Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Switch from the "fixed + not affected" OVAL file to the "fixed + not … #635

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Switch from the "fixed + not affected" OVAL file to the "fixed + not … #635

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4e0fe05
Switch from the "fixed + not affected" OVAL file to the "fixed + not …
msmeissn Jul 19, 2024
aa19d37
Merge branch 'main' of github.com:anchore/vunnel into msmeissn/main
willmurphyscode Aug 6, 2024
6efb539
fix: special case "greater than version zero" test
willmurphyscode Aug 7, 2024
2a5c055
chore: update test snapshots for new SLES feeds
willmurphyscode Aug 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions src/vunnel/providers/sles/parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@

PARSER_CONFIG = OVALParserConfig(
platform_regex=re.compile(r"SUSE Linux Enterprise Server \d+.* is installed"),
artifact_regex=re.compile(r".* is installed"),
artifact_regex=re.compile(r"(.* is installed)|(.* is affected)"),
source_url_xpath_query='{0}metadata/{0}reference[@source="SUSE CVE"]',
severity_map={
"low": "Low",
Expand All @@ -49,8 +49,8 @@


class Parser:
__oval_url__ = "https://ftp.suse.com/pub/projects/security/oval/suse.linux.enterprise.server.{}.xml.bz2"
__oval_file_name__ = "suse-linux-enterprise-server-{}.xml.bz2"
__oval_url__ = "https://ftp.suse.com/pub/projects/security/oval/suse.linux.enterprise.server.{}-affected.xml.bz2"
__oval_file_name__ = "suse-linux-enterprise-server-{}-affected.xml.bz2"
__oval_dir_path__ = "oval"
__source_dir_path__ = "source"

Expand Down Expand Up @@ -142,6 +142,10 @@ def _get_name_and_version_from_test(

name = name_obj.name
version = version_obj.value
if version_obj.operation == "greater than" and version_obj.value == "0:0-0":
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The assumption here is this: That packages that are vulnerable in a given version of SLES, if they are affected and no patch is available, are considered vulnerable if present.

In other words, saying "PackageA is vulnerable" is always either: "All versions of PackagA are vulnerable" or saying, "PackageA is vulnerable until version 0:1.23", and we never say something like, "PackageA is vulnerable for versions greater than 0:1.23 and less than 0:2.0" or something.

Is this assumption valid @BenoitGui or @msmeissn ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems valid for me, but @msmeissn should confirm this assumption since he is the author of the code 👍

# This indicates that any version of the software is vulnerable, so make fixed-in version "None"
# to signify vulnerability without a fix available.
return name, "None"

