Skip to content

Commit 174c1b4

Browse files
willmurphyscodewagoodman
willmurphyscode
and
wagoodman
authored
Add support for RedHat EUS data (#796)
* wip: rhel eus support Signed-off-by: Will Murphy <[email protected]> * add tests Signed-off-by: Alex Goodman <[email protected]> * remove comment Signed-off-by: Alex Goodman <[email protected]> --------- Signed-off-by: Will Murphy <[email protected]> Signed-off-by: Alex Goodman <[email protected]> Co-authored-by: Alex Goodman <[email protected]>
1 parent 30cba0a commit 174c1b4

File tree

9 files changed

+802
-20
lines changed

9 files changed

+802
-20
lines changed

‎src/vunnel/providers/rhel/parser.py

Lines changed: 25 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
class Parser:
3838
__cve_rhel_product_name_base__ = "Red Hat Enterprise Linux"
3939
__rhel_release_pattern__ = re.compile(__cve_rhel_product_name_base__ + r"\s*(\d+)$")
40+
__rhel_eus_pattern__ = re.compile(r"Red Hat Enterprise Linux (\d+\.\d+) Extended Update Support")
4041
__summary_url__ = "https://access.redhat.com/hydra/rest/securitydata/cve.json"
4142
__rhsa_url__ = "https://access.redhat.com/hydra/rest/securitydata/oval/{}.json"
4243
__last_synced_filename__ = "last_synced"
@@ -410,15 +411,8 @@ def _parse_affected_release(self, cve_id: str, content) -> list[FixedIn]: # noq
410411
# first pass to just parse affected releases and construct a list of objects
411412
for item in ars:
412413
try:
413-
match = re.match(
414-
self.__rhel_release_pattern__,
415-
item.get("product_name", None),
416-
)
417-
if not match:
418-
continue
419-
420-
platform = match.group(1)
421-
if not platform: # track even deny-listed platforms here, filter them out later
414+
platform = self._parse_platform(item.get("product_name", None))
415+
if not platform:
422416
continue
423417

424418
ar_obj = AffectedRelease(platform=platform)
@@ -572,21 +566,14 @@ def _parse_package_name_and_module(self, item: dict) -> tuple[str | None, str |
572566

573567
return package_name, module
574568

575-
def _parse_package_state(self, cve_id: str, content) -> list[FixedIn]: # noqa: C901
569+
def _parse_package_state(self, cve_id: str, content) -> list[FixedIn]:
576570
affected: list[FixedIn] = []
577571
out_of_support: list[FixedIn] = [] # Track items out of support to be able to add them if others are affected
578572
pss = content.get("package_state", [])
579573

580574
for item in pss:
581575
try:
582-
match = re.match(
583-
Parser.__rhel_release_pattern__,
584-
item.get("product_name", None),
585-
)
586-
if not match:
587-
continue
588-
589-
platform = match.group(1)
576+
platform = self._parse_platform(item.get("product_name", None))
590577
if not platform or f"{namespace}:{platform}" in self.skip_namespaces:
591578
continue
592579

@@ -645,6 +632,26 @@ def _parse_package_state(self, cve_id: str, content) -> list[FixedIn]: # noqa:
645632

646633
return affected + out_of_support
647634

635+
def _parse_platform(self, product_name: str | None) -> str | None:
636+
is_eus = False
637+
match = re.match(
638+
self.__rhel_release_pattern__,
639+
product_name,
640+
)
641+
if not match:
642+
match = re.match(
643+
self.__rhel_eus_pattern__,
644+
product_name,
645+
)
646+
if not match:
647+
return None
648+
is_eus = True
649+
650+
platform = match.group(1)
651+
if platform and is_eus:
652+
platform = f"{platform}+eus"
653+
return platform
654+
648655
def _parse_cvss3(self, cvss3: dict | None) -> RHELCVSS3 | None:
649656
if not cvss3:
650657
return None

