gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-21 23:00:42 -08:00
Code Issues Packages Projects Releases Wiki Activity

feat(alma): support AlmaLinux (#1238)

Browse Source 
Co-authored-by: Teppei Fukuda <knqyf263@gmail.com>
This commit is contained in:
MaineK00n
2022-01-07 05:26:09 +09:00
committed by GitHub
parent 1e171af165
commit 2a8336b9aa
41 changed files with 554 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/getting-started/overview.md
View File

@@ -22,7 +22,7 @@ See [Integrations][integrations] for details.
## Features
- Comprehensive vulnerability detection
- [OS packages][os] (Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless)
- [OS packages][os] (Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, AlmaLinux, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless)
- [**Language-specific packages**][lang] (Bundler, Composer, Pipenv, Poetry, npm, yarn, Cargo, NuGet, Maven, and Go)
- Detect IaC misconfigurations
- A wide variety of [built-in policies][builtin] are provided **out of the box**:

2
docs/vulnerability/detection/data-source.md
View File

@@ -11,6 +11,7 @@
| Ubuntu | [Ubuntu CVE Tracker][ubuntu] |
| RHEL/CentOS | [OVAL][rhel-oval] |
| | [Security Data][rhel-api] |
| AlmaLinux | [AlmaLinux Product Errata][alma] |
| Oracle Linux | [OVAL][oracle] |
| OpenSUSE/SLES | [CVRF][suse] |
| Photon OS | [Photon Security Advisory][photon] |
@@ -51,6 +52,7 @@
[ubuntu]: https://ubuntu.com/security/cve
[rhel-oval]: https://www.redhat.com/security/data/oval/v2/
[rhel-api]: https://www.redhat.com/security/data/metrics/
[alma]: https://errata.almalinux.org/
[oracle]: https://linux.oracle.com/security/oval/
[suse]: http://ftp.suse.com/pub/projects/security/cvrf/
[photon]: https://packages.vmware.com/photon/photon_cve_metadata/

1
docs/vulnerability/detection/os.md
View File

@@ -8,6 +8,7 @@ The unfixed/unfixable vulnerabilities mean that the patch has not yet been provi
| Red Hat Universal Base Image[^1] | 7, 8 | Installed by yum/rpm | YES |
| Red Hat Enterprise Linux | 6, 7, 8 | Installed by yum/rpm | YES |
| CentOS | 6, 7 | Installed by yum/rpm | YES |
| AlmaLinux | 8 | Installed by yum/rpm | NO |
| Oracle Linux | 5, 6, 7, 8 | Installed by yum/rpm | NO |
| Amazon Linux | 1, 2 | Installed by yum/rpm | NO |
| openSUSE Leap | 42, 15 | Installed by zypper/rpm | NO |

2
go.mod
View File

@@ -13,7 +13,7 @@ require (
github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492
github.com/aquasecurity/trivy-db v0.0.0-20220104200459-525690bf08ef
github.com/aquasecurity/trivy-db v0.0.0-20220105133155-dcbb8819ac5e
github.com/caarlos0/env/v6 v6.0.0
github.com/cenkalti/backoff v2.2.1+incompatible
github.com/cheggaaa/pb/v3 v3.0.3

5
go.sum
View File

@@ -239,8 +239,8 @@ github.com/aquasecurity/testdocker v0.0.0-20210911155206-e1e85f5a1516 h1:moQmzbp
github.com/aquasecurity/testdocker v0.0.0-20210911155206-e1e85f5a1516/go.mod h1:gTd97VdQ0rg8Mkiic3rPgNOQdprZ7feTAhiD5mGQjgM=
github.com/aquasecurity/tfsec v0.63.1 h1:KH63HTcUoab7d3PKtqFO6T8K5AY7bzLw7Kiu+EY9U64=
github.com/aquasecurity/tfsec v0.63.1/go.mod h1:g5ZWmsfqW1FsCaPb9ux8Pzjcyss/WUB2XuRd5slqvnc=
github.com/aquasecurity/trivy-db v0.0.0-20220104200459-525690bf08ef h1:E8ihL2Rh5aceXzexoCgKQVFzWQUQ56TwtITEOu4IuNE=
github.com/aquasecurity/trivy-db v0.0.0-20220104200459-525690bf08ef/go.mod h1:nT/y6Nbo7KDfRhezh3uE8nLNV5R13mGw34j6E8htL+o=
github.com/aquasecurity/trivy-db v0.0.0-20220105133155-dcbb8819ac5e h1:XcBTuz3pjg8509hIUxl0OEgtxyYSsc/siYN0TEY0hRc=
github.com/aquasecurity/trivy-db v0.0.0-20220105133155-dcbb8819ac5e/go.mod h1:rnojVJTK+RySsfLW7xMqmQRSjQpm5fEjS+/N4kf3fcc=
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
@@ -780,7 +780,6 @@ github.com/google/go-containerregistry v0.7.1-0.20211214010025-a65b7844a475 h1:d
github.com/google/go-containerregistry v0.7.1-0.20211214010025-a65b7844a475/go.mod h1:IwJblnDNiCs8sxubbfPNniYsUqr8m+nt7YbPzecsGuE=
github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
github.com/google/go-github/v28 v28.1.1/go.mod h1:bsqJWQX05omyWVmc00nEUql9mhQyv38lDZ8kPZcQVoM=
github.com/google/go-github/v38 v38.1.0/go.mod h1:cStvrz/7nFr0FoENgG6GLbp53WaelXucT+BBz/3VKx4=
github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
github.com/google/go-replayers/grpcreplay v0.1.0/go.mod h1:8Ig2Idjpr6gifRd6pNVggX6TC1Zw6Jx74AKp7QNH2QE=

