diff --git a/docs/getting-started/overview.md b/docs/getting-started/overview.md index dc15486d4946..42c5cc379ba8 100644 --- a/docs/getting-started/overview.md +++ b/docs/getting-started/overview.md @@ -22,7 +22,7 @@ See [Integrations][integrations] for details. ## Features - Comprehensive vulnerability detection - - [OS packages][os] (Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless) + - [OS packages][os] (Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, AlmaLinux, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless) - [**Language-specific packages**][lang] (Bundler, Composer, Pipenv, Poetry, npm, yarn, Cargo, NuGet, Maven, and Go) - Detect IaC misconfigurations - A wide variety of [built-in policies][builtin] are provided **out of the box**: diff --git a/docs/vulnerability/detection/data-source.md b/docs/vulnerability/detection/data-source.md index c6b135be4146..45b43ff17933 100644 --- a/docs/vulnerability/detection/data-source.md +++ b/docs/vulnerability/detection/data-source.md @@ -11,6 +11,7 @@ | Ubuntu | [Ubuntu CVE Tracker][ubuntu] | | RHEL/CentOS | [OVAL][rhel-oval] | | | [Security Data][rhel-api] | +| AlmaLinux | [AlmaLinux Product Errata][alma] | | Oracle Linux | [OVAL][oracle] | | OpenSUSE/SLES | [CVRF][suse] | | Photon OS | [Photon Security Advisory][photon] | @@ -51,6 +52,7 @@ [ubuntu]: https://ubuntu.com/security/cve [rhel-oval]: https://www.redhat.com/security/data/oval/v2/ [rhel-api]: https://www.redhat.com/security/data/metrics/ +[alma]: https://errata.almalinux.org/ [oracle]: https://linux.oracle.com/security/oval/ [suse]: http://ftp.suse.com/pub/projects/security/cvrf/ [photon]: https://packages.vmware.com/photon/photon_cve_metadata/ diff --git a/docs/vulnerability/detection/os.md b/docs/vulnerability/detection/os.md index 0cd8e13136f6..683f34a6efd1 100644 --- a/docs/vulnerability/detection/os.md +++ b/docs/vulnerability/detection/os.md @@ -8,6 +8,7 @@ The unfixed/unfixable vulnerabilities mean that the patch has not yet been provi | Red Hat Universal Base Image[^1] | 7, 8 | Installed by yum/rpm | YES | | Red Hat Enterprise Linux | 6, 7, 8 | Installed by yum/rpm | YES | | CentOS | 6, 7 | Installed by yum/rpm | YES | +| AlmaLinux | 8 | Installed by yum/rpm | NO | | Oracle Linux | 5, 6, 7, 8 | Installed by yum/rpm | NO | | Amazon Linux | 1, 2 | Installed by yum/rpm | NO | | openSUSE Leap | 42, 15 | Installed by zypper/rpm | NO | diff --git a/go.mod b/go.mod index a44873083216..1184305ee4f3 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798 github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46 github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 - github.com/aquasecurity/trivy-db v0.0.0-20220104200459-525690bf08ef + github.com/aquasecurity/trivy-db v0.0.0-20220105133155-dcbb8819ac5e github.com/caarlos0/env/v6 v6.0.0 github.com/cenkalti/backoff v2.2.1+incompatible github.com/cheggaaa/pb/v3 v3.0.3 diff --git a/go.sum b/go.sum index 91310febf52b..7a579df863e8 100644 --- a/go.sum +++ b/go.sum @@ -239,8 +239,8 @@ github.com/aquasecurity/testdocker v0.0.0-20210911155206-e1e85f5a1516 h1:moQmzbp github.com/aquasecurity/testdocker v0.0.0-20210911155206-e1e85f5a1516/go.mod h1:gTd97VdQ0rg8Mkiic3rPgNOQdprZ7feTAhiD5mGQjgM= github.com/aquasecurity/tfsec v0.63.1 h1:KH63HTcUoab7d3PKtqFO6T8K5AY7bzLw7Kiu+EY9U64= github.com/aquasecurity/tfsec v0.63.1/go.mod h1:g5ZWmsfqW1FsCaPb9ux8Pzjcyss/WUB2XuRd5slqvnc= -github.com/aquasecurity/trivy-db v0.0.0-20220104200459-525690bf08ef h1:E8ihL2Rh5aceXzexoCgKQVFzWQUQ56TwtITEOu4IuNE= -github.com/aquasecurity/trivy-db v0.0.0-20220104200459-525690bf08ef/go.mod h1:nT/y6Nbo7KDfRhezh3uE8nLNV5R13mGw34j6E8htL+o= +github.com/aquasecurity/trivy-db v0.0.0-20220105133155-dcbb8819ac5e h1:XcBTuz3pjg8509hIUxl0OEgtxyYSsc/siYN0TEY0hRc= +github.com/aquasecurity/trivy-db v0.0.0-20220105133155-dcbb8819ac5e/go.mod h1:rnojVJTK+RySsfLW7xMqmQRSjQpm5fEjS+/N4kf3fcc= github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o= github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY= @@ -780,7 +780,6 @@ github.com/google/go-containerregistry v0.7.1-0.20211214010025-a65b7844a475 h1:d github.com/google/go-containerregistry v0.7.1-0.20211214010025-a65b7844a475/go.mod h1:IwJblnDNiCs8sxubbfPNniYsUqr8m+nt7YbPzecsGuE= github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ= github.com/google/go-github/v28 v28.1.1/go.mod h1:bsqJWQX05omyWVmc00nEUql9mhQyv38lDZ8kPZcQVoM= -github.com/google/go-github/v38 v38.1.0/go.mod h1:cStvrz/7nFr0FoENgG6GLbp53WaelXucT+BBz/3VKx4= github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck= github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU= github.com/google/go-replayers/grpcreplay v0.1.0/go.mod h1:8Ig2Idjpr6gifRd6pNVggX6TC1Zw6Jx74AKp7QNH2QE= diff --git a/integration/client_server_test.go b/integration/client_server_test.go index afee4573ffa6..3c65dc50a672 100644 --- a/integration/client_server_test.go +++ b/integration/client_server_test.go @@ -141,6 +141,13 @@ func TestClientServer(t *testing.T) { // }, // golden: "testdata/ubi-7.json.golden", //}, + { + name: "almalinux 8", + args: csArgs{ + Input: "testdata/fixtures/images/almalinux-8.tar.gz", + }, + golden: "testdata/almalinux-8.json.golden", + }, { name: "distroless base", args: csArgs{ diff --git a/integration/docker_engine_test.go b/integration/docker_engine_test.go index 172640aeb3f7..cf1a11a1412b 100644 --- a/integration/docker_engine_test.go +++ b/integration/docker_engine_test.go @@ -103,6 +103,12 @@ func TestDockerEngine(t *testing.T) { // wantOutputFile: "testdata/ubi-7.json.golden", // testfile: "testdata/fixtures/images/ubi-7.tar.gz", //}, + { + name: "almalinux 8", + imageTag: "almalinux:8", + wantOutputFile: "testdata/almalinux-8.json.golden", + testfile: "testdata/fixtures/images/almalinux-8.tar.gz", + }, { name: "debian buster/10", imageTag: "debian:buster", diff --git a/integration/standalone_tar_test.go b/integration/standalone_tar_test.go index 3094747fddb6..ba79943a4c2e 100644 --- a/integration/standalone_tar_test.go +++ b/integration/standalone_tar_test.go @@ -173,6 +173,14 @@ func TestTar(t *testing.T) { // }, // golden: "testdata/ubi-7.json.golden", //}, + { + name: "almalinux 8", + testArgs: args{ + Format: "json", + Input: "testdata/fixtures/images/almalinux-8.tar.gz", + }, + golden: "testdata/almalinux-8.json.golden", + }, { name: "distroless base", testArgs: args{ diff --git a/integration/testdata/almalinux-8.json.golden b/integration/testdata/almalinux-8.json.golden new file mode 100644 index 000000000000..5ae4f991cff0 --- /dev/null +++ b/integration/testdata/almalinux-8.json.golden @@ -0,0 +1,112 @@ +{ + "SchemaVersion": 2, + "ArtifactName": "testdata/fixtures/images/almalinux-8.tar.gz", + "ArtifactType": "container_image", + "Metadata": { + "OS": { + "Family": "alma", + "Name": "8.5" + }, + "ImageID": "sha256:4ca63ce1d8a90da2ed4f2d5e93e8e9db2f32d0fabf0718a2edebbe0e70826622", + "DiffIDs": [ + "sha256:124d41c237c5e823577dda97e87cebaecce62d585c725d07e709ce410681de4d" + ], + "ImageConfig": { + "architecture": "amd64", + "container": "a467f67a48d469e1975b7414f33f2cf87121d4cc59d2ee029ea58e6b81774769", + "created": "2021-11-13T12:10:27.09871973Z", + "docker_version": "20.10.7", + "history": [ + { + "created": "2021-11-13T12:10:26.29818864Z", + "created_by": "/bin/sh -c #(nop) ADD file:2e002305ccb9d8a4dcef52509c4c50b9a15e76c9c49ca6abda3e0d7091c63fa7 in / " + }, + { + "created": "2021-11-13T12:10:27.09871973Z", + "created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]", + "empty_layer": true + } + ], + "os": "linux", + "rootfs": { + "type": "layers", + "diff_ids": [ + "sha256:124d41c237c5e823577dda97e87cebaecce62d585c725d07e709ce410681de4d" + ] + }, + "config": { + "Cmd": [ + "/bin/bash" + ], + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + ], + "Image": "sha256:d38d2eac03bc19e080df596d6148863a0f8293f3a277a7524f378da79a1feb0f" + } + } + }, + "Results": [ + { + "Target": "testdata/fixtures/images/almalinux-8.tar.gz (alma 8.5)", + "Class": "os-pkgs", + "Type": "alma", + "Vulnerabilities": [ + { + "VulnerabilityID": "CVE-2021-3712", + "PkgName": "openssl-libs", + "InstalledVersion": "1:1.1.1k-4.el8", + "FixedVersion": "1:1.1.1k-5.el8_5", + "Layer": { + "DiffID": "sha256:124d41c237c5e823577dda97e87cebaecce62d585c725d07e709ce410681de4d" + }, + "SeveritySource": "alma", + "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-3712", + "Title": "openssl: Read buffer overruns processing ASN.1 strings", + "Description": "ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).", + "Severity": "MEDIUM", + "CweIDs": [ + "CWE-125" + ], + "CVSS": { + "nvd": { + "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P", + "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", + "V2Score": 5.8, + "V3Score": 7.4 + }, + "redhat": { + "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", + "V3Score": 7.4 + } + }, + "References": [ + "http://www.openwall.com/lists/oss-security/2021/08/26/2", + "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=94d23fcff9b2a7a8368dfe52214d5c2569882c11", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ccb0a11145ee72b042d10593a64eaf9e8a55ec12", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366", + "https://linux.oracle.com/cve/CVE-2021-3712.html", + "https://linux.oracle.com/errata/ELSA-2021-9632.html", + "https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e@%3Cdev.tomcat.apache.org%3E", + "https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1@%3Cdev.tomcat.apache.org%3E", + "https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html", + "https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html", + "https://security.netapp.com/advisory/ntap-20210827-0010/", + "https://ubuntu.com/security/notices/USN-5051-1", + "https://ubuntu.com/security/notices/USN-5051-2", + "https://ubuntu.com/security/notices/USN-5051-3", + "https://ubuntu.com/security/notices/USN-5051-4 (regression only in trusty/esm)", + "https://ubuntu.com/security/notices/USN-5088-1", + "https://www.debian.org/security/2021/dsa-4963", + "https://www.openssl.org/news/secadv/20210824.txt", + "https://www.oracle.com/security-alerts/cpuoct2021.html", + "https://www.tenable.com/security/tns-2021-16", + "https://www.tenable.com/security/tns-2022-02" + ], + "PublishedDate": "2021-08-24T15:15:00Z", + "LastModifiedDate": "2022-01-06T09:15:00Z" + } + ] + } + ] +} \ No newline at end of file diff --git a/integration/testdata/alpine-310-registry.json.golden b/integration/testdata/alpine-310-registry.json.golden index 12c81d14d7fd..db0e818f3bf3 100644 --- a/integration/testdata/alpine-310-registry.json.golden +++ b/integration/testdata/alpine-310-registry.json.golden @@ -89,7 +89,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -145,7 +144,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -175,7 +173,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1549", @@ -207,7 +205,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -263,7 +260,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -293,7 +289,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" } ] } diff --git a/integration/testdata/alpine-310.gitlab.golden b/integration/testdata/alpine-310.gitlab.golden index 0e25ab417aab..5383831e48ef 100644 --- a/integration/testdata/alpine-310.gitlab.golden +++ b/integration/testdata/alpine-310.gitlab.golden @@ -33,8 +33,6 @@ } ], "links": [{ - "url": "https://access.redhat.com/security/cve/CVE-2019-1549" - },{ "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549" },{ "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be" @@ -110,8 +108,6 @@ "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html" },{ "url": "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html" - },{ - "url": "https://access.redhat.com/security/cve/CVE-2019-1551" },{ "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551" },{ @@ -201,8 +197,6 @@ } ], "links": [{ - "url": "https://access.redhat.com/security/cve/CVE-2019-1549" - },{ "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549" },{ "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be" @@ -278,8 +272,6 @@ "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html" },{ "url": "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html" - },{ - "url": "https://access.redhat.com/security/cve/CVE-2019-1551" },{ "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551" },{ diff --git a/integration/testdata/alpine-310.html.golden b/integration/testdata/alpine-310.html.golden index 9fc315955c04..a89206ac3fb2 100644 --- a/integration/testdata/alpine-310.html.golden +++ b/integration/testdata/alpine-310.html.golden @@ -99,7 +99,6 @@ 1.1.1c-r0 1.1.1d-r0 - https://access.redhat.com/security/cve/CVE-2019-1549 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be https://linux.oracle.com/cve/CVE-2019-1549.html @@ -130,7 +129,6 @@ http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html - https://access.redhat.com/security/cve/CVE-2019-1551 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98 @@ -167,7 +165,6 @@ 1.1.1c-r0 1.1.1d-r0 - https://access.redhat.com/security/cve/CVE-2019-1549 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be