diff --git a/docs/getting-started/overview.md b/docs/getting-started/overview.md index dc15486d49..42c5cc379b 100644 --- a/docs/getting-started/overview.md +++ b/docs/getting-started/overview.md @@ -22,7 +22,7 @@ See [Integrations][integrations] for details. ## Features - Comprehensive vulnerability detection - - [OS packages][os] (Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless) + - [OS packages][os] (Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, AlmaLinux, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless) - [**Language-specific packages**][lang] (Bundler, Composer, Pipenv, Poetry, npm, yarn, Cargo, NuGet, Maven, and Go) - Detect IaC misconfigurations - A wide variety of [built-in policies][builtin] are provided **out of the box**: diff --git a/docs/vulnerability/detection/data-source.md b/docs/vulnerability/detection/data-source.md index c6b135be41..45b43ff179 100644 --- a/docs/vulnerability/detection/data-source.md +++ b/docs/vulnerability/detection/data-source.md @@ -11,6 +11,7 @@ | Ubuntu | [Ubuntu CVE Tracker][ubuntu] | | RHEL/CentOS | [OVAL][rhel-oval] | | | [Security Data][rhel-api] | +| AlmaLinux | [AlmaLinux Product Errata][alma] | | Oracle Linux | [OVAL][oracle] | | OpenSUSE/SLES | [CVRF][suse] | | Photon OS | [Photon Security Advisory][photon] | @@ -51,6 +52,7 @@ [ubuntu]: https://ubuntu.com/security/cve [rhel-oval]: https://www.redhat.com/security/data/oval/v2/ [rhel-api]: https://www.redhat.com/security/data/metrics/ +[alma]: https://errata.almalinux.org/ [oracle]: https://linux.oracle.com/security/oval/ [suse]: http://ftp.suse.com/pub/projects/security/cvrf/ [photon]: https://packages.vmware.com/photon/photon_cve_metadata/ diff --git a/docs/vulnerability/detection/os.md b/docs/vulnerability/detection/os.md index 0cd8e13136..683f34a6ef 100644 --- a/docs/vulnerability/detection/os.md +++ b/docs/vulnerability/detection/os.md @@ -8,6 +8,7 @@ The unfixed/unfixable vulnerabilities mean that the patch has not yet been provi | Red Hat Universal Base Image[^1] | 7, 8 | Installed by yum/rpm | YES | | Red Hat Enterprise Linux | 6, 7, 8 | Installed by yum/rpm | YES | | CentOS | 6, 7 | Installed by yum/rpm | YES | +| AlmaLinux | 8 | Installed by yum/rpm | NO | | Oracle Linux | 5, 6, 7, 8 | Installed by yum/rpm | NO | | Amazon Linux | 1, 2 | Installed by yum/rpm | NO | | openSUSE Leap | 42, 15 | Installed by zypper/rpm | NO | diff --git a/go.mod b/go.mod index a448730832..1184305ee4 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798 github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46 github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 - github.com/aquasecurity/trivy-db v0.0.0-20220104200459-525690bf08ef + github.com/aquasecurity/trivy-db v0.0.0-20220105133155-dcbb8819ac5e github.com/caarlos0/env/v6 v6.0.0 github.com/cenkalti/backoff v2.2.1+incompatible github.com/cheggaaa/pb/v3 v3.0.3 diff --git a/go.sum b/go.sum index 91310febf5..7a579df863 100644 --- a/go.sum +++ b/go.sum @@ -239,8 +239,8 @@ github.com/aquasecurity/testdocker v0.0.0-20210911155206-e1e85f5a1516 h1:moQmzbp github.com/aquasecurity/testdocker v0.0.0-20210911155206-e1e85f5a1516/go.mod h1:gTd97VdQ0rg8Mkiic3rPgNOQdprZ7feTAhiD5mGQjgM= github.com/aquasecurity/tfsec v0.63.1 h1:KH63HTcUoab7d3PKtqFO6T8K5AY7bzLw7Kiu+EY9U64= github.com/aquasecurity/tfsec v0.63.1/go.mod h1:g5ZWmsfqW1FsCaPb9ux8Pzjcyss/WUB2XuRd5slqvnc= -github.com/aquasecurity/trivy-db v0.0.0-20220104200459-525690bf08ef h1:E8ihL2Rh5aceXzexoCgKQVFzWQUQ56TwtITEOu4IuNE= -github.com/aquasecurity/trivy-db v0.0.0-20220104200459-525690bf08ef/go.mod h1:nT/y6Nbo7KDfRhezh3uE8nLNV5R13mGw34j6E8htL+o= +github.com/aquasecurity/trivy-db v0.0.0-20220105133155-dcbb8819ac5e h1:XcBTuz3pjg8509hIUxl0OEgtxyYSsc/siYN0TEY0hRc= +github.com/aquasecurity/trivy-db v0.0.0-20220105133155-dcbb8819ac5e/go.mod h1:rnojVJTK+RySsfLW7xMqmQRSjQpm5fEjS+/N4kf3fcc= github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o= github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY= @@ -780,7 +780,6 @@ github.com/google/go-containerregistry v0.7.1-0.20211214010025-a65b7844a475 h1:d github.com/google/go-containerregistry v0.7.1-0.20211214010025-a65b7844a475/go.mod h1:IwJblnDNiCs8sxubbfPNniYsUqr8m+nt7YbPzecsGuE= github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ= github.com/google/go-github/v28 v28.1.1/go.mod h1:bsqJWQX05omyWVmc00nEUql9mhQyv38lDZ8kPZcQVoM= -github.com/google/go-github/v38 v38.1.0/go.mod h1:cStvrz/7nFr0FoENgG6GLbp53WaelXucT+BBz/3VKx4= github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck= github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU= github.com/google/go-replayers/grpcreplay v0.1.0/go.mod h1:8Ig2Idjpr6gifRd6pNVggX6TC1Zw6Jx74AKp7QNH2QE= diff --git a/integration/client_server_test.go b/integration/client_server_test.go index afee4573ff..3c65dc50a6 100644 --- a/integration/client_server_test.go +++ b/integration/client_server_test.go @@ -141,6 +141,13 @@ func TestClientServer(t *testing.T) { // }, // golden: "testdata/ubi-7.json.golden", //}, + { + name: "almalinux 8", + args: csArgs{ + Input: "testdata/fixtures/images/almalinux-8.tar.gz", + }, + golden: "testdata/almalinux-8.json.golden", + }, { name: "distroless base", args: csArgs{ diff --git a/integration/docker_engine_test.go b/integration/docker_engine_test.go index 172640aeb3..cf1a11a141 100644 --- a/integration/docker_engine_test.go +++ b/integration/docker_engine_test.go @@ -103,6 +103,12 @@ func TestDockerEngine(t *testing.T) { // wantOutputFile: "testdata/ubi-7.json.golden", // testfile: "testdata/fixtures/images/ubi-7.tar.gz", //}, + { + name: "almalinux 8", + imageTag: "almalinux:8", + wantOutputFile: "testdata/almalinux-8.json.golden", + testfile: "testdata/fixtures/images/almalinux-8.tar.gz", + }, { name: "debian buster/10", imageTag: "debian:buster", diff --git a/integration/standalone_tar_test.go b/integration/standalone_tar_test.go index 3094747fdd..ba79943a4c 100644 --- a/integration/standalone_tar_test.go +++ b/integration/standalone_tar_test.go @@ -173,6 +173,14 @@ func TestTar(t *testing.T) { // }, // golden: "testdata/ubi-7.json.golden", //}, + { + name: "almalinux 8", + testArgs: args{ + Format: "json", + Input: "testdata/fixtures/images/almalinux-8.tar.gz", + }, + golden: "testdata/almalinux-8.json.golden", + }, { name: "distroless base", testArgs: args{ diff --git a/integration/testdata/almalinux-8.json.golden b/integration/testdata/almalinux-8.json.golden new file mode 100644 index 0000000000..5ae4f991cf --- /dev/null +++ b/integration/testdata/almalinux-8.json.golden @@ -0,0 +1,112 @@ +{ + "SchemaVersion": 2, + "ArtifactName": "testdata/fixtures/images/almalinux-8.tar.gz", + "ArtifactType": "container_image", + "Metadata": { + "OS": { + "Family": "alma", + "Name": "8.5" + }, + "ImageID": "sha256:4ca63ce1d8a90da2ed4f2d5e93e8e9db2f32d0fabf0718a2edebbe0e70826622", + "DiffIDs": [ + "sha256:124d41c237c5e823577dda97e87cebaecce62d585c725d07e709ce410681de4d" + ], + "ImageConfig": { + "architecture": "amd64", + "container": "a467f67a48d469e1975b7414f33f2cf87121d4cc59d2ee029ea58e6b81774769", + "created": "2021-11-13T12:10:27.09871973Z", + "docker_version": "20.10.7", + "history": [ + { + "created": "2021-11-13T12:10:26.29818864Z", + "created_by": "/bin/sh -c #(nop) ADD file:2e002305ccb9d8a4dcef52509c4c50b9a15e76c9c49ca6abda3e0d7091c63fa7 in / " + }, + { + "created": "2021-11-13T12:10:27.09871973Z", + "created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]", + "empty_layer": true + } + ], + "os": "linux", + "rootfs": { + "type": "layers", + "diff_ids": [ + "sha256:124d41c237c5e823577dda97e87cebaecce62d585c725d07e709ce410681de4d" + ] + }, + "config": { + "Cmd": [ + "/bin/bash" + ], + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + ], + "Image": "sha256:d38d2eac03bc19e080df596d6148863a0f8293f3a277a7524f378da79a1feb0f" + } + } + }, + "Results": [ + { + "Target": "testdata/fixtures/images/almalinux-8.tar.gz (alma 8.5)", + "Class": "os-pkgs", + "Type": "alma", + "Vulnerabilities": [ + { + "VulnerabilityID": "CVE-2021-3712", + "PkgName": "openssl-libs", + "InstalledVersion": "1:1.1.1k-4.el8", + "FixedVersion": "1:1.1.1k-5.el8_5", + "Layer": { + "DiffID": "sha256:124d41c237c5e823577dda97e87cebaecce62d585c725d07e709ce410681de4d" + }, + "SeveritySource": "alma", + "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-3712", + "Title": "openssl: Read buffer overruns processing ASN.1 strings", + "Description": "ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).", + "Severity": "MEDIUM", + "CweIDs": [ + "CWE-125" + ], + "CVSS": { + "nvd": { + "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P", + "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", + "V2Score": 5.8, + "V3Score": 7.4 + }, + "redhat": { + "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", + "V3Score": 7.4 + } + }, + "References": [ + "http://www.openwall.com/lists/oss-security/2021/08/26/2", + "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=94d23fcff9b2a7a8368dfe52214d5c2569882c11", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ccb0a11145ee72b042d10593a64eaf9e8a55ec12", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366", + "https://linux.oracle.com/cve/CVE-2021-3712.html", + "https://linux.oracle.com/errata/ELSA-2021-9632.html", + "https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e@%3Cdev.tomcat.apache.org%3E", + "https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1@%3Cdev.tomcat.apache.org%3E", + "https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html", + "https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html", + "https://security.netapp.com/advisory/ntap-20210827-0010/", + "https://ubuntu.com/security/notices/USN-5051-1", + "https://ubuntu.com/security/notices/USN-5051-2", + "https://ubuntu.com/security/notices/USN-5051-3", + "https://ubuntu.com/security/notices/USN-5051-4 (regression only in trusty/esm)", + "https://ubuntu.com/security/notices/USN-5088-1", + "https://www.debian.org/security/2021/dsa-4963", + "https://www.openssl.org/news/secadv/20210824.txt", + "https://www.oracle.com/security-alerts/cpuoct2021.html", + "https://www.tenable.com/security/tns-2021-16", + "https://www.tenable.com/security/tns-2022-02" + ], + "PublishedDate": "2021-08-24T15:15:00Z", + "LastModifiedDate": "2022-01-06T09:15:00Z" + } + ] + } + ] +} \ No newline at end of file diff --git a/integration/testdata/alpine-310-registry.json.golden b/integration/testdata/alpine-310-registry.json.golden index 12c81d14d7..db0e818f3b 100644 --- a/integration/testdata/alpine-310-registry.json.golden +++ b/integration/testdata/alpine-310-registry.json.golden @@ -89,7 +89,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -145,7 +144,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -175,7 +173,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1549", @@ -207,7 +205,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -263,7 +260,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -293,7 +289,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" } ] } diff --git a/integration/testdata/alpine-310.gitlab.golden b/integration/testdata/alpine-310.gitlab.golden index 0e25ab417a..5383831e48 100644 --- a/integration/testdata/alpine-310.gitlab.golden +++ b/integration/testdata/alpine-310.gitlab.golden @@ -33,8 +33,6 @@ } ], "links": [{ - "url": "https://access.redhat.com/security/cve/CVE-2019-1549" - },{ "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549" },{ "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be" @@ -110,8 +108,6 @@ "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html" },{ "url": "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html" - },{ - "url": "https://access.redhat.com/security/cve/CVE-2019-1551" },{ "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551" },{ @@ -201,8 +197,6 @@ } ], "links": [{ - "url": "https://access.redhat.com/security/cve/CVE-2019-1549" - },{ "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549" },{ "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be" @@ -278,8 +272,6 @@ "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html" },{ "url": "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html" - },{ - "url": "https://access.redhat.com/security/cve/CVE-2019-1551" },{ "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551" },{ diff --git a/integration/testdata/alpine-310.html.golden b/integration/testdata/alpine-310.html.golden index 9fc315955c..a89206ac3f 100644 --- a/integration/testdata/alpine-310.html.golden +++ b/integration/testdata/alpine-310.html.golden @@ -99,7 +99,6 @@ 1.1.1c-r0 1.1.1d-r0 - https://access.redhat.com/security/cve/CVE-2019-1549 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be https://linux.oracle.com/cve/CVE-2019-1549.html @@ -130,7 +129,6 @@ http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html - https://access.redhat.com/security/cve/CVE-2019-1551 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98 @@ -167,7 +165,6 @@ 1.1.1c-r0 1.1.1d-r0 - https://access.redhat.com/security/cve/CVE-2019-1549 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be