‎src/vunnel/utils/csaf_types.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -301,7 +301,7 @@ class Document(OmitNoneORJSONModel):
301301
class CSAFDoc(OmitNoneORJSONModel):
302302
document: Document
303303
product_tree: ProductTree
304-
vulnerabilities: list[Vulnerability]
304+
vulnerabilities: list[Vulnerability] = field(default_factory=list)
305305

306306

307307
def from_path(path: str) -> CSAFDoc:

‎tests/unit/providers/rhel/test-fixtures/snapshots/rhel:8.6+eus/cve-2023-4863.json

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"identifier": "rhel:8.6+eus/cve-2023-4863",
3+
"item": {
4+
"Vulnerability": {
5+
"CVSS": [
6+
{
7+
"base_metrics": {
8+
"base_score": 9.6,
9+
"base_severity": "Critical",
10+
"exploitability_score": 2.8,
11+
"impact_score": 6.0
12+
},
13+
"status": "verified",
14+
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
15+
"version": "3.1"
16+
}
17+
],
18+
"Description": "A heap-based buffer flaw was found in the way libwebp, a library used to process \"WebP\" image format data, processes certain specially formatted WebP images. An attacker could use this flaw to crash or execute remotely arbitrary code in an application such as a web browser compiled with this library.",
19+
"FixedIn": [
20+
{
21+
"Module": null,
22+
"Name": "libwebp",
23+
"NamespaceName": "rhel:8.6+eus",
24+
"VendorAdvisory": {
25+
"AdvisorySummary": [
26+
{
27+
"ID": "RHSA-2023:5189",
28+
"Link": "https://access.redhat.com/errata/RHSA-2023:5189"
29+
}
30+
],
31+
"NoAdvisory": false
32+
},
33+
"Version": "0:1.0.0-7.el8_6.1",
34+
"VersionFormat": "rpm"
35+
},
36+
{
37+
"Module": null,
38+
"Name": "firefox",
39+
"NamespaceName": "rhel:8.6+eus",
40+
"VendorAdvisory": {
41+
"AdvisorySummary": [
42+
{
43+
"ID": "RHSA-2023:5198",
44+
"Link": "https://access.redhat.com/errata/RHSA-2023:5198"
45+
}
46+
],
47+
"NoAdvisory": false
48+
},
49+
"Version": "0:102.15.1-1.el8_6",
50+
"VersionFormat": "rpm"
51+
},
52+
{
53+
"Module": null,
54+
"Name": "thunderbird",
55+
"NamespaceName": "rhel:8.6+eus",
56+
"VendorAdvisory": {
57+
"AdvisorySummary": [
58+
{
59+
"ID": "RHSA-2023:5202",
60+
"Link": "https://access.redhat.com/errata/RHSA-2023:5202"
61+
}
62+
],
63+
"NoAdvisory": false
64+
},
65+
"Version": "0:102.15.1-1.el8_6",
66+
"VersionFormat": "rpm"
67+
}
68+
],
69+
"Link": "https://access.redhat.com/security/cve/CVE-2023-4863",
70+
"Metadata": {},
71+
"Name": "CVE-2023-4863",
72+
"NamespaceName": "rhel:8.6+eus",
73+
"Severity": "High"
74+
}
75+
},
76+
"schema": "https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.2.json"
77+
}

‎tests/unit/providers/rhel/test-fixtures/snapshots/rhel:8.6+eus/cve-2023-5129.json

