From: Ross Burton <ross.burton@intel.com>
Date: Wed, 17 Jul 2019 10:45:38 +0000 (+0100)
Subject: cve-update-db-native: use SQL placeholders instead of format strings
X-Git-Tag: lucaceresoli/bug-15201-perf-libtraceevent-missing~13863
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=91770338f76;p=thirdparty%2Fopenembedded%2Fopenembedded-core-contrib.git

cve-update-db-native: use SQL placeholders instead of format strings

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---

diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
index e16c41a72fd..72d1f48835b 100644
--- a/meta/recipes-core/meta/cve-update-db-native.bb
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -62,7 +62,7 @@ python do_populate_cve_db() {
             break
 
         # Compare with current db last modified date
-        c.execute("select DATE from META where YEAR = '%d'" % year)
+        c.execute("select DATE from META where YEAR = ?", (year,))
         meta = c.fetchone()
         if not meta or meta[0] != last_modified:
             # Update db with current year json file