7
integration/client_server_test.go
View File

@@ -141,6 +141,13 @@ func TestClientServer(t *testing.T) {
// },
// golden: "testdata/ubi-7.json.golden",
//},
{
name: "almalinux 8",
args: csArgs{
Input: "testdata/fixtures/images/almalinux-8.tar.gz",
},
golden: "testdata/almalinux-8.json.golden",
},
{
name: "distroless base",
args: csArgs{

6
integration/docker_engine_test.go
View File

@@ -103,6 +103,12 @@ func TestDockerEngine(t *testing.T) {
// wantOutputFile: "testdata/ubi-7.json.golden",
// testfile: "testdata/fixtures/images/ubi-7.tar.gz",
//},
{
name: "almalinux 8",
imageTag: "almalinux:8",
wantOutputFile: "testdata/almalinux-8.json.golden",
testfile: "testdata/fixtures/images/almalinux-8.tar.gz",
},
{
name: "debian buster/10",
imageTag: "debian:buster",

8
integration/standalone_tar_test.go
View File

@@ -173,6 +173,14 @@ func TestTar(t *testing.T) {
// },
// golden: "testdata/ubi-7.json.golden",
//},
{
name: "almalinux 8",
testArgs: args{
Format: "json",
Input: "testdata/fixtures/images/almalinux-8.tar.gz",
},
golden: "testdata/almalinux-8.json.golden",
},
{
name: "distroless base",
testArgs: args{

112
integration/testdata/almalinux-8.json.golden vendored Normal file
View File

@@ -0,0 +1,112 @@
{
"SchemaVersion": 2,
"ArtifactName": "testdata/fixtures/images/almalinux-8.tar.gz",
"ArtifactType": "container_image",
"Metadata": {
"OS": {
"Family": "alma",
"Name": "8.5"
},
"ImageID": "sha256:4ca63ce1d8a90da2ed4f2d5e93e8e9db2f32d0fabf0718a2edebbe0e70826622",
"DiffIDs": [
"sha256:124d41c237c5e823577dda97e87cebaecce62d585c725d07e709ce410681de4d"
],
"ImageConfig": {
"architecture": "amd64",
"container": "a467f67a48d469e1975b7414f33f2cf87121d4cc59d2ee029ea58e6b81774769",
"created": "2021-11-13T12:10:27.09871973Z",
"docker_version": "20.10.7",
"history": [
{
"created": "2021-11-13T12:10:26.29818864Z",
"created_by": "/bin/sh -c #(nop) ADD file:2e002305ccb9d8a4dcef52509c4c50b9a15e76c9c49ca6abda3e0d7091c63fa7 in / "
},
{
"created": "2021-11-13T12:10:27.09871973Z",
"created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]",
"empty_layer": true
}
],
"os": "linux",
"rootfs": {
"type": "layers",
"diff_ids": [
"sha256:124d41c237c5e823577dda97e87cebaecce62d585c725d07e709ce410681de4d"
]
},
"config": {
"Cmd": [
"/bin/bash"
],
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Image": "sha256:d38d2eac03bc19e080df596d6148863a0f8293f3a277a7524f378da79a1feb0f"
}
}
},
"Results": [
{
"Target": "testdata/fixtures/images/almalinux-8.tar.gz (alma 8.5)",
"Class": "os-pkgs",
"Type": "alma",
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2021-3712",
"PkgName": "openssl-libs",
"InstalledVersion": "1:1.1.1k-4.el8",
"FixedVersion": "1:1.1.1k-5.el8_5",
"Layer": {
"DiffID": "sha256:124d41c237c5e823577dda97e87cebaecce62d585c725d07e709ce410681de4d"
},
"SeveritySource": "alma",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-3712",
"Title": "openssl: Read buffer overruns processing ASN.1 strings",
"Description": "ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-125"
],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"V2Score": 5.8,
"V3Score": 7.4
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"V3Score": 7.4
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2021/08/26/2",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=94d23fcff9b2a7a8368dfe52214d5c2569882c11",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ccb0a11145ee72b042d10593a64eaf9e8a55ec12",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366",
"https://linux.oracle.com/cve/CVE-2021-3712.html",
"https://linux.oracle.com/errata/ELSA-2021-9632.html",
"https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1@%3Cdev.tomcat.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html",
"https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html",
"https://security.netapp.com/advisory/ntap-20210827-0010/",
"https://ubuntu.com/security/notices/USN-5051-1",
"https://ubuntu.com/security/notices/USN-5051-2",
"https://ubuntu.com/security/notices/USN-5051-3",
"https://ubuntu.com/security/notices/USN-5051-4 (regression only in trusty/esm)",
"https://ubuntu.com/security/notices/USN-5088-1",
"https://www.debian.org/security/2021/dsa-4963",
"https://www.openssl.org/news/secadv/20210824.txt",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://www.tenable.com/security/tns-2021-16",
"https://www.tenable.com/security/tns-2022-02"
],
"PublishedDate": "2021-08-24T15:15:00Z",
"LastModifiedDate": "2022-01-06T09:15:00Z"
}
]
}
]
}

8
integration/testdata/alpine-310-registry.json.golden vendored
View File

@@ -89,7 +89,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1549",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be",
"https://linux.oracle.com/cve/CVE-2019-1549.html",
@@ -145,7 +144,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -175,7 +173,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
},
{
"VulnerabilityID": "CVE-2019-1549",
@@ -207,7 +205,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1549",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be",
"https://linux.oracle.com/cve/CVE-2019-1549.html",
@@ -263,7 +260,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -293,7 +289,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
}
]
}

8
integration/testdata/alpine-310.gitlab.golden vendored
View File

@@ -33,8 +33,6 @@
}
],
"links": [{
"url": "https://access.redhat.com/security/cve/CVE-2019-1549"
},{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549"
},{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be"
@@ -110,8 +108,6 @@
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html"
},{
"url": "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html"
},{
"url": "https://access.redhat.com/security/cve/CVE-2019-1551"
},{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551"
},{
@@ -201,8 +197,6 @@
}
],
"links": [{
"url": "https://access.redhat.com/security/cve/CVE-2019-1549"
},{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549"
},{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be"
@@ -278,8 +272,6 @@
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html"
},{
"url": "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html"
},{
"url": "https://access.redhat.com/security/cve/CVE-2019-1551"
},{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551"
},{

