diff --git a/tests/unit/providers/mariner/test-fixtures/azure-linux-truncated-3.0-oval.xml b/tests/unit/providers/mariner/test-fixtures/azure-linux-truncated-3.0-oval.xml new file mode 100644 index 00000000..eeb10a48 --- /dev/null +++ b/tests/unit/providers/mariner/test-fixtures/azure-linux-truncated-3.0-oval.xml @@ -0,0 +1,98 @@ + + + Azure Linux OVAL Definition Generator + 17 + 5.11 + 2024-05-08T12:04:07.046098262Z + 1715169847 + + + + + CVE-2024-24258 affecting package freeglut for versions less than 3.4.0-1 + + Azure Linux + + + true + 2024-04-17T22:02:46Z + 39708-1 + High + CVE-2024-24258 affecting package freeglut for versions less than 3.4.0-1. A patched version of the package is available. + + + + + + + + CVE-2024-24259 affecting package freeglut for versions less than 3.4.0-1 + + Azure Linux + + + true + 2024-04-17T22:02:46Z + 39694-1 + High + CVE-2024-24259 affecting package freeglut for versions less than 3.4.0-1. A patched version of the package is available. + + + + + + + + CVE-2020-27304 affecting package ceph for versions less than 18.2.1-1 + + Azure Linux + + + true + 2024-04-17T22:02:46Z + 39076-1 + Critical + CVE-2020-27304 affecting package ceph for versions less than 18.2.1-1. An upgraded version of the package is available that resolves this issue. + + + + + + + + + + + + + + + + + + + + + + + freeglut + + + freeglut + + + ceph + + + + + 0:3.4.0-1.azl3 + + + 0:3.4.0-1.azl3 + + + 0:18.2.1-1.azl3 + + + diff --git a/tests/unit/providers/mariner/test_mariner.py b/tests/unit/providers/mariner/test_mariner.py index 1fd03045..152d79bb 100644 --- a/tests/unit/providers/mariner/test_mariner.py +++ b/tests/unit/providers/mariner/test_mariner.py @@ -8,7 +8,7 @@ from vunnel import result, workspace, utils from vunnel.providers.mariner import Config, Provider, parser from vunnel.providers.mariner.parser import MarinerXmlFile -from vunnel.utils.vulnerability import Vulnerability, FixedIn +from vunnel.utils.vulnerability import Vulnerability, FixedIn, VendorAdvisory @pytest.mark.parametrize( @@ -74,7 +74,69 @@ ], ), ], - ) + ), + ( + "test-fixtures/azure-linux-truncated-3.0-oval.xml", + [ + Vulnerability( + Name="CVE-2024-24258", + NamespaceName="mariner:3.0", + Description="CVE-2024-24258 affecting package freeglut for versions less than 3.4.0-1. A patched version of the package is available.", + Severity="High", + Link="https://nvd.nist.gov/vuln/detail/CVE-2024-24258", + CVSS=[], + FixedIn=[ + FixedIn( + Name="freeglut", + NamespaceName="mariner:3.0", + VersionFormat="rpm", + Version="0:3.4.0-1.azl3", + Module="", + VendorAdvisory=VendorAdvisory(NoAdvisory=False, AdvisorySummary=[]), + ) + ], + Metadata={}, + ), + Vulnerability( + Name="CVE-2024-24259", + NamespaceName="mariner:3.0", + Description="CVE-2024-24259 affecting package freeglut for versions less than 3.4.0-1. A patched version of the package is available.", + Severity="High", + Link="https://nvd.nist.gov/vuln/detail/CVE-2024-24259", + CVSS=[], + FixedIn=[ + FixedIn( + Name="freeglut", + NamespaceName="mariner:3.0", + VersionFormat="rpm", + Version="0:3.4.0-1.azl3", + Module="", + VendorAdvisory=VendorAdvisory(NoAdvisory=False, AdvisorySummary=[]), + ) + ], + Metadata={}, + ), + Vulnerability( + Name="CVE-2020-27304", + NamespaceName="mariner:3.0", + Description="CVE-2020-27304 affecting package ceph for versions less than 18.2.1-1. An upgraded version of the package is available that resolves this issue.", + Severity="Critical", + Link="https://nvd.nist.gov/vuln/detail/CVE-2020-27304", + CVSS=[], + FixedIn=[ + FixedIn( + Name="ceph", + NamespaceName="mariner:3.0", + VersionFormat="rpm", + Version="0:18.2.1-1.azl3", + Module="", + VendorAdvisory=VendorAdvisory(NoAdvisory=False, AdvisorySummary=[]), + ) + ], + Metadata={}, + ), + ], + ), ], ) def test_parse(tmpdir, helpers, input_file, expected):