses coccinelle internally (which spatch) to check sources for known patterns. From your screen it seems like there is no spatch binary in the system. To install it: sudo apt install coccinelle. I will add a check in the next release to warn users if cocci is not installed in the system.

[pysiak]

With --verbose it produces:

Checking: CVE-2018-8043
Failed to check CVE-2018-8043

spatch is there:

solt@Holodeck:~$ which spatch
/usr/bin/spatch

coccinelle was installed with:

  860  sudo add-apt-repository ppa:npalix/coccinelle
  861  apt-get install coccinelle

[evdenis]

Sorry, -vv instead of a single -v

[pysiak]

Aha! We're getting somewhere. It now says things like:

Failed to run: spatch --no-includes --include-headers -D detect --no-show-diff -j 12 --cocci-file /home/solt/.local/lib/python3.8/site-packages/cvehound/cve/CVE-2019-18808.cocci /home/solt/workspace/linux-source-5.4.0/drivers/crypto/ccp/ccp-ops.c

When I ran that spatch command it said:

solt@Holodeck:~$ spatch --no-includes --include-headers -D detect --no-show-diff -j 12 --cocci-file /home/solt/.local/lib/python3.8/site-packages/cvehound/cve/CVE-2019-18808.cocci /home/solt/workspace/linux-source-5.4.0/drivers/crypto/ccp/ccp-ops.c
init_defs_builtins: /usr/bin/../lib/coccinelle/standard.h
warning: line 14: should sha be a metavariable?
warning: line 14: should sha be a metavariable?
warning: line 16: should sha be a metavariable?
warning: line 18: should ret be a metavariable?
warning: line 19: should e_ctx be a metavariable?
Py.find_library: unable to find the Python library [libpython2.7m.so returned Library not found] [/usr/bin/../lib/libpython2.7m.so returned Library not found] [libpython2.7.so returned Library not found] [/usr/bin/../lib/libpython2.7.so returned Library not found]

So I sudo apt install libpython2.7 and it seems to work now:

Checking: CVE-2020-27825
Checking: CVE-2020-27830
Found: CVE-2020-27830
MSG: speakup: Reject setting the speakup line discipline outside of speakup
DATE: 2020-12-14
/home/solt/workspace/linux-source-5.4.0/drivers/staging/speakup/spk_ttyio.c:62:9-10: ERROR: CVE-2020-27830
/home/solt/workspace/linux-source-5.4.0/drivers/staging/speakup/spk_ttyio.c:148:12-13: ERROR: CVE-2020-27830

Thanks!!

[evdenis]

Aha, cocci still depends on python2.7 internally. I will add this to README. Thanks