https://linux.oracle.com/cve/CVE-2019-1549.html @@ -198,7 +195,6 @@ http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html - https://access.redhat.com/security/cve/CVE-2019-1551 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98 diff --git a/integration/testdata/alpine-310.json.golden b/integration/testdata/alpine-310.json.golden index 32a15278c7b5..663cdd36bd72 100644 --- a/integration/testdata/alpine-310.json.golden +++ b/integration/testdata/alpine-310.json.golden @@ -82,7 +82,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -137,7 +136,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -167,7 +165,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1549", @@ -198,7 +196,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -253,7 +250,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -283,7 +279,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" } ] } diff --git a/integration/testdata/alpine-39-ignore-cveids.json.golden b/integration/testdata/alpine-39-ignore-cveids.json.golden index 857f7da01a23..daa364b14486 100644 --- a/integration/testdata/alpine-39-ignore-cveids.json.golden +++ b/integration/testdata/alpine-39-ignore-cveids.json.golden @@ -84,7 +84,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -114,7 +113,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1551", @@ -147,7 +146,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -177,7 +175,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" } ] } diff --git a/integration/testdata/alpine-39.json.golden b/integration/testdata/alpine-39.json.golden index 92de08d8b6ed..e7e8033ace4e 100644 --- a/integration/testdata/alpine-39.json.golden +++ b/integration/testdata/alpine-39.json.golden @@ -82,7 +82,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -137,7 +136,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -167,7 +165,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1549", @@ -198,7 +196,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-1549", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be", "https://linux.oracle.com/cve/CVE-2019-1549.html", @@ -253,7 +250,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -283,7 +279,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-14697", diff --git a/integration/testdata/amazon-1.json.golden b/integration/testdata/amazon-1.json.golden index 2d99632c3cd6..549edb6b2c2a 100644 --- a/integration/testdata/amazon-1.json.golden +++ b/integration/testdata/amazon-1.json.golden @@ -83,7 +83,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html", - "https://access.redhat.com/security/cve/CVE-2019-5481", "https://curl.haxx.se/docs/CVE-2019-5481.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481", "https://linux.oracle.com/cve/CVE-2019-5481.html", diff --git a/integration/testdata/amazon-2.json.golden b/integration/testdata/amazon-2.json.golden index 9cb17f6aa5c5..2f9b8501caae 100644 --- a/integration/testdata/amazon-2.json.golden +++ b/integration/testdata/amazon-2.json.golden @@ -83,7 +83,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html", - "https://access.redhat.com/security/cve/CVE-2019-5481", "https://curl.haxx.se/docs/CVE-2019-5481.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481", "https://linux.oracle.com/cve/CVE-2019-5481.html", @@ -135,7 +134,6 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html", "http://www.openwall.com/lists/oss-security/2019/09/11/6", - "https://access.redhat.com/security/cve/CVE-2019-5436", "https://curl.haxx.se/docs/CVE-2019-5436.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436", "https://linux.oracle.com/cve/CVE-2019-5436.html", diff --git a/integration/testdata/debian-buster-ignore-unfixed.json.golden b/integration/testdata/debian-buster-ignore-unfixed.json.golden index fdf2a92ad954..6fd4bd671a75 100644 --- a/integration/testdata/debian-buster-ignore-unfixed.json.golden +++ b/integration/testdata/debian-buster-ignore-unfixed.json.golden @@ -86,7 +86,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html", - "https://access.redhat.com/security/cve/CVE-2019-18224", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224", "https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c", diff --git a/integration/testdata/debian-buster.json.golden b/integration/testdata/debian-buster.json.golden index 0521481e7947..880338543936 100644 --- a/integration/testdata/debian-buster.json.golden +++ b/integration/testdata/debian-buster.json.golden @@ -81,7 +81,6 @@ }, "References": [ "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html", - "https://access.redhat.com/security/cve/CVE-2019-18276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276", "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff", "https://linux.oracle.com/cve/CVE-2019-18276.html", @@ -128,7 +127,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html", - "https://access.redhat.com/security/cve/CVE-2019-18224", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224", "https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c", diff --git a/integration/testdata/debian-stretch.json.golden b/integration/testdata/debian-stretch.json.golden index 1a06964d7c0b..449e7d360cf9 100644 --- a/integration/testdata/debian-stretch.json.golden +++ b/integration/testdata/debian-stretch.json.golden @@ -81,7 +81,6 @@ }, "References": [ "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html", - "https://access.redhat.com/security/cve/CVE-2019-18276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276", "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff", "https://linux.oracle.com/cve/CVE-2019-18276.html", @@ -126,7 +125,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -178,7 +176,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -230,7 +227,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -282,7 +278,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", diff --git a/integration/testdata/distroless-base.json.golden b/integration/testdata/distroless-base.json.golden index 0e1161543574..67362e83b0da 100644 --- a/integration/testdata/distroless-base.json.golden +++ b/integration/testdata/distroless-base.json.golden @@ -80,7 +80,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -110,7 +109,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1563", @@ -129,7 +128,8 @@ "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "Severity": "LOW", "CweIDs": [ - "CWE-311" + "CWE-327", + "CWE-203" ], "CVSS": { "nvd": { @@ -149,11 +149,11 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html", "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://linux.oracle.com/cve/CVE-2019-1563.html", "https://linux.oracle.com/errata/ELSA-2020-1840.html", "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html", @@ -182,7 +182,7 @@ "https://www.tenable.com/security/tns-2019-09" ], "PublishedDate": "2019-09-10T17:15:00Z", - "LastModifiedDate": "2020-10-20T22:15:00Z" + "LastModifiedDate": "2021-07-31T08:15:00Z" }, { "VulnerabilityID": "CVE-2019-1551", @@ -214,7 +214,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -244,7 +243,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1563", @@ -263,7 +262,8 @@ "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "Severity": "LOW", "CweIDs": [ - "CWE-311" + "CWE-327", + "CWE-203" ], "CVSS": { "nvd": { @@ -283,11 +283,11 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html", "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://linux.oracle.com/cve/CVE-2019-1563.html", "https://linux.oracle.com/errata/ELSA-2020-1840.html", "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html", @@ -316,7 +316,7 @@ "https://www.tenable.com/security/tns-2019-09" ], "PublishedDate": "2019-09-10T17:15:00Z", - "LastModifiedDate": "2020-10-20T22:15:00Z" + "LastModifiedDate": "2021-07-31T08:15:00Z" } ] } diff --git a/integration/testdata/distroless-python27.json.golden b/integration/testdata/distroless-python27.json.golden index 746cd0304400..7d58cd4760d5 100644 --- a/integration/testdata/distroless-python27.json.golden +++ b/integration/testdata/distroless-python27.json.golden @@ -97,7 +97,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -127,7 +126,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1563", @@ -146,7 +145,8 @@ "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "Severity": "LOW", "CweIDs": [ - "CWE-311" + "CWE-327", + "CWE-203" ], "CVSS": { "nvd": { @@ -166,11 +166,11 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html", "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://linux.oracle.com/cve/CVE-2019-1563.html", "https://linux.oracle.com/errata/ELSA-2020-1840.html", "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html", @@ -199,7 +199,7 @@ "https://www.tenable.com/security/tns-2019-09" ], "PublishedDate": "2019-09-10T17:15:00Z", - "LastModifiedDate": "2020-10-20T22:15:00Z" + "LastModifiedDate": "2021-07-31T08:15:00Z" }, { "VulnerabilityID": "CVE-2019-1551", @@ -231,7 +231,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html", "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1551", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98", @@ -261,7 +260,7 @@ "https://www.tenable.com/security/tns-2021-10" ], "PublishedDate": "2019-12-06T18:15:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-07-21T11:39:00Z" }, { "VulnerabilityID": "CVE-2019-1563", @@ -280,7 +279,8 @@ "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).", "Severity": "LOW", "CweIDs": [ - "CWE-311" + "CWE-327", + "CWE-203" ], "CVSS": { "nvd": { @@ -300,11 +300,11 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html", "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html", - "https://access.redhat.com/security/cve/CVE-2019-1563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f", + "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://linux.oracle.com/cve/CVE-2019-1563.html", "https://linux.oracle.com/errata/ELSA-2020-1840.html", "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html", @@ -333,7 +333,7 @@ "https://www.tenable.com/security/tns-2019-09" ], "PublishedDate": "2019-09-10T17:15:00Z", - "LastModifiedDate": "2020-10-20T22:15:00Z" + "LastModifiedDate": "2021-07-31T08:15:00Z" } ] } diff --git a/integration/testdata/dockerfile-custom-policies.json.golden b/integration/testdata/dockerfile-custom-policies.json.golden index 5c398255b867..0e15a4c81dd2 100644 --- a/integration/testdata/dockerfile-custom-policies.json.golden +++ b/integration/testdata/dockerfile-custom-policies.json.golden @@ -33,7 +33,9 @@ "Namespace": "user.bar", "Query": "data.user.bar.deny", "Severity": "UNKNOWN", - "Status": "FAIL" + "Status": "FAIL", + "Layer": {}, + "IacMetadata": {} }, { "Type": "N/A", @@ -43,7 +45,9 @@ "Namespace": "user.foo", "Query": "data.user.foo.deny", "Severity": "UNKNOWN", - "Status": "FAIL" + "Status": "FAIL", + "Layer": {}, + "IacMetadata": {} } ] } diff --git a/integration/testdata/dockerfile.json.golden b/integration/testdata/dockerfile.json.golden index a070b1512225..bc72b632cfac 100644 --- a/integration/testdata/dockerfile.json.golden +++ b/integration/testdata/dockerfile.json.golden @@ -40,7 +40,9 @@ "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://avd.aquasec.com/appshield/ds002" ], - "Status": "FAIL" + "Status": "FAIL", + "Layer": {}, + "IacMetadata": {} } ] } diff --git a/integration/testdata/fixtures/db/almalinux.yaml b/integration/testdata/fixtures/db/almalinux.yaml new file mode 100644 index 000000000000..e7e463ebe389 --- /dev/null +++ b/integration/testdata/fixtures/db/almalinux.yaml @@ -0,0 +1,10 @@ +- bucket: alma 8 + pairs: + - bucket: openssl-libs + pairs: + - key: CVE-2021-3450 + value: + FixedVersion: 1:1.1.1g-15.el8_3 + - key: CVE-2021-3712 + value: + FixedVersion: 1:1.1.1k-5.el8_5 \ No newline at end of file diff --git a/integration/testdata/fixtures/db/vulnerability.yaml b/integration/testdata/fixtures/db/vulnerability.yaml index 393e9570ac91..b11633aaa42d 100644 --- a/integration/testdata/fixtures/db/vulnerability.yaml +++ b/integration/testdata/fixtures/db/vulnerability.yaml @@ -24,7 +24,6 @@ - http://www.openwall.com/lists/oss-security/2016/11/17/9 - http://www.securityfocus.com/bid/94398 - https://access.redhat.com/errata/RHSA-2017:1931 - - https://access.redhat.com/security/cve/CVE-2016-9401 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9401 - https://linux.oracle.com/cve/CVE-2016-9401.html - https://linux.oracle.com/errata/ELSA-2017-1931.html @@ -56,18 +55,19 @@ PublishedDate: 2019-07-26T00:15:00Z References: - https://access.redhat.com/errata/RHSA-2019:3024 - - https://access.redhat.com/security/cve/CVE-2019-10744 - https://github.com/advisories/GHSA-jf85-cpcp-j695 + - https://github.com/lodash/lodash/pull/4336 - https://nvd.nist.gov/vuln/detail/CVE-2019-10744 - https://security.netapp.com/advisory/ntap-20191004-0005/ - https://snyk.io/vuln/SNYK-JS-LODASH-450202 - https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS + - https://www.npmjs.com/advisories/1065 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuoct2020.html Severity: CRITICAL Title: "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties" VendorSeverity: - ghsa-npm: 3.0 + ghsa-npm: 4.0 nvd: 4.0 redhat: 3.0 - key: CVE-2019-11358 @@ -84,7 +84,7 @@ CweIDs: - CWE-79 Description: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. - LastModifiedDate: 2021-06-14T18:15:00Z + LastModifiedDate: 2021-10-20T11:15:00Z PublishedDate: 2019-04-20T00:29:00Z References: - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html @@ -102,7 +102,6 @@ - https://access.redhat.com/errata/RHSA-2019:2587 - https://access.redhat.com/errata/RHSA-2019:3023 - https://access.redhat.com/errata/RHSA-2019:3024 - - https://access.redhat.com/security/cve/CVE-2019-11358 - https://backdropcms.org/security/backdrop-sa-core-2019-009 - https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358 @@ -114,7 +113,7 @@ - https://hackerone.com/reports/454365 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601 - https://linux.oracle.com/cve/CVE-2019-11358.html - - https://linux.oracle.com/errata/ELSA-2020-3936.html + - https://linux.oracle.com/errata/ELSA-2020-4847.html - https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844@%3Ccommits.airflow.apache.org%3E @@ -152,12 +151,14 @@ - https://www.debian.org/security/2019/dsa-4434 - https://www.debian.org/security/2019/dsa-4460 - https://www.drupal.org/sa-core-2019-006 + - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html + - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/ @@ -167,6 +168,7 @@ Severity: MEDIUM Title: "jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection" VendorSeverity: + alma: 2.0 amazon: 2.0 arch-linux: 2.0 ghsa-npm: 2.0 @@ -215,7 +217,6 @@ References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html - - https://access.redhat.com/security/cve/CVE-2019-14806 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806 - https://github.com/advisories/GHSA-gq9m-qvpx-68hc - "https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168" @@ -247,7 +248,6 @@ LastModifiedDate: 2020-10-20T22:15:00Z PublishedDate: 2019-09-10T17:15:00Z References: - - https://access.redhat.com/security/cve/CVE-2019-1549 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be - https://linux.oracle.com/cve/CVE-2019-1549.html @@ -290,12 +290,11 @@ CweIDs: - CWE-200 Description: There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t). - LastModifiedDate: 2021-06-14T18:15:00Z + LastModifiedDate: 2021-07-21T11:39:00Z PublishedDate: 2019-12-06T18:15:00Z References: - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html - http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html - - https://access.redhat.com/security/cve/CVE-2019-1551 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98 @@ -326,6 +325,7 @@ Severity: MEDIUM Title: "openssl: Integer overflow in RSAZ modular exponentiation on x86_64" VendorSeverity: + amazon: 1.0 nvd: 2.0 oracle-oval: 1.0 photon: 2.0 @@ -343,9 +343,10 @@ V3Score: 3.7 V3Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CweIDs: - - CWE-311 + - CWE-327 + - CWE-203 Description: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). - LastModifiedDate: 2020-10-20T22:15:00Z + LastModifiedDate: 2021-07-31T08:15:00Z PublishedDate: 2019-09-10T17:15:00Z References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html @@ -353,11 +354,11 @@ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html - http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html - - https://access.redhat.com/security/cve/CVE-2019-1563 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f + - https://kc.mcafee.com/corporate/index?page=content&id=SB10365 - https://linux.oracle.com/cve/CVE-2019-1563.html - https://linux.oracle.com/errata/ELSA-2020-1840.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html @@ -412,7 +413,6 @@ References: - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html - - https://access.redhat.com/security/cve/CVE-2019-18224 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224 - https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c @@ -449,7 +449,6 @@ PublishedDate: 2019-11-28T01:15:00Z References: - http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html - - https://access.redhat.com/security/cve/CVE-2019-18276 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276 - https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff - https://linux.oracle.com/cve/CVE-2019-18276.html @@ -485,7 +484,6 @@ References: - http://www.securityfocus.com/bid/106950 - https://access.redhat.com/errata/RHSA-2019:3701 - - https://access.redhat.com/security/cve/CVE-2019-3823 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823 - https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf - https://curl.haxx.se/docs/CVE-2019-3823.html @@ -527,7 +525,6 @@ LastModifiedDate: 2021-01-11T19:21:00Z PublishedDate: 2019-09-24T22:15:00Z References: - - https://access.redhat.com/security/cve/CVE-2019-5094 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094 - https://linux.oracle.com/cve/CVE-2019-5094.html - https://linux.oracle.com/errata/ELSA-2020-4011.html @@ -572,7 +569,6 @@ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html - http://www.openwall.com/lists/oss-security/2019/09/11/6 - - https://access.redhat.com/security/cve/CVE-2019-5436 - https://curl.haxx.se/docs/CVE-2019-5436.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436 - https://linux.oracle.com/cve/CVE-2019-5436.html @@ -618,7 +614,6 @@ References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html - - https://access.redhat.com/security/cve/CVE-2019-5481 - https://curl.haxx.se/docs/CVE-2019-5481.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481 - https://linux.oracle.com/cve/CVE-2019-5481.html @@ -661,7 +656,6 @@ LastModifiedDate: 2020-12-01T16:05:00Z PublishedDate: 2020-11-18T15:15:00Z References: - - https://access.redhat.com/security/cve/CVE-2020-28724 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28724 - https://github.com/advisories/GHSA-3p3h-qghp-hvh2 - https://github.com/pallets/flask/issues/1639 @@ -695,8 +689,8 @@ References: - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html - - https://access.redhat.com/security/cve/CVE-2020-8165 - https://github.com/advisories/GHSA-2p68-f74v-9wc6 + - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml - "https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ" - "https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c" - https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c @@ -712,6 +706,56 @@ ghsa-rubygems: 3.0 nvd: 4.0 redhat: 3.0 + - key: CVE-2021-3712 + value: + CVSS: + nvd: + V2Score: 5.8 + V2Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P + V3Score: 7.4 + V3Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H + redhat: + V3Score: 7.4 + V3Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H + CweIDs: + - CWE-125 + Description: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y). + LastModifiedDate: 2022-01-06T09:15:00Z + PublishedDate: 2021-08-24T15:15:00Z + References: + - http://www.openwall.com/lists/oss-security/2021/08/26/2 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712 + - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=94d23fcff9b2a7a8368dfe52214d5c2569882c11 + - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ccb0a11145ee72b042d10593a64eaf9e8a55ec12 + - https://kc.mcafee.com/corporate/index?page=content&id=SB10366 + - https://linux.oracle.com/cve/CVE-2021-3712.html + - https://linux.oracle.com/errata/ELSA-2021-9632.html + - https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e@%3Cdev.tomcat.apache.org%3E + - https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1@%3Cdev.tomcat.apache.org%3E + - https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html + - https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html + - https://security.netapp.com/advisory/ntap-20210827-0010/ + - https://ubuntu.com/security/notices/USN-5051-1 + - https://ubuntu.com/security/notices/USN-5051-2 + - https://ubuntu.com/security/notices/USN-5051-3 + - https://ubuntu.com/security/notices/USN-5051-4 (regression only in trusty/esm) + - https://ubuntu.com/security/notices/USN-5088-1 + - https://www.debian.org/security/2021/dsa-4963 + - https://www.openssl.org/news/secadv/20210824.txt + - https://www.oracle.com/security-alerts/cpuoct2021.html + - https://www.tenable.com/security/tns-2021-16 + - https://www.tenable.com/security/tns-2022-02 + Severity: HIGH + Title: "openssl: Read buffer overruns processing ASN.1 strings" + VendorSeverity: + alma: 2.0 + amazon: 2.0 + arch-linux: 3.0 + nvd: 3.0 + oracle-oval: 2.0 + photon: 3.0 + redhat: 2.0 + ubuntu: 2.0 - key: RUSTSEC-2019-0001 value: Description: |- diff --git a/integration/testdata/fluentd-gems.json.golden b/integration/testdata/fluentd-gems.json.golden index c69710d0b628..d7f146593f1d 100644 --- a/integration/testdata/fluentd-gems.json.golden +++ b/integration/testdata/fluentd-gems.json.golden @@ -139,7 +139,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html", - "https://access.redhat.com/security/cve/CVE-2019-18224", "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224", "https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c", @@ -194,8 +193,8 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html", "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html", - "https://access.redhat.com/security/cve/CVE-2020-8165", "https://github.com/advisories/GHSA-2p68-f74v-9wc6", + "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml", "https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ", "https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c", "https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c", diff --git a/integration/testdata/nodejs.json.golden b/integration/testdata/nodejs.json.golden index 844be2501283..3b06bc2a119b 100644 --- a/integration/testdata/nodejs.json.golden +++ b/integration/testdata/nodejs.json.golden @@ -62,7 +62,6 @@ "https://access.redhat.com/errata/RHSA-2019:2587", "https://access.redhat.com/errata/RHSA-2019:3023", "https://access.redhat.com/errata/RHSA-2019:3024", - "https://access.redhat.com/security/cve/CVE-2019-11358", "https://backdropcms.org/security/backdrop-sa-core-2019-009", "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358", @@ -74,7 +73,7 @@ "https://hackerone.com/reports/454365", "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601", "https://linux.oracle.com/cve/CVE-2019-11358.html", - "https://linux.oracle.com/errata/ELSA-2020-3936.html", + "https://linux.oracle.com/errata/ELSA-2020-4847.html", "https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E", "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E", "https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844@%3Ccommits.airflow.apache.org%3E", @@ -112,12 +111,14 @@ "https://www.debian.org/security/2019/dsa-4434", "https://www.debian.org/security/2019/dsa-4460", "https://www.drupal.org/sa-core-2019-006", + "https://www.oracle.com//security-alerts/cpujul2021.html", "https://www.oracle.com/security-alerts/cpuApr2021.html", "https://www.oracle.com/security-alerts/cpuapr2020.html", "https://www.oracle.com/security-alerts/cpujan2020.html", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpujul2020.html", "https://www.oracle.com/security-alerts/cpuoct2020.html", + "https://www.oracle.com/security-alerts/cpuoct2021.html", "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/", @@ -126,7 +127,7 @@ "https://www.tenable.com/security/tns-2020-02" ], "PublishedDate": "2019-04-20T00:29:00Z", - "LastModifiedDate": "2021-06-14T18:15:00Z" + "LastModifiedDate": "2021-10-20T11:15:00Z" }, { "VulnerabilityID": "CVE-2019-10744", @@ -138,7 +139,7 @@ "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-10744", "Title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "Description": "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", - "Severity": "HIGH", + "Severity": "CRITICAL", "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P", @@ -153,12 +154,13 @@ }, "References": [ "https://access.redhat.com/errata/RHSA-2019:3024", - "https://access.redhat.com/security/cve/CVE-2019-10744", "https://github.com/advisories/GHSA-jf85-cpcp-j695", + "https://github.com/lodash/lodash/pull/4336", "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", "https://security.netapp.com/advisory/ntap-20191004-0005/", "https://snyk.io/vuln/SNYK-JS-LODASH-450202", "https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS", + "https://www.npmjs.com/advisories/1065", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpuoct2020.html" ], diff --git a/integration/testdata/oraclelinux-8-slim.json.golden b/integration/testdata/oraclelinux-8-slim.json.golden index 0436f6b53d5f..fd2cab02057d 100644 --- a/integration/testdata/oraclelinux-8-slim.json.golden +++ b/integration/testdata/oraclelinux-8-slim.json.golden @@ -92,7 +92,6 @@ "References": [ "http://www.securityfocus.com/bid/106950", "https://access.redhat.com/errata/RHSA-2019:3701", - "https://access.redhat.com/security/cve/CVE-2019-3823", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823", "https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf", "https://curl.haxx.se/docs/CVE-2019-3823.html", @@ -143,7 +142,6 @@ "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html", "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html", "http://www.openwall.com/lists/oss-security/2019/09/11/6", - "https://access.redhat.com/security/cve/CVE-2019-5436", "https://curl.haxx.se/docs/CVE-2019-5436.