4
integration/testdata/alpine-310.html.golden vendored
View File

@@ -99,7 +99,6 @@
<td class="pkg-version">1.1.1c-r0</td>
<td>1.1.1d-r0</td>
<td class="links" data-more-links="off">
<a href="https://access.redhat.com/security/cve/CVE-2019-1549">https://access.redhat.com/security/cve/CVE-2019-1549</a>
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549</a>
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be</a>
<a href="https://linux.oracle.com/cve/CVE-2019-1549.html">https://linux.oracle.com/cve/CVE-2019-1549.html</a>
@@ -130,7 +129,6 @@
<td class="links" data-more-links="off">
<a href="http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html">http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html</a>
<a href="http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html">http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html</a>
<a href="https://access.redhat.com/security/cve/CVE-2019-1551">https://access.redhat.com/security/cve/CVE-2019-1551</a>
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551</a>
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f</a>
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98</a>
@@ -167,7 +165,6 @@
<td class="pkg-version">1.1.1c-r0</td>
<td>1.1.1d-r0</td>
<td class="links" data-more-links="off">
<a href="https://access.redhat.com/security/cve/CVE-2019-1549">https://access.redhat.com/security/cve/CVE-2019-1549</a>
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549</a>
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be</a>
<a href="https://linux.oracle.com/cve/CVE-2019-1549.html">https://linux.oracle.com/cve/CVE-2019-1549.html</a>
@@ -198,7 +195,6 @@
<td class="links" data-more-links="off">
<a href="http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html">http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html</a>
<a href="http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html">http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html</a>
<a href="https://access.redhat.com/security/cve/CVE-2019-1551">https://access.redhat.com/security/cve/CVE-2019-1551</a>
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551</a>
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f</a>
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98</a>

8
integration/testdata/alpine-310.json.golden vendored
View File

@@ -82,7 +82,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1549",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be",
"https://linux.oracle.com/cve/CVE-2019-1549.html",
@@ -137,7 +136,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -167,7 +165,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
},
{
"VulnerabilityID": "CVE-2019-1549",
@@ -198,7 +196,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1549",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be",
"https://linux.oracle.com/cve/CVE-2019-1549.html",
@@ -253,7 +250,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -283,7 +279,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
}
]
}

6
integration/testdata/alpine-39-ignore-cveids.json.golden vendored
View File

@@ -84,7 +84,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -114,7 +113,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
},
{
"VulnerabilityID": "CVE-2019-1551",
@@ -147,7 +146,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -177,7 +175,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
}
]
}

8
integration/testdata/alpine-39.json.golden vendored
View File

@@ -82,7 +82,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1549",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be",
"https://linux.oracle.com/cve/CVE-2019-1549.html",
@@ -137,7 +136,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -167,7 +165,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
},
{
"VulnerabilityID": "CVE-2019-1549",
@@ -198,7 +196,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1549",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be",
"https://linux.oracle.com/cve/CVE-2019-1549.html",
@@ -253,7 +250,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -283,7 +279,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
},
{
"VulnerabilityID": "CVE-2019-14697",

1
integration/testdata/amazon-1.json.golden vendored
View File

@@ -83,7 +83,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
"https://access.redhat.com/security/cve/CVE-2019-5481",
"https://curl.haxx.se/docs/CVE-2019-5481.html",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
"https://linux.oracle.com/cve/CVE-2019-5481.html",

2
integration/testdata/amazon-2.json.golden vendored
View File

@@ -83,7 +83,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
"https://access.redhat.com/security/cve/CVE-2019-5481",
"https://curl.haxx.se/docs/CVE-2019-5481.html",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
"https://linux.oracle.com/cve/CVE-2019-5481.html",
@@ -135,7 +134,6 @@
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html",
"http://www.openwall.com/lists/oss-security/2019/09/11/6",
"https://access.redhat.com/security/cve/CVE-2019-5436",
"https://curl.haxx.se/docs/CVE-2019-5436.html",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436",
"https://linux.oracle.com/cve/CVE-2019-5436.html",

1
integration/testdata/debian-buster-ignore-unfixed.json.golden vendored
View File

@@ -86,7 +86,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html",
"https://access.redhat.com/security/cve/CVE-2019-18224",
"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224",
"https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c",

2
integration/testdata/debian-buster.json.golden vendored
View File

@@ -81,7 +81,6 @@
},
"References": [
"http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html",
"https://access.redhat.com/security/cve/CVE-2019-18276",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276",
"https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff",
"https://linux.oracle.com/cve/CVE-2019-18276.html",
@@ -128,7 +127,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html",
"https://access.redhat.com/security/cve/CVE-2019-18224",
"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224",
"https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c",

5
integration/testdata/debian-stretch.json.golden vendored
View File

@@ -81,7 +81,6 @@
},
"References": [
"http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html",
"https://access.redhat.com/security/cve/CVE-2019-18276",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276",
"https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff",
"https://linux.oracle.com/cve/CVE-2019-18276.html",
@@ -126,7 +125,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",
@@ -178,7 +176,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",
@@ -230,7 +227,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",
@@ -282,7 +278,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",