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"identifier": "rhel:8.6+eus/cve-2023-5129",
3+
"item": {
4+
"Vulnerability": {
5+
"CVSS": [
6+
{
7+
"base_metrics": {
8+
"base_score": 0.0,
9+
"base_severity": "None",
10+
"exploitability_score": 2.8,
11+
"impact_score": -0.2
12+
},
13+
"status": "verified",
14+
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N",
15+
"version": "3.1"
16+
}
17+
],
18+
"Description": "This CVE ID has been rejected by its CVE Numbering Authority. Duplicate of CVE-2023-4863.",
19+
"FixedIn": [
20+
{
21+
"Module": null,
22+
"Name": "libwebp",
23+
"NamespaceName": "rhel:8.6+eus",
24+
"VendorAdvisory": {
25+
"AdvisorySummary": [
26+
{
27+
"ID": "RHSA-2023:5189",
28+
"Link": "https://access.redhat.com/errata/RHSA-2023:5189"
29+
}
30+
],
31+
"NoAdvisory": false
32+
},
33+
"Version": "0:1.0.0-7.el8_6.1",
34+
"VersionFormat": "rpm"
35+
},
36+
{
37+
"Module": null,
38+
"Name": "firefox",
39+
"NamespaceName": "rhel:8.6+eus",
40+
"VendorAdvisory": {
41+
"AdvisorySummary": [
42+
{
43+
"ID": "RHSA-2023:5198",
44+
"Link": "https://access.redhat.com/errata/RHSA-2023:5198"
45+
}
46+
],
47+
"NoAdvisory": false
48+
},
49+
"Version": "0:102.15.1-1.el8_6",
50+
"VersionFormat": "rpm"
51+
},
52+
{
53+
"Module": null,
54+
"Name": "thunderbird",
55+
"NamespaceName": "rhel:8.6+eus",
56+
"VendorAdvisory": {
57+
"AdvisorySummary": [
58+
{
59+
"ID": "RHSA-2023:5202",
60+
"Link": "https://access.redhat.com/errata/RHSA-2023:5202"
61+
}
62+
],
63+
"NoAdvisory": false
64+
},
65+
"Version": "0:102.15.1-1.el8_6",
66+
"VersionFormat": "rpm"
67+
}
68+
],
69+
"Link": "https://access.redhat.com/security/cve/CVE-2023-5129",
70+
"Metadata": {},
71+
"Name": "CVE-2023-5129",
72+
"NamespaceName": "rhel:8.6+eus",
73+
"Severity": "Unknown"
74+
}
75+
},
76+
"schema": "https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.2.json"
77+
}

‎tests/unit/providers/rhel/test-fixtures/snapshots/rhel:8.6+eus/cve-2023-5217.json

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"identifier": "rhel:8.6+eus/cve-2023-5217",
3+
"item": {
4+
"Vulnerability": {
5+
"CVSS": [
6+
{
7+
"base_metrics": {
8+
"base_score": 8.8,
9+
"base_severity": "High",
10+
"exploitability_score": 2.8,
11+
"impact_score": 5.9
12+
},
13+
"status": "verified",
14+
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
15+
"version": "3.1"
16+
}
17+
],
18+
"Description": "A heap-based buffer overflow flaw was found in the way libvpx, a library used to process VP8 and VP9 video codecs data, processes certain specially formatted video data via a crafted HTML page. This flaw allows an attacker to crash or remotely execute arbitrary code in an application, such as a web browser that is compiled with this library.",
19+
"FixedIn": [
20+
{
21+
"Module": null,
22+
"Name": "thunderbird",
23+
"NamespaceName": "rhel:8.6+eus",
24+
"VendorAdvisory": {
25+
"AdvisorySummary": [
26+
{
27+
"ID": "RHSA-2023:5430",
28+
"Link": "https://access.redhat.com/errata/RHSA-2023:5430"
29+
}
30+
],
31+
"NoAdvisory": false
32+
},
33+
"Version": "0:115.3.1-1.el8_6",
34+
"VersionFormat": "rpm"
35+
},
36+
{
37+
"Module": null,
38+
"Name": "firefox",
39+
"NamespaceName": "rhel:8.6+eus",
40+
"VendorAdvisory": {
41+
"AdvisorySummary": [
42+
{
43+
"ID": "RHSA-2023:5436",
44+
"Link": "https://access.redhat.com/errata/RHSA-2023:5436"
45+
}
46+
],
47+
"NoAdvisory": false
48+
},
49+
"Version": "0:115.3.1-1.el8_6",
50+
"VersionFormat": "rpm"
51+
},
52+
{
53+
"Module": null,
54+
"Name": "libvpx",
55+
"NamespaceName": "rhel:8.6+eus",
56+
"VendorAdvisory": {
57+
"AdvisorySummary": [
58+
{
59+
"ID": "RHSA-2023:5538",
60+
"Link": "https://access.redhat.com/errata/RHSA-2023:5538"
61+
}
62+
],
63+
"NoAdvisory": false
64+
},
65+
"Version": "0:1.7.0-10.el8_6",
66+
"VersionFormat": "rpm"
67+
}
68+
],
69+
"Link": "https://access.redhat.com/security/cve/CVE-2023-5217",
70+
"Metadata": {},
71+
"Name": "CVE-2023-5217",
72+
"NamespaceName": "rhel:8.6+eus",
73+
"Severity": "High"
74+
}
75+
},
76+
"schema": "https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.2.json"
77+
}