https://linux.oracle.com/cve/CVE-2019-1549.html @@ -198,7 +195,6 @@ http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html - https://access.redhat.com/security/cve/CVE-2019-1551 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98 diff --git a/integration/testdata/alpine-310.json.golden b/integration/testdata/alpine-310.json.golden index 32a15278c7..663cdd36bd 100644 --- a/integration/testdata/alpine-310.json.golden +++ b/integration/testdata/alpine-310.json.golden @@ -82,7 +82,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -137,7 +136,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -167,7 +165,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1549", @@ -198,7 +196,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -253,7 +250,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -283,7 +279,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" } ] } diff --git a/integration/testdata/alpine-39-ignore-cveids.json.golden b/integration/testdata/alpine-39-ignore-cveids.json.golden index 857f7da01a..daa364b144 100644 --- a/integration/testdata/alpine-39-ignore-cveids.json.golden +++ b/integration/testdata/alpine-39-ignore-cveids.json.golden @@ -84,7 +84,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -114,7 +113,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1551", @@ -147,7 +146,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -177,7 +175,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" } ] } diff --git a/integration/testdata/alpine-39.json.golden b/integration/testdata/alpine-39.json.golden index 92de08d8b6..e7e8033ace 100644 --- a/integration/testdata/alpine-39.json.golden +++ b/integration/testdata/alpine-39.json.golden @@ -82,7 +82,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -137,7 +136,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -167,7 +165,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1549", @@ -198,7 +196,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -253,7 +250,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -283,7 +279,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-14697", diff --git a/integration/testdata/amazon-1.json.golden b/integration/testdata/amazon-1.json.golden index 2d99632c3c..549edb6b2c 100644 --- a/integration/testdata/amazon-1.json.golden +++ b/integration/testdata/amazon-1.json.golden @@ -83,7 +83,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html", - "https://access.redhat.com/security/cve/CVE-2019-5481", "https://curl.haxx.se/docs/CVE-2019-5481.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481", "https://linux.oracle.com/cve/CVE-2019-5481.html", diff --git a/integration/testdata/amazon-2.json.golden b/integration/testdata/amazon-2.json.golden index 9cb17f6aa5..2f9b8501ca 100644 --- a/integration/testdata/amazon-2.json.golden +++ b/integration/testdata/amazon-2.json.golden @@ -83,7 +83,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html", - "https://access.redhat.com/security/cve/CVE-2019-5481", "https://curl.haxx.se/docs/CVE-2019-5481.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481", "https://linux.oracle.com/cve/CVE-2019-5481.html", @@ -135,7 +134,6 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html", "http://www.openwall.com/lists/oss-security/2019/09/11/6", - "https://access.redhat.com/security/cve/CVE-2019-5436", "https://curl.haxx.se/docs/CVE-2019-5436.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436", "https://linux.oracle.com/cve/CVE-2019-5436.html", diff --git a/integration/testdata/debian-buster-ignore-unfixed.json.golden b/integration/testdata/debian-buster-ignore-unfixed.json.golden index fdf2a92ad9..6fd4bd671a 100644 --- a/integration/testdata/debian-buster-ignore-unfixed.json.golden +++ b/integration/testdata/debian-buster-ignore-unfixed.json.golden @@ -86,7 +86,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html", - "https://access.redhat.com/security/cve/CVE-2019-18224", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224", "https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c", diff --git a/integration/testdata/debian-buster.json.golden b/integration/testdata/debian-buster.json.golden index 0521481e79..8803385439 100644 --- a/integration/testdata/debian-buster.json.golden +++ b/integration/testdata/debian-buster.json.golden @@ -81,7 +81,6 @@ }, "References": [ "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html", - "https://access.redhat.com/security/cve/CVE-2019-18276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276", "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff", "https://linux.oracle.com/cve/CVE-2019-18276.html", @@ -128,7 +127,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html", - "https://access.redhat.com/security/cve/CVE-2019-18224", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224", "https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c", diff --git a/integration/testdata/debian-stretch.json.golden b/integration/testdata/debian-stretch.json.golden index 1a06964d7c..449e7d360c 100644 --- a/integration/testdata/debian-stretch.json.golden +++ b/integration/testdata/debian-stretch.json.golden @@ -81,7 +81,6 @@ }, "References": [ "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html", - "https://access.redhat.com/security/cve/CVE-2019-18276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276", "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff", "https://linux.oracle.com/cve/CVE-2019-18276.html", @@ -126,7 +125,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -178,7 +176,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -230,7 +227,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -282,7 +278,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", diff --git a/integration/testdata/distroless-base.json.golden b/integration/testdata/distroless-base.json.golden index 0e11615435..67362e83b0 100644 --- a/integration/testdata/distroless-base.json.golden +++ b/integration/testdata/distroless-base.json.golden @@ -80,7 +80,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -110,7 +109,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1563", @@ -129,7 +128,8 @@ "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "Severity": "LOW", "CweIDs": [ - "CWE-311" + "CWE-327", + "CWE-203" ], "CVSS": { "nvd": { @@ -149,11 +149,11 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html", "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://linux.oracle.com/cve/CVE-2019-1563.html", "https://linux.oracle.com/errata/ELSA-2020-1840.html", "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html", @@ -182,7 +182,7 @@ "https://www.tenable.com/security/tns-2019-09" ], "PublishedDate": "2019-09-10T17:15:00Z", - "LastModifiedDate": "2020-10-20T22:15:00Z" + "LastModifiedDate": "2021-07-31T08:15:00Z" }, { "VulnerabilityID": "CVE-2019-1551", @@ -214,7 +214,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -244,7 +243,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1563", @@ -263,7 +262,8 @@ "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "Severity": "LOW", "CweIDs": [ - "CWE-311" + "CWE-327", + "CWE-203" ], "CVSS": { "nvd": { @@ -283,11 +283,11 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html", "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://linux.oracle.com/cve/CVE-2019-1563.html", "https://linux.oracle.com/errata/ELSA-2020-1840.html", "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html", @@ -316,7 +316,7 @@ "https://www.tenable.com/security/tns-2019-09" ], "PublishedDate": "2019-09-10T17:15:00Z", - "LastModifiedDate": "2020-10-20T22:15:00Z" + "LastModifiedDate": "2021-07-31T08:15:00Z" } ] } diff --git a/integration/testdata/distroless-python27.json.golden b/integration/testdata/distroless-python27.json.golden index 746cd03044..7d58cd4760 100644 --- a/integration/testdata/distroless-python27.json.golden +++ b/integration/testdata/distroless-python27.json.golden @@ -97,7 +97,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -127,7 +126,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1563", @@ -146,7 +145,8 @@ "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "Severity": "LOW", "CweIDs": [ - "CWE-311" + "CWE-327", + "CWE-203" ], "CVSS": { "nvd": { @@ -166,11 +166,11 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html", "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://linux.oracle.com/cve/CVE-2019-1563.html", "https://linux.oracle.com/errata/ELSA-2020-1840.html", "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html", @@ -199,7 +199,7 @@ "https://www.tenable.com/security/tns-2019-09" ], "PublishedDate": "2019-09-10T17:15:00Z", - "LastModifiedDate": "2020-10-20T22:15:00Z" + "LastModifiedDate": "2021-07-31T08:15:00Z" }, { "VulnerabilityID": "CVE-2019-1551", @@ -231,7 +231,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -261,7 +260,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1563", @@ -280,7 +279,8 @@ "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "Severity": "LOW", "CweIDs": [ - "CWE-311" + "CWE-327", + "CWE-203" ], "CVSS": { "nvd": { @@ -300,11 +300,11 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html", "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://linux.oracle.com/cve/CVE-2019-1563.html", "https://linux.oracle.com/errata/ELSA-2020-1840.html", "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html", @@ -333,7 +333,7 @@ "https://www.tenable.com/security/tns-2019-09" ], "PublishedDate": "2019-09-10T17:15:00Z", - "LastModifiedDate": "2020-10-20T22:15:00Z" + "LastModifiedDate": "2021-07-31T08:15:00Z" } ] } diff --git a/integration/testdata/dockerfile-custom-policies.json.golden b/integration/testdata/dockerfile-custom-policies.json.golden index 5c398255b8..0e15a4c81d 100644 --- a/integration/testdata/dockerfile-custom-policies.json.golden +++ b/integration/testdata/dockerfile-custom-policies.json.golden @@ -33,7 +33,9 @@ "Namespace": "user.bar", "Query": "data.user.bar.deny", "Severity": "UNKNOWN", - "Status": "FAIL" + "Status": "FAIL", + "Layer": {}, + "IacMetadata": {} }, { "Type": "N/A", @@ -43,7 +45,9 @@ "Namespace": "user.foo", "Query": "data.user.foo.deny", "Severity": "UNKNOWN", - "Status": "FAIL" + "Status": "FAIL", + "Layer": {}, + "IacMetadata": {} } ] } diff --git a/integration/testdata/dockerfile.json.golden b/integration/testdata/dockerfile.json.golden index a070b15122..bc72b632cf 100644 --- a/integration/testdata/dockerfile.json.golden +++ b/integration/testdata/dockerfile.json.golden @@ -40,7 +40,9 @@ "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://avd.aquasec.com/appshield/ds002" ], - "Status": "FAIL" + "Status": "FAIL", + "Layer": {}, + "IacMetadata": {} } ] } diff --git a/integration/testdata/fixtures/db/almalinux.yaml b/integration/testdata/fixtures/db/almalinux.yaml new file mode 100644 index 0000000000..e7e463ebe3 --- /dev/null +++ b/integration/testdata/fixtures/db/almalinux.yaml @@ -0,0 +1,10 @@ +- bucket: alma 8 + pairs: + - bucket: openssl-libs + pairs: + - key: CVE-2021-3450 + value: + FixedVersion: 1:1.1.1g-15.el8_3 + - key: CVE-2021-3712 + value: + FixedVersion: 1:1.1.1k-5.el8_5 \ No newline at end of file diff --git a/integration/testdata/fixtures/db/vulnerability.yaml b/integration/testdata/fixtures/db/vulnerability.yaml index 393e9570ac..b11633aaa4 100644 --- a/integration/testdata/fixtures/db/vulnerability.yaml +++ b/integration/testdata/fixtures/db/vulnerability.yaml @@ -24,7 +24,6 @@ - http://www.openwall.com/lists/oss-security/2016/11/17/9 - http://www.securityfocus.com/bid/94398 - https://access.redhat.com/errata/RHSA-2017:1931 - - https://access.redhat.com/security/cve/CVE-2016-9401 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9401 - https://linux.oracle.com/cve/CVE-2016-9401.html - https://linux.oracle.com/errata/ELSA-2017-1931.html @@ -56,18 +55,19 @@ PublishedDate: 2019-07-26T00:15:00Z References: - https://access.redhat.com/errata/RHSA-2019:3024 - - https://access.redhat.com/security/cve/CVE-2019-10744 - https://github.com/advisories/GHSA-jf85-cpcp-j695 + - https://github.com/lodash/lodash/pull/4336 - https://nvd.nist.gov/vuln/detail/CVE-2019-10744 - https://security.netapp.com/advisory/ntap-20191004-0005/ - https://snyk.io/vuln/SNYK-JS-LODASH-450202 - https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS + - https://www.npmjs.com/advisories/1065 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuoct2020.html Severity: CRITICAL Title: "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties" VendorSeverity: - ghsa-npm: 3.0 + ghsa-npm: 4.0 nvd: 4.0 redhat: 3.0 - key: CVE-2019-11358 @@ -84,7 +84,7 @@ CweIDs: - CWE-79 Description: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. - LastModifiedDate: 2021-06-14T18:15:00Z + LastModifiedDate: 2021-10-20T11:15:00Z PublishedDate: 2019-04-20T00:29:00Z References: - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html @@ -102,7 +102,6 @@ - https://access.redhat.com/errata/RHSA-2019:2587 - https://access.redhat.com/errata/RHSA-2019:3023 - https://access.redhat.com/errata/RHSA-2019:3024 - - https://access.redhat.com/security/cve/CVE-2019-11358 - https://backdropcms.org/security/backdrop-sa-core-2019-009 - https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358 @@ -114,7 +113,7 @@ - https://hackerone.com/reports/454365 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601 - https://linux.oracle.com/cve/CVE-2019-11358.html - - https://linux.oracle.com/errata/ELSA-2020-3936.html + - https://linux.oracle.com/errata/ELSA-2020-4847.html - https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844@%3Ccommits.airflow.apache.org%3E @@ -152,12 +151,14 @@ - https://www.debian.org/security/2019/dsa-4434 - https://www.debian.org/security/2019/dsa-4460 - https://www.drupal.org/sa-core-2019-006 + - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html + - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/ @@ -167,6 +168,7 @@ Severity: MEDIUM Title: "jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection" VendorSeverity: + alma: 2.0 amazon: 2.0 arch-linux: 2.0 ghsa-npm: 2.0 @@ -215,7 +217,6 @@ References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html - - https://access.redhat.com/security/cve/CVE-2019-14806 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806 - https://github.com/advisories/GHSA-gq9m-qvpx-68hc - "https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168" @@ -247,7 +248,6 @@ LastModifiedDate: 2020-10-20T22:15:00Z PublishedDate: 2019-09-10T17:15:00Z References: - - https://access.redhat.com/security/cve/CVE-2019-1549 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be - https://linux.oracle.com/cve/CVE-2019-1549.html @@ -290,12 +290,11 @@ CweIDs: - CWE-200 Description: There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t). - LastModifiedDate: 2021-06-14T18:15:00Z + LastModifiedDate: 2021-07-21T11:39:00Z PublishedDate: 2019-12-06T18:15:00Z References: - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html - http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html - - https://access.redhat.com/security/cve/CVE-2019-1551 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98 @@ -326,6 +325,7 @@ Severity: MEDIUM Title: "openssl: Integer overflow in RSAZ modular exponentiation on x86_64" VendorSeverity: + amazon: 1.0 nvd: 2.0 oracle-oval: 1.0 photon: 2.0 @@ -343,9 +343,10 @@ V3Score: 3.7 V3Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CweIDs: - - CWE-311 + - CWE-327 + - CWE-203 Description: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). - LastModifiedDate: 2020-10-20T22:15:00Z + LastModifiedDate: 2021-07-31T08:15:00Z PublishedDate: 2019-09-10T17:15:00Z References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html @@ -353,11 +354,11 @@ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html - http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html - - https://access.redhat.com/security/cve/CVE-2019-1563 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f + - https://kc.mcafee.com/corporate/index?page=content&id=SB10365 - https://linux.oracle.com/cve/CVE-2019-1563.html - https://linux.oracle.com/errata/ELSA-2020-1840.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html @@ -412,7 +413,6 @@ References: - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html - - https://access.redhat.com/security/cve/CVE-2019-18224 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224 - https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c @@ -449,7 +449,6 @@ PublishedDate: 2019-11-28T01:15:00Z References: - http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html - - https://access.redhat.com/security/cve/CVE-2019-18276 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276 - https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff - https://linux.oracle.com/cve/CVE-2019-18276.html @@ -485,7 +484,6 @@ References: - http://www.securityfocus.com/bid/106950 - https://access.redhat.com/errata/RHSA-2019:3701 - - https://access.redhat.com/security/cve/CVE-2019-3823 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823 - https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf - https://curl.haxx.se/docs/CVE-2019-3823.html @@ -527,7 +525,6 @@ LastModifiedDate: 2021-01-11T19:21:00Z PublishedDate: 2019-09-24T22:15:00Z References: - - https://access.redhat.com/security/cve/CVE-2019-5094 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094 - https://linux.oracle.com/cve/CVE-2019-5094.html - https://linux.oracle.com/errata/ELSA-2020-4011.html @@ -572,7 +569,6 @@ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html - http://www.openwall.com/lists/oss-security/2019/09/11/6 - - https://access.redhat.com/security/cve/CVE-2019-5436 - https://curl.haxx.se/docs/CVE-2019-5436.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436 - https://linux.oracle.com/cve/CVE-2019-5436.html @@ -618,7 +614,6 @@ References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html - - https://access.redhat.com/security/cve/CVE-2019-5481 - https://curl.haxx.se/docs/CVE-2019-5481.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481 - https://linux.oracle.com/cve/CVE-2019-5481.html @@ -661,7 +656,6 @@ LastModifiedDate: 2020-12-01T16:05:00Z PublishedDate: 2020-11-18T15:15:00Z References: - - https://access.redhat.com/security/cve/CVE-2020-28724 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28724 - https://github.com/advisories/GHSA-3p3h-qghp-hvh2 - https://github.com/pallets/flask/issues/1639 @@ -695,8 +689,8 @@ References: - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html - - https://access.redhat.com/security/cve/CVE-2020-8165 - https://github.com/advisories/GHSA-2p68-f74v-9wc6 + - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml - "https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ" - "https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c" - https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c @@ -712,6 +706,56 @@ ghsa-rubygems: 3.0 nvd: 4.0 redhat: 3.0 + - key: CVE-2021-3712 + value: + CVSS: + nvd: + V2Score: 5.8 + V2Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P + V3Score: 7.4 + V3Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H + redhat: + V3Score: 7.4 + V3Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H + CweIDs: + - CWE-125 + Description: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y). + LastModifiedDate: 2022-01-06T09:15:00Z + PublishedDate: 2021-08-24T15:15:00Z + References: + - http://www.openwall.com/lists/oss-security/2021/08/26/2 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712 + - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=94d23fcff9b2a7a8368dfe52214d5c2569882c11 + - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ccb0a11145ee72b042d10593a64eaf9e8a55ec12 + - https://kc.mcafee.com/corporate/index?page=content&id=SB10366 + - https://linux.oracle.com/cve/CVE-2021-3712.html + - https://linux.oracle.com/errata/ELSA-2021-9632.html + - https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e@%3Cdev.tomcat.apache.org%3E + - https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1@%3Cdev.tomcat.apache.org%3E + - https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html + - https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html + - https://security.netapp.com/advisory/ntap-20210827-0010/ + - https://ubuntu.com/security/notices/USN-5051-1 + - https://ubuntu.com/security/notices/USN-5051-2 + - https://ubuntu.com/security/notices/USN-5051-3 + - https://ubuntu.com/security/notices/USN-5051-4 (regression only in trusty/esm) + - https://ubuntu.com/security/notices/USN-5088-1 + - https://www.debian.org/security/2021/dsa-4963 + - https://www.openssl.org/news/secadv/20210824.txt + - https://www.oracle.com/security-alerts/cpuoct2021.html + - https://www.tenable.com/security/tns-2021-16 + - https://www.tenable.com/security/tns-2022-02 + Severity: HIGH + Title: "openssl: Read buffer overruns processing ASN.1 strings" + VendorSeverity: + alma: 2.0 + amazon: 2.0 + arch-linux: 3.0 + nvd: 3.0 + oracle-oval: 2.0 + photon: 3.0 + redhat: 2.0 + ubuntu: 2.0 - key: RUSTSEC-2019-0001 value: Description: |- diff --git a/integration/testdata/fluentd-gems.json.golden b/integration/testdata/fluentd-gems.json.golden index c69710d0b6..d7f146593f 100644 --- a/integration/testdata/fluentd-gems.json.golden +++ b/integration/testdata/fluentd-gems.json.golden @@ -139,7 +139,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html", - "https://access.redhat.com/security/cve/CVE-2019-18224", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224", "https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c", @@ -194,8 +193,8 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html", "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html", - "https://access.redhat.com/security/cve/CVE-2020-8165", "https://github.com/advisories/GHSA-2p68-f74v-9wc6", + "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml", "https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ", "https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c", "https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c", diff --git a/integration/testdata/nodejs.json.golden b/integration/testdata/nodejs.json.golden index 844be25012..3b06bc2a11 100644 --- a/integration/testdata/nodejs.json.golden +++ b/integration/testdata/nodejs.json.golden @@ -62,7 +62,6 @@ "https://access.redhat.com/errata/RHSA-2019:2587", "https://access.redhat.com/errata/RHSA-2019:3023", "https://access.redhat.com/errata/RHSA-2019:3024", - "https://access.redhat.com/security/cve/CVE-2019-11358", "https://backdropcms.org/security/backdrop-sa-core-2019-009", "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358", @@ -74,7 +73,7 @@ "https://hackerone.com/reports/454365", "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601", "https://linux.oracle.com/cve/CVE-2019-11358.html", - "https://linux.oracle.com/errata/ELSA-2020-3936.html", + "https://linux.oracle.com/errata/ELSA-2020-4847.html", "https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E", "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E", "https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844@%3Ccommits.airflow.apache.org%3E", @@ -112,12 +111,14 @@ "https://www.debian.org/security/2019/dsa-4434", "https://www.debian.org/security/2019/dsa-4460", "https://www.drupal.org/sa-core-2019-006", + "https://www.oracle.com//security-alerts/cpujul2021.html", "https://www.oracle.com/security-alerts/cpuApr2021.html", "https://www.oracle.com/security-alerts/cpuapr2020.html", "https://www.oracle.com/security-alerts/cpujan2020.html", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpujul2020.html", "https://www.oracle.com/security-alerts/cpuoct2020.html", + "https://www.oracle.com/security-alerts/cpuoct2021.html", "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/", @@ -126,7 +127,7 @@ "https://www.tenable.com/security/tns-2020-02" ], "PublishedDate": "2019-04-20T00:29:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-10-20T11:15:00Z" }, { "VulnerabilityID": "CVE-2019-10744", @@ -138,7 +139,7 @@ "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-10744", "Title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "Description": "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", - "Severity": "HIGH", + "Severity": "CRITICAL", "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P", @@ -153,12 +154,13 @@ }, "References": [ "https://access.redhat.com/errata/RHSA-2019:3024", - "https://access.redhat.com/security/cve/CVE-2019-10744", "https://github.com/advisories/GHSA-jf85-cpcp-j695", + "https://github.com/lodash/lodash/pull/4336", "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", "https://security.netapp.com/advisory/ntap-20191004-0005/", "https://snyk.io/vuln/SNYK-JS-LODASH-450202", "https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS", + "https://www.npmjs.com/advisories/1065", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpuoct2020.html" ], diff --git a/integration/testdata/oraclelinux-8-slim.json.golden b/integration/testdata/oraclelinux-8-slim.json.golden index 0436f6b53d..fd2cab0205 100644 --- a/integration/testdata/oraclelinux-8-slim.json.golden +++ b/integration/testdata/oraclelinux-8-slim.json.golden @@ -92,7 +92,6 @@ "References": [ "http://www.securityfocus.com/bid/106950", "https://access.redhat.com/errata/RHSA-2019:3701", - "https://access.redhat.com/security/cve/CVE-2019-3823", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823", "https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf", "https://curl.haxx.se/docs/CVE-2019-3823.html", @@ -143,7 +142,6 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html", "http://www.openwall.com/lists/oss-security/2019/09/11/6", - "https://access.redhat.com/security/cve/CVE-2019-5436", "https://curl.haxx.se/docs/CVE-2019-5436.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436", "https://linux.oracle.com/cve/CVE-2019-5436.html", diff --git a/integration/testdata/photon-30.json.golden b/integration/testdata/photon-30.json.golden index e09737b680..674339cfeb 100644 --- a/integration/testdata/photon-30.json.golden +++ b/integration/testdata/photon-30.json.golden @@ -92,7 +92,6 @@ }, "References": [ "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html", - "https://access.redhat.com/security/cve/CVE-2019-18276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276", "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff", "https://linux.oracle.com/cve/CVE-2019-18276.html", @@ -136,7 +135,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html", - "https://access.redhat.com/security/cve/CVE-2019-5481", "https://curl.haxx.se/docs/CVE-2019-5481.