20
integration/testdata/distroless-base.json.golden vendored
View File

@@ -80,7 +80,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -110,7 +109,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
},
{
"VulnerabilityID": "CVE-2019-1563",
@@ -129,7 +128,8 @@
"Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
"Severity": "LOW",
"CweIDs": [
"CWE-311"
"CWE-327",
"CWE-203"
],
"CVSS": {
"nvd": {
@@ -149,11 +149,11 @@
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
"http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1563",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://linux.oracle.com/cve/CVE-2019-1563.html",
"https://linux.oracle.com/errata/ELSA-2020-1840.html",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
@@ -182,7 +182,7 @@
"https://www.tenable.com/security/tns-2019-09"
],
"PublishedDate": "2019-09-10T17:15:00Z",
"LastModifiedDate": "2020-10-20T22:15:00Z"
"LastModifiedDate": "2021-07-31T08:15:00Z"
},
{
"VulnerabilityID": "CVE-2019-1551",
@@ -214,7 +214,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -244,7 +243,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
},
{
"VulnerabilityID": "CVE-2019-1563",
@@ -263,7 +262,8 @@
"Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
"Severity": "LOW",
"CweIDs": [
"CWE-311"
"CWE-327",
"CWE-203"
],
"CVSS": {
"nvd": {
@@ -283,11 +283,11 @@
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
"http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1563",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://linux.oracle.com/cve/CVE-2019-1563.html",
"https://linux.oracle.com/errata/ELSA-2020-1840.html",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
@@ -316,7 +316,7 @@
"https://www.tenable.com/security/tns-2019-09"
],
"PublishedDate": "2019-09-10T17:15:00Z",
"LastModifiedDate": "2020-10-20T22:15:00Z"
"LastModifiedDate": "2021-07-31T08:15:00Z"
}
]
}

20
integration/testdata/distroless-python27.json.golden vendored
View File

@@ -97,7 +97,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -127,7 +126,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
},
{
"VulnerabilityID": "CVE-2019-1563",
@@ -146,7 +145,8 @@
"Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
"Severity": "LOW",
"CweIDs": [
"CWE-311"
"CWE-327",
"CWE-203"
],
"CVSS": {
"nvd": {
@@ -166,11 +166,11 @@
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
"http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1563",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://linux.oracle.com/cve/CVE-2019-1563.html",
"https://linux.oracle.com/errata/ELSA-2020-1840.html",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
@@ -199,7 +199,7 @@
"https://www.tenable.com/security/tns-2019-09"
],
"PublishedDate": "2019-09-10T17:15:00Z",
"LastModifiedDate": "2020-10-20T22:15:00Z"
"LastModifiedDate": "2021-07-31T08:15:00Z"
},
{
"VulnerabilityID": "CVE-2019-1551",
@@ -231,7 +231,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
@@ -261,7 +260,7 @@
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-07-21T11:39:00Z"
},
{
"VulnerabilityID": "CVE-2019-1563",
@@ -280,7 +279,8 @@
"Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
"Severity": "LOW",
"CweIDs": [
"CWE-311"
"CWE-327",
"CWE-203"
],
"CVSS": {
"nvd": {
@@ -300,11 +300,11 @@
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
"http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1563",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://linux.oracle.com/cve/CVE-2019-1563.html",
"https://linux.oracle.com/errata/ELSA-2020-1840.html",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
@@ -333,7 +333,7 @@
"https://www.tenable.com/security/tns-2019-09"
],
"PublishedDate": "2019-09-10T17:15:00Z",
"LastModifiedDate": "2020-10-20T22:15:00Z"
"LastModifiedDate": "2021-07-31T08:15:00Z"
}
]
}

8
integration/testdata/dockerfile-custom-policies.json.golden vendored
View File

@@ -33,7 +33,9 @@
"Namespace": "user.bar",
"Query": "data.user.bar.deny",
"Severity": "UNKNOWN",
"Status": "FAIL"
"Status": "FAIL",
"Layer": {},
"IacMetadata": {}
},
{
"Type": "N/A",
@@ -43,7 +45,9 @@
"Namespace": "user.foo",
"Query": "data.user.foo.deny",
"Severity": "UNKNOWN",
"Status": "FAIL"
"Status": "FAIL",
"Layer": {},
"IacMetadata": {}
}
]
}

4
integration/testdata/dockerfile.json.golden vendored
View File

@@ -40,7 +40,9 @@
"https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
"https://avd.aquasec.com/appshield/ds002"
],
"Status": "FAIL"
"Status": "FAIL",
"Layer": {},
"IacMetadata": {}
}
]
}

10
integration/testdata/fixtures/db/almalinux.yaml vendored Normal file
View File

@@ -0,0 +1,10 @@
- bucket: alma 8
pairs:
- bucket: openssl-libs
pairs:
- key: CVE-2021-3450
value:
FixedVersion: 1:1.1.1g-15.el8_3
- key: CVE-2021-3712
value:
FixedVersion: 1:1.1.1k-5.el8_5