‎tests/unit/providers/rhel/test-fixtures/snapshots/rhel:9.0+eus/cve-2023-4863.json

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"identifier": "rhel:9.0+eus/cve-2023-4863",
3+
"item": {
4+
"Vulnerability": {
5+
"CVSS": [
6+
{
7+
"base_metrics": {
8+
"base_score": 9.6,
9+
"base_severity": "Critical",
10+
"exploitability_score": 2.8,
11+
"impact_score": 6.0
12+
},
13+
"status": "verified",
14+
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
15+
"version": "3.1"
16+
}
17+
],
18+
"Description": "A heap-based buffer flaw was found in the way libwebp, a library used to process \"WebP\" image format data, processes certain specially formatted WebP images. An attacker could use this flaw to crash or execute remotely arbitrary code in an application such as a web browser compiled with this library.",
19+
"FixedIn": [
20+
{
21+
"Module": null,
22+
"Name": "libwebp",
23+
"NamespaceName": "rhel:9.0+eus",
24+
"VendorAdvisory": {
25+
"AdvisorySummary": [
26+
{
27+
"ID": "RHSA-2023:5204",
28+
"Link": "https://access.redhat.com/errata/RHSA-2023:5204"
29+
}
30+
],
31+
"NoAdvisory": false
32+
},
33+
"Version": "0:1.2.0-6.el9_0",
34+
"VersionFormat": "rpm"
35+
},
36+
{
37+
"Module": null,
38+
"Name": "firefox",
39+
"NamespaceName": "rhel:9.0+eus",
40+
"VendorAdvisory": {
41+
"AdvisorySummary": [
42+
{
43+
"ID": "RHSA-2023:5205",
44+
"Link": "https://access.redhat.com/errata/RHSA-2023:5205"
45+
}
46+
],
47+
"NoAdvisory": false
48+
},
49+
"Version": "0:102.15.1-1.el9_0",
50+
"VersionFormat": "rpm"
51+
},
52+
{
53+
"Module": null,
54+
"Name": "thunderbird",
55+
"NamespaceName": "rhel:9.0+eus",
56+
"VendorAdvisory": {
57+
"AdvisorySummary": [
58+
{
59+
"ID": "RHSA-2023:5223",
60+
"Link": "https://access.redhat.com/errata/RHSA-2023:5223"
61+
}
62+
],
63+
"NoAdvisory": false
64+
},
65+
"Version": "0:102.15.1-1.el9_0",
66+
"VersionFormat": "rpm"
67+
}
68+
],
69+
"Link": "https://access.redhat.com/security/cve/CVE-2023-4863",
70+
"Metadata": {},
71+
"Name": "CVE-2023-4863",
72+
"NamespaceName": "rhel:9.0+eus",
73+
"Severity": "High"
74+
}
75+
},
76+
"schema": "https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.2.json"
77+
}

0 commit comments

Comments
 (0)