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481", "https://linux.oracle.com/cve/CVE-2019-5481.html", @@ -187,7 +185,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html", - "https://access.redhat.com/security/cve/CVE-2019-5481", "https://curl.haxx.se/docs/CVE-2019-5481.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481", "https://linux.oracle.com/cve/CVE-2019-5481.html", diff --git a/integration/testdata/pip.json.golden b/integration/testdata/pip.json.golden index ab3a6054be..6728f1eb30 100644 --- a/integration/testdata/pip.json.golden +++ b/integration/testdata/pip.json.golden @@ -49,7 +49,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html", - "https://access.redhat.com/security/cve/CVE-2019-14806", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806", "https://github.com/advisories/GHSA-gq9m-qvpx-68hc", "https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168", @@ -88,7 +87,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2020-28724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28724", "https://github.com/advisories/GHSA-3p3h-qghp-hvh2", "https://github.com/pallets/flask/issues/1639", diff --git a/integration/testdata/ubuntu-1804-ignore-unfixed.json.golden b/integration/testdata/ubuntu-1804-ignore-unfixed.json.golden index fc4cc9d474..4f331ac696 100644 --- a/integration/testdata/ubuntu-1804-ignore-unfixed.json.golden +++ b/integration/testdata/ubuntu-1804-ignore-unfixed.json.golden @@ -99,7 +99,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -148,7 +147,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -197,7 +195,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -246,7 +243,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", diff --git a/integration/testdata/ubuntu-1804.json.golden b/integration/testdata/ubuntu-1804.json.golden index fcd1b4d3ef..896d442041 100644 --- a/integration/testdata/ubuntu-1804.json.golden +++ b/integration/testdata/ubuntu-1804.json.golden @@ -99,7 +99,6 @@ }, "References": [ "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html", - "https://access.redhat.com/security/cve/CVE-2019-18276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276", "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff", "https://linux.oracle.com/cve/CVE-2019-18276.html", @@ -141,7 +140,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -190,7 +188,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -239,7 +236,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -288,7 +284,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", diff --git a/pkg/detector/ospkg/alma/alma.go b/pkg/detector/ospkg/alma/alma.go new file mode 100644 index 0000000000..54408aae1d --- /dev/null +++ b/pkg/detector/ospkg/alma/alma.go @@ -0,0 +1,123 @@ +package alma + +import ( + "strings" + "time" + + version "github.com/knqyf263/go-rpm-version" + "golang.org/x/xerrors" + "k8s.io/utils/clock" + + ftypes "github.com/aquasecurity/fanal/types" + "github.com/aquasecurity/trivy-db/pkg/vulnsrc/alma" + "github.com/aquasecurity/trivy/pkg/log" + "github.com/aquasecurity/trivy/pkg/scanner/utils" + "github.com/aquasecurity/trivy/pkg/types" +) + +var ( + eolDates = map[string]time.Time{ + // Source: + // https://wiki.almalinux.org/FAQ.html#how-long-will-cloudlinux-support-almalinux + "8": time.Date(2029, 12, 31, 23, 59, 59, 0, time.UTC), + } +) + +type options struct { + clock clock.Clock +} + +type option func(*options) + +func WithClock(clock clock.Clock) option { + return func(opts *options) { + opts.clock = clock + } +} + +// Scanner implements the AlmaLinux scanner +type Scanner struct { + vs alma.VulnSrc + *options +} + +// NewScanner is the factory method for Scanner +func NewScanner(opts ...option) *Scanner { + o := &options{ + clock: clock.RealClock{}, + } + + for _, opt := range opts { + opt(o) + } + return &Scanner{ + vs: alma.NewVulnSrc(), + options: o, + } +} + +// Detect vulnerabilities in package using AlmaLinux scanner +func (s *Scanner) Detect(osVer string, pkgs []ftypes.Package) ([]types.DetectedVulnerability, error) { + log.Logger.Info("Detecting AlmaLinux vulnerabilities...") + if strings.Count(osVer, ".") > 0 { + osVer = osVer[:strings.Index(osVer, ".")] + } + log.Logger.Debugf("AlmaLinux: os version: %s", osVer) + log.Logger.Debugf("AlmaLinux: the number of packages: %d", len(pkgs)) + + var vulns []types.DetectedVulnerability + for _, pkg := range pkgs { + pkgName := addModularNamespace(pkg.Name, pkg.Modularitylabel) + advisories, err := s.vs.Get(osVer, pkgName) + if err != nil { + return nil, xerrors.Errorf("failed to get AlmaLinux advisories: %w", err) + } + + installed := utils.FormatVersion(pkg) + installedVersion := version.NewVersion(installed) + + for _, adv := range advisories { + fixedVersion := version.NewVersion(adv.FixedVersion) + if installedVersion.LessThan(fixedVersion) { + vuln := types.DetectedVulnerability{ + VulnerabilityID: adv.VulnerabilityID, + PkgName: pkg.Name, + InstalledVersion: installed, + FixedVersion: fixedVersion.String(), + Layer: pkg.Layer, + } + vulns = append(vulns, vuln) + } + } + } + return vulns, nil +} + +// IsSupportedVersion checks the OSFamily can be scanned using AlmaLinux scanner +func (s *Scanner) IsSupportedVersion(osFamily, osVer string) bool { + if strings.Count(osVer, ".") > 0 { + osVer = osVer[:strings.Index(osVer, ".")] + } + + eol, ok := eolDates[osVer] + if !ok { + log.Logger.Warnf("This OS version is not on the EOL list: %s %s", osFamily, osVer) + return false + } + + return s.clock.Now().Before(eol) +} + +func addModularNamespace(name, label string) string { + // e.g. npm, nodejs:12:8030020201124152102:229f0a1c => nodejs:12::npm + var count int + for i, r := range label { + if r == ':' { + count++ + } + if count == 2 { + return label[:i] + "::" + name + } + } + return name +} diff --git a/pkg/detector/ospkg/alma/alma_test.go b/pkg/detector/ospkg/alma/alma_test.go new file mode 100644 index 0000000000..5b5d043c6a --- /dev/null +++ b/pkg/detector/ospkg/alma/alma_test.go @@ -0,0 +1,143 @@ +package alma_test + +import ( + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + fake "k8s.io/utils/clock/testing" + + ftypes "github.com/aquasecurity/fanal/types" + "github.com/aquasecurity/trivy-db/pkg/db" + "github.com/aquasecurity/trivy/pkg/dbtest" + "github.com/aquasecurity/trivy/pkg/detector/ospkg/alma" + "github.com/aquasecurity/trivy/pkg/types" +) + +func TestScanner_Detect(t *testing.T) { + type args struct { + osVer string + pkgs []ftypes.Package + } + tests := []struct { + name string + args args + fixtures []string + want []types.DetectedVulnerability + wantErr string + }{ + { + name: "happy path", + fixtures: []string{"testdata/fixtures/alma.yaml"}, + args: args{ + osVer: "8.4", + pkgs: []ftypes.Package{ + { + Name: "python3-libs", + Epoch: 0, + Version: "3.6.8", + Release: "36.el8.alma", + Arch: "x86_64", + SrcName: "python3", + SrcEpoch: 0, + SrcVersion: "3.6.8", + SrcRelease: "36.el8.alma", + Modularitylabel: "", + License: "Python", + Layer: ftypes.Layer{}, + }, + }, + }, + want: []types.DetectedVulnerability{ + { + PkgName: "python3-libs", + VulnerabilityID: "CVE-2020-26116", + InstalledVersion: "3.6.8-36.el8.alma", + FixedVersion: "3.6.8-37.el8.alma", + Layer: ftypes.Layer{}, + }, + }, + }, + { + name: "Get returns an error", + fixtures: []string{"testdata/fixtures/invalid.yaml"}, + args: args{ + osVer: "8.4", + pkgs: []ftypes.Package{ + { + Name: "jq", + Version: "1.5-12", + SrcName: "jq", + SrcVersion: "1.5-12", + }, + }, + }, + wantErr: "failed to get AlmaLinux advisories", + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _ = dbtest.InitDB(t, tt.fixtures) + defer db.Close() + + s := alma.NewScanner() + got, err := s.Detect(tt.args.osVer, tt.args.pkgs) + if tt.wantErr != "" { + require.Error(t, err) + assert.Contains(t, err.Error(), tt.wantErr) + return + } + assert.NoError(t, err) + assert.Equal(t, tt.want, got) + }) + } +} + +func TestScanner_IsSupportedVersion(t *testing.T) { + type args struct { + osFamily string + osVer string + } + tests := []struct { + name string + now time.Time + args args + want bool + }{ + { + name: "alma 8.4", + now: time.Date(2019, 3, 2, 23, 59, 59, 0, time.UTC), + args: args{ + osFamily: "alma", + osVer: "8.4", + }, + want: true, + }, + { + name: "alma 8.4 with EOL", + now: time.Date(2030, 1, 1, 0, 0, 0, 0, time.UTC), + args: args{ + osFamily: "alma", + osVer: "8.4", + }, + want: false, + }, + { + name: "unknown", + now: time.Date(2019, 5, 2, 23, 59, 59, 0, time.UTC), + args: args{ + osFamily: "alma", + osVer: "unknown", + }, + want: false, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + s := alma.NewScanner(alma.WithClock(fake.NewFakeClock(tt.now))) + got := s.IsSupportedVersion(tt.args.osFamily, tt.args.osVer) + assert.Equal(t, tt.want, got) + }) + } +} diff --git a/pkg/detector/ospkg/alma/testdata/fixtures/alma.yaml b/pkg/detector/ospkg/alma/testdata/fixtures/alma.yaml new file mode 100644 index 0000000000..af3043c75f --- /dev/null +++ b/pkg/detector/ospkg/alma/testdata/fixtures/alma.yaml @@ -0,0 +1,10 @@ +- bucket: alma 8 + pairs: + - bucket: python3-libs + pairs: + - key: CVE-2019-16935 + value: + FixedVersion: "3.6.8-31.el8.alma" + - key: CVE-2020-26116 + value: + FixedVersion: "3.6.8-37.el8.alma" \ No newline at end of file diff --git a/pkg/detector/ospkg/alma/testdata/fixtures/invalid.yaml b/pkg/detector/ospkg/alma/testdata/fixtures/invalid.yaml new file mode 100644 index 0000000000..a9cbeec8e0 --- /dev/null +++ b/pkg/detector/ospkg/alma/testdata/fixtures/invalid.yaml @@ -0,0 +1,9 @@ +- bucket: alma 8 + pairs: + - bucket: jq + pairs: + - key: CVE-2020-8177 + value: + FixedVersion: + - foo + - bar \ No newline at end of file diff --git a/pkg/detector/ospkg/detect.go b/pkg/detector/ospkg/detect.go index cf055464ca..3a8176b421 100644 --- a/pkg/detector/ospkg/detect.go +++ b/pkg/detector/ospkg/detect.go @@ -8,6 +8,7 @@ import ( fos "github.com/aquasecurity/fanal/analyzer/os" ftypes "github.com/aquasecurity/fanal/types" + "github.com/aquasecurity/trivy/pkg/detector/ospkg/alma" "github.com/aquasecurity/trivy/pkg/detector/ospkg/alpine" "github.com/aquasecurity/trivy/pkg/detector/ospkg/amazon" "github.com/aquasecurity/trivy/pkg/detector/ospkg/debian" @@ -63,12 +64,12 @@ func (d Detector) Detect(_, osFamily, osName string, _ time.Time, pkgs []ftypes. } // nolint: gocyclo -// TODO: fix cyclometic complexity by removing default func newDriver(osFamily, osName string) Driver { - // TODO: use DI and change struct names switch osFamily { case fos.Alpine: return alpine.NewScanner() + case fos.Alma: + return alma.NewScanner() case fos.Debian: return debian.NewScanner() case fos.Ubuntu: diff --git a/pkg/report/template.go b/pkg/report/template.go index 363440b12c..5b982f01ee 100644 --- a/pkg/report/template.go +++ b/pkg/report/template.go @@ -105,7 +105,7 @@ func toSarifRuleName(vulnerabilityType string) string { case vulnerability.Ubuntu, vulnerability.Alpine, vulnerability.RedHat, vulnerability.RedHatOVAL, vulnerability.Debian, vulnerability.DebianOVAL, vulnerability.Fedora, vulnerability.Amazon, vulnerability.OracleOVAL, vulnerability.SuseCVRF, vulnerability.OpenSuseCVRF, vulnerability.Photon, - vulnerability.CentOS: + vulnerability.CentOS, vulnerability.Alma: return "OsPackageVulnerability" case "npm", "yarn", "nuget", "pipenv", "poetry", "bundler", "cargo", "composer": return "ProgrammingLanguageVulnerability" diff --git a/pkg/report/writer_internal_test.go b/pkg/report/writer_internal_test.go index 2a465f0912..e3f2a539cd 100644 --- a/pkg/report/writer_internal_test.go +++ b/pkg/report/writer_internal_test.go @@ -64,6 +64,10 @@ func TestReportWriter_toSarifRuleName(t *testing.T) { vulnerabilityType: vulnerability.CentOS, sarifRuleName: "OsPackageVulnerability", }, + { + vulnerabilityType: vulnerability.Alma, + sarifRuleName: "OsPackageVulnerability", + }, { vulnerabilityType: "npm", sarifRuleName: "ProgrammingLanguageVulnerability", diff --git a/pkg/result/result.go b/pkg/result/result.go index 7ba35e9e72..4f35697208 100644 --- a/pkg/result/result.go +++ b/pkg/result/result.go @@ -94,7 +94,7 @@ func (c Client) detectSource(reportType string) []string { switch reportType { case vulnerability.Ubuntu, vulnerability.Alpine, vulnerability.RedHat, vulnerability.RedHatOVAL, vulnerability.Debian, vulnerability.DebianOVAL, vulnerability.Fedora, vulnerability.Amazon, - vulnerability.OracleOVAL, vulnerability.SuseCVRF, vulnerability.OpenSuseCVRF, vulnerability.Photon: + vulnerability.OracleOVAL, vulnerability.SuseCVRF, vulnerability.OpenSuseCVRF, vulnerability.Photon, vulnerability.Alma: sources = []string{reportType} case vulnerability.CentOS: // CentOS doesn't have its own so we use RedHat sources = []string{vulnerability.RedHat}