86
integration/testdata/fixtures/db/vulnerability.yaml vendored
View File

@@ -24,7 +24,6 @@
- http://www.openwall.com/lists/oss-security/2016/11/17/9
- http://www.securityfocus.com/bid/94398
- https://access.redhat.com/errata/RHSA-2017:1931
- https://access.redhat.com/security/cve/CVE-2016-9401
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9401
- https://linux.oracle.com/cve/CVE-2016-9401.html
- https://linux.oracle.com/errata/ELSA-2017-1931.html
@@ -56,18 +55,19 @@
PublishedDate: 2019-07-26T00:15:00Z
References:
- https://access.redhat.com/errata/RHSA-2019:3024
- https://access.redhat.com/security/cve/CVE-2019-10744
- https://github.com/advisories/GHSA-jf85-cpcp-j695
- https://github.com/lodash/lodash/pull/4336
- https://nvd.nist.gov/vuln/detail/CVE-2019-10744
- https://security.netapp.com/advisory/ntap-20191004-0005/
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp;utm_medium=RSS
- https://www.npmjs.com/advisories/1065
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
Severity: CRITICAL
Title: "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties"
VendorSeverity:
ghsa-npm: 3.0
ghsa-npm: 4.0
nvd: 4.0
redhat: 3.0
- key: CVE-2019-11358
@@ -84,7 +84,7 @@
CweIDs:
- CWE-79
Description: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
LastModifiedDate: 2021-06-14T18:15:00Z
LastModifiedDate: 2021-10-20T11:15:00Z
PublishedDate: 2019-04-20T00:29:00Z
References:
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
@@ -102,7 +102,6 @@
- https://access.redhat.com/errata/RHSA-2019:2587
- https://access.redhat.com/errata/RHSA-2019:3023
- https://access.redhat.com/errata/RHSA-2019:3024
- https://access.redhat.com/security/cve/CVE-2019-11358
- https://backdropcms.org/security/backdrop-sa-core-2019-009
- https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358
@@ -114,7 +113,7 @@
- https://hackerone.com/reports/454365
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
- https://linux.oracle.com/cve/CVE-2019-11358.html
- https://linux.oracle.com/errata/ELSA-2020-3936.html
- https://linux.oracle.com/errata/ELSA-2020-4847.html
- https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844@%3Ccommits.airflow.apache.org%3E
@@ -152,12 +151,14 @@
- https://www.debian.org/security/2019/dsa-4434
- https://www.debian.org/security/2019/dsa-4460
- https://www.drupal.org/sa-core-2019-006
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/
@@ -167,6 +168,7 @@
Severity: MEDIUM
Title: "jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection"
VendorSeverity:
alma: 2.0
amazon: 2.0
arch-linux: 2.0
ghsa-npm: 2.0
@@ -215,7 +217,6 @@
References:
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html
- https://access.redhat.com/security/cve/CVE-2019-14806
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806
- https://github.com/advisories/GHSA-gq9m-qvpx-68hc
- "https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168"
@@ -247,7 +248,6 @@
LastModifiedDate: 2020-10-20T22:15:00Z
PublishedDate: 2019-09-10T17:15:00Z
References:
- https://access.redhat.com/security/cve/CVE-2019-1549
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be
- https://linux.oracle.com/cve/CVE-2019-1549.html
@@ -290,12 +290,11 @@
CweIDs:
- CWE-200
Description: There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).
LastModifiedDate: 2021-06-14T18:15:00Z
LastModifiedDate: 2021-07-21T11:39:00Z
PublishedDate: 2019-12-06T18:15:00Z
References:
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html
- http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html
- https://access.redhat.com/security/cve/CVE-2019-1551
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98
@@ -326,6 +325,7 @@
Severity: MEDIUM
Title: "openssl: Integer overflow in RSAZ modular exponentiation on x86_64"
VendorSeverity:
amazon: 1.0
nvd: 2.0
oracle-oval: 1.0
photon: 2.0
@@ -343,9 +343,10 @@
V3Score: 3.7
V3Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CweIDs:
- CWE-311
- CWE-327
- CWE-203
Description: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
LastModifiedDate: 2020-10-20T22:15:00Z
LastModifiedDate: 2021-07-31T08:15:00Z
PublishedDate: 2019-09-10T17:15:00Z
References:
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html
@@ -353,11 +354,11 @@
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html
- http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html
- https://access.redhat.com/security/cve/CVE-2019-1563
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://linux.oracle.com/cve/CVE-2019-1563.html
- https://linux.oracle.com/errata/ELSA-2020-1840.html
- https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html
@@ -412,7 +413,6 @@
References:
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html
- https://access.redhat.com/security/cve/CVE-2019-18224
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224
- https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c
@@ -449,7 +449,6 @@
PublishedDate: 2019-11-28T01:15:00Z
References:
- http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
- https://access.redhat.com/security/cve/CVE-2019-18276
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
- https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
- https://linux.oracle.com/cve/CVE-2019-18276.html
@@ -485,7 +484,6 @@
References:
- http://www.securityfocus.com/bid/106950
- https://access.redhat.com/errata/RHSA-2019:3701
- https://access.redhat.com/security/cve/CVE-2019-3823
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823
- https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf
- https://curl.haxx.se/docs/CVE-2019-3823.html
@@ -527,7 +525,6 @@
LastModifiedDate: 2021-01-11T19:21:00Z
PublishedDate: 2019-09-24T22:15:00Z
References:
- https://access.redhat.com/security/cve/CVE-2019-5094
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094
- https://linux.oracle.com/cve/CVE-2019-5094.html
- https://linux.oracle.com/errata/ELSA-2020-4011.html
@@ -572,7 +569,6 @@
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html
- http://www.openwall.com/lists/oss-security/2019/09/11/6
- https://access.redhat.com/security/cve/CVE-2019-5436
- https://curl.haxx.se/docs/CVE-2019-5436.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436
- https://linux.oracle.com/cve/CVE-2019-5436.html
@@ -618,7 +614,6 @@
References:
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html
- https://access.redhat.com/security/cve/CVE-2019-5481
- https://curl.haxx.se/docs/CVE-2019-5481.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481
- https://linux.oracle.com/cve/CVE-2019-5481.html
@@ -661,7 +656,6 @@
LastModifiedDate: 2020-12-01T16:05:00Z
PublishedDate: 2020-11-18T15:15:00Z
References:
- https://access.redhat.com/security/cve/CVE-2020-28724
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28724
- https://github.com/advisories/GHSA-3p3h-qghp-hvh2
- https://github.com/pallets/flask/issues/1639
@@ -695,8 +689,8 @@
References:
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html
- https://access.redhat.com/security/cve/CVE-2020-8165
- https://github.com/advisories/GHSA-2p68-f74v-9wc6
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml
- "https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ"
- "https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c"
- https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c
@@ -712,6 +706,56 @@
ghsa-rubygems: 3.0
nvd: 4.0
redhat: 3.0
- key: CVE-2021-3712
value:
CVSS:
nvd:
V2Score: 5.8
V2Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P
V3Score: 7.4
V3Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
redhat:
V3Score: 7.4
V3Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CweIDs:
- CWE-125
Description: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).
LastModifiedDate: 2022-01-06T09:15:00Z
PublishedDate: 2021-08-24T15:15:00Z
References:
- http://www.openwall.com/lists/oss-security/2021/08/26/2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=94d23fcff9b2a7a8368dfe52214d5c2569882c11
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ccb0a11145ee72b042d10593a64eaf9e8a55ec12
- https://kc.mcafee.com/corporate/index?page=content&id=SB10366
- https://linux.oracle.com/cve/CVE-2021-3712.html
- https://linux.oracle.com/errata/ELSA-2021-9632.html
- https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1@%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html
- https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html
- https://security.netapp.com/advisory/ntap-20210827-0010/
- https://ubuntu.com/security/notices/USN-5051-1
- https://ubuntu.com/security/notices/USN-5051-2
- https://ubuntu.com/security/notices/USN-5051-3
- https://ubuntu.com/security/notices/USN-5051-4 (regression only in trusty/esm)
- https://ubuntu.com/security/notices/USN-5088-1
- https://www.debian.org/security/2021/dsa-4963
- https://www.openssl.org/news/secadv/20210824.txt
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.tenable.com/security/tns-2021-16
- https://www.tenable.com/security/tns-2022-02
Severity: HIGH
Title: "openssl: Read buffer overruns processing ASN.1 strings"
VendorSeverity:
alma: 2.0
amazon: 2.0
arch-linux: 3.0
nvd: 3.0
oracle-oval: 2.0
photon: 3.0
redhat: 2.0
ubuntu: 2.0
- key: RUSTSEC-2019-0001
value:
Description: |-