return name, version

Expand Down
41 changes: 41 additions & 0 deletions tests/unit/providers/sles/test-fixtures/snapshots/sles:15.1/cve-2010-2322.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{
"identifier": "sles:15.1/cve-2010-2322",
"item": {
"Vulnerability": {
"CVSS": [
{
"base_metrics": {
"base_score": 3.7,
"base_severity": "Low",
"exploitability_score": 2.2,
"impact_score": 1.4
},
"status": "N/A",
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
],
"Description": "Absolute path traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via\n a full pathname for a file within a .jar archive, a related issue to CVE-2010-0831. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.",
"FixedIn": [
{
"Module": "",
"Name": "fastjar",
"NamespaceName": "sles:15.1",
"VendorAdvisory": {
"AdvisorySummary": [],
"NoAdvisory": false
},
"Version": "None",
"VersionFormat": "rpm",
"VulnerableRange": null
}
],
"Link": "https://www.suse.com/security/cve/CVE-2010-2322",
"Metadata": {},
"Name": "CVE-2010-2322",
"NamespaceName": "sles:15.1",
"Severity": "Low"
}
},
"schema": "https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json"
}
62 changes: 60 additions & 2 deletions tests/unit/providers/sles/test-fixtures/suse_truncated.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,44 @@ UG64TKDHFDLMRIRJQG/#QQHP7MDAGKGRMVUG64TKDHFDLMRIRJQG"></reference>
</criteria>
</criteria>
</definition>
<definition id="oval:org.opensuse.security:def:20102322" version="1" class="vulnerability">
<metadata>
<title>CVE-2010-2322</title>
<affected family="unix">
<platform>SUSE Linux Enterprise Server 15 SP1-LTSS</platform>
<platform>SUSE Linux Enterprise Server for SAP Applications 15 SP1</platform>
</affected>
<reference source="CVE" ref_id="Mitre CVE-2010-2322" ref_url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2322"></reference>
<reference source="SUSE CVE" ref_id="SUSE CVE-2010-2322" ref_url="https://www.suse.com/security/cve/CVE-2010-2322"></reference>
<reference source="SUSE-SU" ref_id="SUSE-SU-2021:2635-1" ref_url="https://lists.suse.com/pipermail/sle-security-updates/2021-August/009264.html"></reference>
<reference source="SUSE-SU" ref_id="openSUSE-SU-2021:1107-1" ref_url="https://lists.opensuse.org/archives/list/[email protected]/thread/AJWN7K3ZWIZYG5QW25KKFIGISFYT
G2R3/"></reference>
<reference source="SUSE-SU" ref_id="openSUSE-SU-2021:2565-1" ref_url="https://lists.opensuse.org/archives/list/[email protected]/thread/OHWHBBR2CBRHE7HR6PAPJLGHP3QC
HYHS/"></reference>
<description>&#xA; Absolute path traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via
a full pathname for a file within a .jar archive, a related issue to CVE-2010-0831. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.&#xA; </description>
<advisory>
<severity>Low</severity>
<cve cvss3="3.7/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" cwe="" impact="low" href="https://www.suse.com/security/cve/CVE-2010-2322/" public="">CVE-2010-2322 at SUSE</cve>
<cve cwe="" impact="" href="https://nvd.nist.gov/vuln/detail/CVE-2010-2322" public="">CVE-2010-2322 at NVD</cve>
<bugzilla id="" href="https://bugzilla.suse.com/1188517">SUSE bug 1188517</bugzilla>
<affected_cpe_list>
<cpe>cpe:/o:suse:sles-ltss:15:sp1</cpe>
<cpe>cpe:/o:suse:sles_sap:15:sp1</cpe>
</affected_cpe_list>
<issued date="2022-05-20"></issued>
<updated date="2024-04-26"></updated>
<affected></affected>
</advisory>
</metadata>
<criteria operator="AND">
<criteria operator="OR">
<criterion test_ref="oval:org.opensuse.security:tst:2009341508" comment="SUSE Linux Enterprise Server 15 SP1-LTSS is installed"></criterion>
<criterion test_ref="oval:org.opensuse.security:tst:2009341764" comment="SUSE Linux Enterprise Server for SAP Applications 15 SP1 is installed"></criterion>
</criteria>
<criterion test_ref="oval:org.opensuse.security:tst:2009694232" comment="fastjar is affected"></criterion>
</criteria>
</definition>
</definitions>
<tests>
<rpminfo_test id="oval:org.opensuse.security:tst:2009302033" version="1" comment="sles-ltss-release is ==15" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
Expand Down Expand Up @@ -380,6 +418,14 @@ UG64TKDHFDLMRIRJQG/#QQHP7MDAGKGRMVUG64TKDHFDLMRIRJQG"></reference>
<object object_ref="oval:org.opensuse.security:obj:2009031042"></object>
<state state_ref="oval:org.opensuse.security:ste:2009111500"></state>
</rpminfo_test>
<rpminfo_test id="oval:org.opensuse.security:tst:2009341764" comment="SLES_SAP-release is ==15.1" check="at least one" version="1">
<object object_ref="oval:org.opensuse.security:obj:2009047546"></object>
<state state_ref="oval:org.opensuse.security:ste:2009068342"></state>
</rpminfo_test>
<rpminfo_test id="oval:org.opensuse.security:tst:2009694232" comment="fastjar is &gt;0" check="at least one" version="1">
<object object_ref="oval:org.opensuse.security:obj:2009037419"></object>
<state state_ref="oval:org.opensuse.security:ste:2009079459"></state>
</rpminfo_test>
</tests>
<objects>
<rpminfo_object id="oval:org.opensuse.security:obj:2009049560" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
Expand Down Expand Up @@ -433,6 +479,15 @@ UG64TKDHFDLMRIRJQG/#QQHP7MDAGKGRMVUG64TKDHFDLMRIRJQG"></reference>
<rpminfo_object id="oval:org.opensuse.security:obj:2009031042" version="1">
<name>krb5-server</name>
</rpminfo_object>
<rpminfo_object id="oval:org.opensuse.security:obj:2009047546" version="1">
<name>SLES_SAP-release</name>
</rpminfo_object>
<rpminfo_object id="oval:org.opensuse.security:obj:2009049560" version="1">
<name>sles-ltss-release</name>
</rpminfo_object>
<rpminfo_object id="oval:org.opensuse.security:obj:2009037419" version="1">
<name>fastjar</name>
</rpminfo_object>
</objects>
<state>
<rpminfo_state id="oval:org.opensuse.security:ste:2009061809" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
Expand All @@ -449,8 +504,11 @@ UG64TKDHFDLMRIRJQG/#QQHP7MDAGKGRMVUG64TKDHFDLMRIRJQG"></reference>
<arch datatype="string" operation="pattern match">(aarch64|ppc64le|s390x|x86_64)</arch>
<evr datatype="evr_string" operation="less than">0:4.12.14-197.89.2</evr>
</rpminfo_state>
<rpminfo_state id="oval:org.opensuse.security:ste:2009111500" version="1">
<evr operation="6">0:1.15.2-4.25</evr>
<rpminfo_state id="oval:org.opensuse.security:ste:2009111500" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<evr datatype="evr_string" operation="less than">0:1.15.2-4.25</evr>
</rpminfo_state>
<rpminfo_state id="oval:org.opensuse.security:ste:2009079459" version="1">
<evr operation="greater than">0:0-0</evr>
</rpminfo_state>
</state>
</oval_definitions>
31 changes: 30 additions & 1 deletion tests/unit/providers/sles/test_sles.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,6 +277,35 @@ def parsed_vulnerabilities(self):
],
Metadata={},
),
Vulnerability(
Name="CVE-2010-2322",
NamespaceName="sles:15.1",
Description="Absolute path traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via\n a full pathname for a file within a .jar archive, a related issue to CVE-2010-0831. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.",
Severity="Low",
Link="https://www.suse.com/security/cve/CVE-2010-2322",
CVSS=[
CVSS(
version="3.1",
vector_string="CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
base_metrics=CVSSBaseMetrics(
base_score=3.7, exploitability_score=2.2, impact_score=1.4, base_severity="Low"
),
status="N/A",
)
],
FixedIn=[
FixedIn(
Name="fastjar",
NamespaceName="sles:15.1",
VersionFormat="rpm",
Version="None",
Module="",
VendorAdvisory=VendorAdvisory(NoAdvisory=False, AdvisorySummary=[]),
VulnerableRange=None,
)
],
Metadata={},
),
]

@pytest.mark.parametrize(
Expand Down Expand Up @@ -390,7 +419,7 @@ def mock_download(self, *args, **kwargs):

p.update(None)

assert 3 == workspace.num_result_entries()
assert 4 == workspace.num_result_entries()
assert workspace.result_schemas_valid(require_entries=True)


Expand Down
Loading