3
integration/testdata/fluentd-gems.json.golden vendored
View File

@@ -139,7 +139,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html",
"https://access.redhat.com/security/cve/CVE-2019-18224",
"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224",
"https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c",
@@ -194,8 +193,8 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html",
"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html",
"https://access.redhat.com/security/cve/CVE-2020-8165",
"https://github.com/advisories/GHSA-2p68-f74v-9wc6",
"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml",
"https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ",
"https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c",
"https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c",

12
integration/testdata/nodejs.json.golden vendored
View File

@@ -62,7 +62,6 @@
"https://access.redhat.com/errata/RHSA-2019:2587",
"https://access.redhat.com/errata/RHSA-2019:3023",
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://access.redhat.com/security/cve/CVE-2019-11358",
"https://backdropcms.org/security/backdrop-sa-core-2019-009",
"https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358",
@@ -74,7 +73,7 @@
"https://hackerone.com/reports/454365",
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601",
"https://linux.oracle.com/cve/CVE-2019-11358.html",
"https://linux.oracle.com/errata/ELSA-2020-3936.html",
"https://linux.oracle.com/errata/ELSA-2020-4847.html",
"https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E",
"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E",
"https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844@%3Ccommits.airflow.apache.org%3E",
@@ -112,12 +111,14 @@
"https://www.debian.org/security/2019/dsa-4434",
"https://www.debian.org/security/2019/dsa-4460",
"https://www.drupal.org/sa-core-2019-006",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpujan2020.html",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/",
@@ -126,7 +127,7 @@
"https://www.tenable.com/security/tns-2020-02"
],
"PublishedDate": "2019-04-20T00:29:00Z",
"LastModifiedDate": "2021-06-14T18:15:00Z"
"LastModifiedDate": "2021-10-20T11:15:00Z"
},
{
"VulnerabilityID": "CVE-2019-10744",
@@ -138,7 +139,7 @@
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-10744",
"Title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties",
"Description": "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"Severity": "HIGH",
"Severity": "CRITICAL",
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
@@ -153,12 +154,13 @@
},
"References": [
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://access.redhat.com/security/cve/CVE-2019-10744",
"https://github.com/advisories/GHSA-jf85-cpcp-j695",
"https://github.com/lodash/lodash/pull/4336",
"https://nvd.nist.gov/vuln/detail/CVE-2019-10744",
"https://security.netapp.com/advisory/ntap-20191004-0005/",
"https://snyk.io/vuln/SNYK-JS-LODASH-450202",
"https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://www.npmjs.com/advisories/1065",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html"
],

2
integration/testdata/oraclelinux-8-slim.json.golden vendored
View File

@@ -92,7 +92,6 @@
"References": [
"http://www.securityfocus.com/bid/106950",
"https://access.redhat.com/errata/RHSA-2019:3701",
"https://access.redhat.com/security/cve/CVE-2019-3823",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823",
"https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf",
"https://curl.haxx.se/docs/CVE-2019-3823.html",
@@ -143,7 +142,6 @@
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html",
"http://www.openwall.com/lists/oss-security/2019/09/11/6",
"https://access.redhat.com/security/cve/CVE-2019-5436",
"https://curl.haxx.se/docs/CVE-2019-5436.html",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436",
"https://linux.oracle.com/cve/CVE-2019-5436.html",

3
integration/testdata/photon-30.json.golden vendored
View File

@@ -92,7 +92,6 @@
},
"References": [
"http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html",
"https://access.redhat.com/security/cve/CVE-2019-18276",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276",
"https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff",
"https://linux.oracle.com/cve/CVE-2019-18276.html",
@@ -136,7 +135,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
"https://access.redhat.com/security/cve/CVE-2019-5481",
"https://curl.haxx.se/docs/CVE-2019-5481.html",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
"https://linux.oracle.com/cve/CVE-2019-5481.html",
@@ -187,7 +185,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
"https://access.redhat.com/security/cve/CVE-2019-5481",
"https://curl.haxx.se/docs/CVE-2019-5481.html",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
"https://linux.oracle.com/cve/CVE-2019-5481.html",

2
integration/testdata/pip.json.golden vendored
View File

@@ -49,7 +49,6 @@
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html",
"https://access.redhat.com/security/cve/CVE-2019-14806",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806",
"https://github.com/advisories/GHSA-gq9m-qvpx-68hc",
"https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168",
@@ -88,7 +87,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2020-28724",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28724",
"https://github.com/advisories/GHSA-3p3h-qghp-hvh2",
"https://github.com/pallets/flask/issues/1639",

4
integration/testdata/ubuntu-1804-ignore-unfixed.json.golden vendored
View File

@@ -99,7 +99,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",
@@ -148,7 +147,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",
@@ -197,7 +195,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",
@@ -246,7 +243,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",

5
integration/testdata/ubuntu-1804.json.golden vendored
View File

@@ -99,7 +99,6 @@
},
"References": [
"http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html",
"https://access.redhat.com/security/cve/CVE-2019-18276",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276",
"https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff",
"https://linux.oracle.com/cve/CVE-2019-18276.html",
@@ -141,7 +140,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",
@@ -190,7 +188,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",
@@ -239,7 +236,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",
@@ -288,7 +284,6 @@
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-5094",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://linux.oracle.com/cve/CVE-2019-5094.html",
"https://linux.oracle.com/errata/ELSA-2020-4011.html",

123
pkg/detector/ospkg/alma/alma.go Normal file
View File

@@ -0,0 +1,123 @@
package alma
import (
"strings"
"time"
version "github.com/knqyf263/go-rpm-version"
"golang.org/x/xerrors"
"k8s.io/utils/clock"
ftypes "github.com/aquasecurity/fanal/types"
"github.com/aquasecurity/trivy-db/pkg/vulnsrc/alma"
"github.com/aquasecurity/trivy/pkg/log"
"github.com/aquasecurity/trivy/pkg/scanner/utils"
"github.com/aquasecurity/trivy/pkg/types"
)
var (
eolDates = map[string]time.Time{
// Source:
// https://wiki.almalinux.org/FAQ.html#how-long-will-cloudlinux-support-almalinux
"8": time.Date(2029, 12, 31, 23, 59, 59, 0, time.UTC),
}
)
type options struct {
clock clock.Clock
}
type option func(*options)
func WithClock(clock clock.Clock) option {
return func(opts *options) {
opts.clock = clock
}
}
// Scanner implements the AlmaLinux scanner
type Scanner struct {
vs alma.VulnSrc
*options
}
// NewScanner is the factory method for Scanner
func NewScanner(opts ...option) *Scanner {
o := &options{
clock: clock.RealClock{},
}
for _, opt := range opts {
opt(o)
}
return &Scanner{
vs: alma.NewVulnSrc(),
options: o,
}
}
// Detect vulnerabilities in package using AlmaLinux scanner
func (s *Scanner) Detect(osVer string, pkgs []ftypes.Package) ([]types.DetectedVulnerability, error) {
log.Logger.Info("Detecting AlmaLinux vulnerabilities...")
if strings.Count(osVer, ".") > 0 {
osVer = osVer[:strings.Index(osVer, ".")]
}
log.Logger.Debugf("AlmaLinux: os version: %s", osVer)
log.Logger.Debugf("AlmaLinux: the number of packages: %d", len(pkgs))
var vulns []types.DetectedVulnerability
for _, pkg := range pkgs {
pkgName := addModularNamespace(pkg.Name, pkg.Modularitylabel)
advisories, err := s.vs.Get(osVer, pkgName)
if err != nil {
return nil, xerrors.Errorf("failed to get AlmaLinux advisories: %w", err)
}
installed := utils.FormatVersion(pkg)
installedVersion := version.NewVersion(installed)
for _, adv := range advisories {
fixedVersion := version.NewVersion(adv.FixedVersion)
if installedVersion.LessThan(fixedVersion) {
vuln := types.DetectedVulnerability{
VulnerabilityID: adv.VulnerabilityID,
PkgName: pkg.Name,
InstalledVersion: installed,
FixedVersion: fixedVersion.String(),
Layer: pkg.Layer,
}
vulns = append(vulns, vuln)
}
}
}
return vulns, nil
}
// IsSupportedVersion checks the OSFamily can be scanned using AlmaLinux scanner
func (s *Scanner) IsSupportedVersion(osFamily, osVer string) bool {
if strings.Count(osVer, ".") > 0 {
osVer = osVer[:strings.Index(osVer, ".")]
}
eol, ok := eolDates[osVer]
if !ok {
log.Logger.Warnf("This OS version is not on the EOL list: %s %s", osFamily, osVer)
return false
}
return s.clock.Now().Before(eol)
}
func addModularNamespace(name, label string) string {
// e.g. npm, nodejs:12:8030020201124152102:229f0a1c => nodejs:12::npm
var count int
for i, r := range label {
if r == ':' {
count++
}
if count == 2 {
return label[:i] + "::" + name
}
}
return name
}

143
pkg/detector/ospkg/alma/alma_test.go Normal file
View File

@@ -0,0 +1,143 @@
package alma_test
import (
"testing"
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
fake "k8s.io/utils/clock/testing"
ftypes "github.com/aquasecurity/fanal/types"
"github.com/aquasecurity/trivy-db/pkg/db"
"github.com/aquasecurity/trivy/pkg/dbtest"
"github.com/aquasecurity/trivy/pkg/detector/ospkg/alma"
"github.com/aquasecurity/trivy/pkg/types"
)
func TestScanner_Detect(t *testing.T) {
type args struct {
osVer string
pkgs []ftypes.Package
}
tests := []struct {
name string
args args
fixtures []string
want []types.DetectedVulnerability
wantErr string
}{
{
name: "happy path",
fixtures: []string{"testdata/fixtures/alma.yaml"},
args: args{
osVer: "8.4",
pkgs: []ftypes.Package{
{
Name: "python3-libs",
Epoch: 0,
Version: "3.6.8",
Release: "36.el8.alma",
Arch: "x86_64",
SrcName: "python3",
SrcEpoch: 0,
SrcVersion: "3.6.8",
SrcRelease: "36.el8.alma",
Modularitylabel: "",
License: "Python",
Layer: ftypes.Layer{},
},
},
},
want: []types.DetectedVulnerability{
{
PkgName: "python3-libs",
VulnerabilityID: "CVE-2020-26116",
InstalledVersion: "3.6.8-36.el8.alma",
FixedVersion: "3.6.8-37.el8.alma",
Layer: ftypes.Layer{},
},
},
},
{
name: "Get returns an error",
fixtures: []string{"testdata/fixtures/invalid.yaml"},
args: args{
osVer: "8.4",
pkgs: []ftypes.Package{
{
Name: "jq",
Version: "1.5-12",
SrcName: "jq",
SrcVersion: "1.5-12",
},
},
},
wantErr: "failed to get AlmaLinux advisories",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
_ = dbtest.InitDB(t, tt.fixtures)
defer db.Close()
s := alma.NewScanner()
got, err := s.Detect(tt.args.osVer, tt.args.pkgs)
if tt.wantErr != "" {
require.Error(t, err)
assert.Contains(t, err.Error(), tt.wantErr)
return
}
assert.NoError(t, err)
assert.Equal(t, tt.want, got)
})
}
}
func TestScanner_IsSupportedVersion(t *testing.T) {
type args struct {
osFamily string
osVer string
}
tests := []struct {
name string
now time.Time
args args
want bool
}{
{
name: "alma 8.4",
now: time.Date(2019, 3, 2, 23, 59, 59, 0, time.UTC),
args: args{
osFamily: "alma",
osVer: "8.4",
},
want: true,
},
{
name: "alma 8.4 with EOL",
now: time.Date(2030, 1, 1, 0, 0, 0, 0, time.UTC),
args: args{
osFamily: "alma",
osVer: "8.4",
},
want: false,
},
{
name: "unknown",
now: time.Date(2019, 5, 2, 23, 59, 59, 0, time.UTC),
args: args{
osFamily: "alma",
osVer: "unknown",
},
want: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
s := alma.NewScanner(alma.WithClock(fake.NewFakeClock(tt.now)))
got := s.IsSupportedVersion(tt.args.osFamily, tt.args.osVer)
assert.Equal(t, tt.want, got)
})
}
}

10
pkg/detector/ospkg/alma/testdata/fixtures/alma.yaml vendored Normal file
View File

@@ -0,0 +1,10 @@
- bucket: alma 8
pairs:
- bucket: python3-libs
pairs:
- key: CVE-2019-16935
value:
FixedVersion: "3.6.8-31.el8.alma"
- key: CVE-2020-26116
value:
FixedVersion: "3.6.8-37.el8.alma"

9
pkg/detector/ospkg/alma/testdata/fixtures/invalid.yaml vendored Normal file
View File

@@ -0,0 +1,9 @@
- bucket: alma 8
pairs:
- bucket: jq
pairs:
- key: CVE-2020-8177
value:
FixedVersion:
- foo
- bar

5
pkg/detector/ospkg/detect.go
View File

@@ -8,6 +8,7 @@ import (
fos "github.com/aquasecurity/fanal/analyzer/os"
ftypes "github.com/aquasecurity/fanal/types"
"github.com/aquasecurity/trivy/pkg/detector/ospkg/alma"
"github.com/aquasecurity/trivy/pkg/detector/ospkg/alpine"
"github.com/aquasecurity/trivy/pkg/detector/ospkg/amazon"
"github.com/aquasecurity/trivy/pkg/detector/ospkg/debian"
@@ -63,12 +64,12 @@ func (d Detector) Detect(_, osFamily, osName string, _ time.Time, pkgs []ftypes.
}
// nolint: gocyclo
// TODO: fix cyclometic complexity by removing default
func newDriver(osFamily, osName string) Driver {
// TODO: use DI and change struct names
switch osFamily {
case fos.Alpine:
return alpine.NewScanner()
case fos.Alma:
return alma.NewScanner()
case fos.Debian:
return debian.NewScanner()
case fos.Ubuntu:

2
pkg/report/template.go
View File

@@ -105,7 +105,7 @@ func toSarifRuleName(vulnerabilityType string) string {
case vulnerability.Ubuntu, vulnerability.Alpine, vulnerability.RedHat, vulnerability.RedHatOVAL,
vulnerability.Debian, vulnerability.DebianOVAL, vulnerability.Fedora, vulnerability.Amazon,
vulnerability.OracleOVAL, vulnerability.SuseCVRF, vulnerability.OpenSuseCVRF, vulnerability.Photon,
vulnerability.CentOS:
vulnerability.CentOS, vulnerability.Alma:
return "OsPackageVulnerability"
case "npm", "yarn", "nuget", "pipenv", "poetry", "bundler", "cargo", "composer":
return "ProgrammingLanguageVulnerability"

4
pkg/report/writer_internal_test.go
View File

@@ -64,6 +64,10 @@ func TestReportWriter_toSarifRuleName(t *testing.T) {
vulnerabilityType: vulnerability.CentOS,
sarifRuleName: "OsPackageVulnerability",
},
{
vulnerabilityType: vulnerability.Alma,
sarifRuleName: "OsPackageVulnerability",
},
{
vulnerabilityType: "npm",
sarifRuleName: "ProgrammingLanguageVulnerability",

2
pkg/result/result.go
View File

@@ -94,7 +94,7 @@ func (c Client) detectSource(reportType string) []string {
switch reportType {
case vulnerability.Ubuntu, vulnerability.Alpine, vulnerability.RedHat, vulnerability.RedHatOVAL,
vulnerability.Debian, vulnerability.DebianOVAL, vulnerability.Fedora, vulnerability.Amazon,
vulnerability.OracleOVAL, vulnerability.SuseCVRF, vulnerability.OpenSuseCVRF, vulnerability.Photon:
vulnerability.OracleOVAL, vulnerability.SuseCVRF, vulnerability.OpenSuseCVRF, vulnerability.Photon, vulnerability.Alma:
sources = []string{reportType}
case vulnerability.CentOS: // CentOS doesn't have its own so we use RedHat
sources = []string{vulnerability.RedHat}