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436", "https://linux.oracle.com/cve/CVE-2019-5436.html", diff --git a/integration/testdata/photon-30.json.golden b/integration/testdata/photon-30.json.golden index e09737b6803a..674339cfeb1a 100644 --- a/integration/testdata/photon-30.json.golden +++ b/integration/testdata/photon-30.json.golden @@ -92,7 +92,6 @@ }, "References": [ "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html", - "https://access.redhat.com/security/cve/CVE-2019-18276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276", "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff", "https://linux.oracle.com/cve/CVE-2019-18276.html", @@ -136,7 +135,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html", - "https://access.redhat.com/security/cve/CVE-2019-5481", "https://curl.haxx.se/docs/CVE-2019-5481.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481", "https://linux.oracle.com/cve/CVE-2019-5481.html", @@ -187,7 +185,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html", - "https://access.redhat.com/security/cve/CVE-2019-5481", "https://curl.haxx.se/docs/CVE-2019-5481.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481", "https://linux.oracle.com/cve/CVE-2019-5481.html", diff --git a/integration/testdata/pip.json.golden b/integration/testdata/pip.json.golden index ab3a6054be73..6728f1eb30a5 100644 --- a/integration/testdata/pip.json.golden +++ b/integration/testdata/pip.json.golden @@ -49,7 +49,6 @@ "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html", - "https://access.redhat.com/security/cve/CVE-2019-14806", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806", "https://github.com/advisories/GHSA-gq9m-qvpx-68hc", "https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168", @@ -88,7 +87,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2020-28724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28724", "https://github.com/advisories/GHSA-3p3h-qghp-hvh2", "https://github.com/pallets/flask/issues/1639", diff --git a/integration/testdata/ubuntu-1804-ignore-unfixed.json.golden b/integration/testdata/ubuntu-1804-ignore-unfixed.json.golden index fc4cc9d47466..4f331ac696fe 100644 --- a/integration/testdata/ubuntu-1804-ignore-unfixed.json.golden +++ b/integration/testdata/ubuntu-1804-ignore-unfixed.json.golden @@ -99,7 +99,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -148,7 +147,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -197,7 +195,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -246,7 +243,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", diff --git a/integration/testdata/ubuntu-1804.json.golden b/integration/testdata/ubuntu-1804.json.golden index fcd1b4d3ef94..896d442041e9 100644 --- a/integration/testdata/ubuntu-1804.json.golden +++ b/integration/testdata/ubuntu-1804.json.golden @@ -99,7 +99,6 @@ }, "References": [ "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html", - "https://access.redhat.com/security/cve/CVE-2019-18276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276", "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff", "https://linux.oracle.com/cve/CVE-2019-18276.html", @@ -141,7 +140,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -190,7 +188,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -239,7 +236,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", @@ -288,7 +284,6 @@ } }, "References": [ - "https://access.redhat.com/security/cve/CVE-2019-5094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094", "https://linux.oracle.com/cve/CVE-2019-5094.html", "https://linux.oracle.com/errata/ELSA-2020-4011.html", diff --git a/pkg/detector/ospkg/alma/alma.go b/pkg/detector/ospkg/alma/alma.go new file mode 100644 index 000000000000..54408aae1df8 --- /dev/null +++ b/pkg/detector/ospkg/alma/alma.go @@ -0,0 +1,123 @@ +package alma + +import ( + "strings" + "time" + + version "github.com/knqyf263/go-rpm-version" + "golang.org/x/xerrors" + "k8s.io/utils/clock" + + ftypes "github.com/aquasecurity/fanal/types" + "github.com/aquasecurity/trivy-db/pkg/vulnsrc/alma" + "github.com/aquasecurity/trivy/pkg/log" + "github.com/aquasecurity/trivy/pkg/scanner/utils" + "github.com/aquasecurity/trivy/pkg/types" +) + +var ( + eolDates = map[string]time.Time{ + // Source: + // https://wiki.almalinux.org/FAQ.html#how-long-will-cloudlinux-support-almalinux + "8": time.Date(2029, 12, 31, 23, 59, 59, 0, time.UTC), + } +) + +type options struct { + clock clock.Clock +} + +type option func(*options) + +func WithClock(clock clock.Clock) option { + return func(opts *options) { + opts.clock = clock + } +} + +// Scanner implements the AlmaLinux scanner +type Scanner struct { + vs alma.VulnSrc + *options +} + +// NewScanner is the factory method for Scanner +func NewScanner(opts ...option) *Scanner { + o := &options{ + clock: clock.RealClock{}, + } + + for _, opt := range opts { + opt(o) + } + return &Scanner{ + vs: alma.NewVulnSrc(), + options: o, + } +} + +// Detect vulnerabilities in package using AlmaLinux scanner +func (s *Scanner) Detect(osVer string, pkgs []ftypes.Package) ([]types.DetectedVulnerability, error) { + log.Logger.Info("Detecting AlmaLinux vulnerabilities...") + if strings.Count(osVer, ".") > 0 { + osVer = osVer[:strings.Index(osVer, ".")] + } + log.Logger.Debugf("AlmaLinux: os version: %s", osVer) + log.Logger.Debugf("AlmaLinux: the number of packages: %d", len(pkgs)) + + var vulns []types.DetectedVulnerability + for _, pkg := range pkgs { + pkgName := addModularNamespace(pkg.Name, pkg.Modularitylabel) + advisories, err := s.vs.Get(osVer, pkgName) + if err != nil { + return nil, xerrors.Errorf("failed to get AlmaLinux advisories: %w", err) + } + + installed := utils.FormatVersion(pkg) + installedVersion := version.NewVersion(installed) + + for _, adv := range advisories { + fixedVersion := version.NewVersion(adv.FixedVersion) + if installedVersion.LessThan(fixedVersion) { + vuln := types.DetectedVulnerability{ + VulnerabilityID: adv.VulnerabilityID, + PkgName: pkg.Name, + InstalledVersion: installed, + FixedVersion: fixedVersion.String(), + Layer: pkg.Layer, + } + vulns = append(vulns, vuln) + } + } + } + return vulns, nil +} + +// IsSupportedVersion checks the OSFamily can be scanned using AlmaLinux scanner +func (s *Scanner) IsSupportedVersion(osFamily, osVer string) bool { + if strings.Count(osVer, ".") > 0 { + osVer = osVer[:strings.Index(osVer, ".")] + } + + eol, ok := eolDates[osVer] + if !ok { + log.Logger.Warnf("This OS version is not on the EOL list: %s %s", osFamily, osVer) + return false + } + + return s.clock.Now().Before(eol) +} + +func addModularNamespace(name, label string) string { + // e.g. npm, nodejs:12:8030020201124152102:229f0a1c => nodejs:12::npm + var count int + for i, r := range label { + if r == ':' { + count++ + } + if count == 2 { + return label[:i] + "::" + name + } + } + return name +} diff --git a/pkg/detector/ospkg/alma/alma_test.go b/pkg/detector/ospkg/alma/alma_test.go new file mode 100644 index 000000000000..5b5d043c6a1d --- /dev/null +++ b/pkg/detector/ospkg/alma/alma_test.go @@ -0,0 +1,143 @@ +package alma_test + +import ( + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + fake "k8s.io/utils/clock/testing" + + ftypes "github.com/aquasecurity/fanal/types" + "github.com/aquasecurity/trivy-db/pkg/db" + "github.com/aquasecurity/trivy/pkg/dbtest" + "github.com/aquasecurity/trivy/pkg/detector/ospkg/alma" + "github.com/aquasecurity/trivy/pkg/types" +) + +func TestScanner_Detect(t *testing.T) { + type args struct { + osVer string + pkgs []ftypes.Package + } + tests := []struct { + name string + args args + fixtures []string + want []types.DetectedVulnerability + wantErr string + }{ + { + name: "happy path", + fixtures: []string{"testdata/fixtures/alma.yaml"}, + args: args{ + osVer: "8.4", + pkgs: []ftypes.Package{ + { + Name: "python3-libs", + Epoch: 0, + Version: "3.6.8", + Release: "36.el8.alma", + Arch: "x86_64", + SrcName: "python3", + SrcEpoch: 0, + SrcVersion: "3.6.8", + SrcRelease: "36.el8.alma", + Modularitylabel: "", + License: "Python", + Layer: ftypes.Layer{}, + }, + }, + }, + want: []types.DetectedVulnerability{ + { + PkgName: "python3-libs", + VulnerabilityID: "CVE-2020-26116", + InstalledVersion: "3.6.8-36.el8.alma", + FixedVersion: "3.6.8-37.el8.alma", + Layer: ftypes.Layer{}, + }, + }, + }, + { + name: "Get returns an error", + fixtures: []string{"testdata/fixtures/invalid.yaml"}, + args: args{ + osVer: "8.4", + pkgs: []ftypes.Package{ + { + Name: "jq", + Version: "1.5-12", + SrcName: "jq", + SrcVersion: "1.5-12", + }, + }, + }, + wantErr: "failed to get AlmaLinux advisories", + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _ = dbtest.InitDB(t, tt.fixtures) + defer db.Close() + + s := alma.NewScanner() + got, err := s.Detect(tt.args.osVer, tt.args.pkgs) + if tt.wantErr != "" { + require.Error(t, err) + assert.Contains(t, err.Error(), tt.wantErr) + return + } + assert.NoError(t, err) + assert.Equal(t, tt.want, got) + }) + } +} + +func TestScanner_IsSupportedVersion(t *testing.T) { + type args struct { + osFamily string + osVer string + } + tests := []struct { + name string + now time.Time + args args + want bool + }{ + { + name: "alma 8.4", + now: time.Date(2019, 3, 2, 23, 59, 59, 0, time.UTC), + args: args{ + osFamily: "alma", + osVer: "8.4", + }, + want: true, + }, + { + name: "alma 8.4 with EOL", + now: time.Date(2030, 1, 1, 0, 0, 0, 0, time.UTC), + args: args{ + osFamily: "alma", + osVer: "8.4", + }, + want: false, + }, + { + name: "unknown", + now: time.Date(2019, 5, 2, 23, 59, 59, 0, time.UTC), + args: args{ + osFamily: "alma", + osVer: "unknown", + }, + want: false, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + s := alma.NewScanner(alma.WithClock(fake.NewFakeClock(tt.now))) + got := s.IsSupportedVersion(tt.args.osFamily, tt.args.osVer) + assert.Equal(t, tt.want, got) + }) + } +} diff --git a/pkg/detector/ospkg/alma/testdata/fixtures/alma.yaml b/pkg/detector/ospkg/alma/testdata/fixtures/alma.yaml new file mode 100644 index 000000000000..af3043c75faa --- /dev/null +++ b/pkg/detector/ospkg/alma/testdata/fixtures/alma.yaml @@ -0,0 +1,10 @@ +- bucket: alma 8 + pairs: + - bucket: python3-libs + pairs: + - key: CVE-2019-16935 + value: + FixedVersion: "3.6.8-31.el8.alma" + - key: CVE-2020-26116 + value: + FixedVersion: "3.6.8-37.el8.alma" \ No newline at end of file diff --git a/pkg/detector/ospkg/alma/testdata/fixtures/invalid.yaml b/pkg/detector/ospkg/alma/testdata/fixtures/invalid.yaml new file mode 100644 index 000000000000..a9cbeec8e062 --- /dev/null +++ b/pkg/detector/ospkg/alma/testdata/fixtures/invalid.yaml @@ -0,0 +1,9 @@ +- bucket: alma 8 + pairs: + - bucket: jq + pairs: + - key: CVE-2020-8177 + value: + FixedVersion: + - foo + - bar \ No newline at end of file diff --git a/pkg/detector/ospkg/detect.go b/pkg/detector/ospkg/detect.go index cf055464ca65..3a8176b421e8 100644 --- a/pkg/detector/ospkg/detect.go +++ b/pkg/detector/ospkg/detect.go @@ -8,6 +8,7 @@ import ( fos "github.com/aquasecurity/fanal/analyzer/os" ftypes "github.com/aquasecurity/fanal/types" + "github.com/aquasecurity/trivy/pkg/detector/ospkg/alma" "github.com/aquasecurity/trivy/pkg/detector/ospkg/alpine" "github.com/aquasecurity/trivy/pkg/detector/ospkg/amazon" "github.com/aquasecurity/trivy/pkg/detector/ospkg/debian" @@ -63,12 +64,12 @@ func (d Detector) Detect(_, osFamily, osName string, _ time.Time, pkgs []ftypes. } // nolint: gocyclo -// TODO: fix cyclometic complexity by removing default func newDriver(osFamily, osName string) Driver { - // TODO: use DI and change struct names switch osFamily { case fos.Alpine: return alpine.NewScanner() + case fos.Alma: + return alma.NewScanner() case fos.Debian: return debian.NewScanner() case fos.Ubuntu: diff --git a/pkg/report/template.go b/pkg/report/template.go index 363440b12cd0..5b982f01eeda 100644 --- a/pkg/report/template.go +++ b/pkg/report/template.go @@ -105,7 +105,7 @@ func toSarifRuleName(vulnerabilityType string) string { case vulnerability.Ubuntu, vulnerability.Alpine, vulnerability.RedHat, vulnerability.RedHatOVAL, vulnerability.Debian, vulnerability.DebianOVAL, vulnerability.Fedora, vulnerability.Amazon, vulnerability.OracleOVAL, vulnerability.SuseCVRF, vulnerability.OpenSuseCVRF, vulnerability.Photon, - vulnerability.CentOS: + vulnerability.CentOS, vulnerability.Alma: return "OsPackageVulnerability" case "npm", "yarn", "nuget", "pipenv", "poetry", "bundler", "cargo", "composer": return "ProgrammingLanguageVulnerability" diff --git a/pkg/report/writer_internal_test.go b/pkg/report/writer_internal_test.go index 2a465f091265..e3f2a539cdeb 100644 --- a/pkg/report/writer_internal_test.go +++ b/pkg/report/writer_internal_test.go @@ -64,6 +64,10 @@ func TestReportWriter_toSarifRuleName(t *testing.T) { vulnerabilityType: vulnerability.CentOS, sarifRuleName: "OsPackageVulnerability", }, + { + vulnerabilityType: vulnerability.Alma, + sarifRuleName: "OsPackageVulnerability", + }, { vulnerabilityType: "npm", sarifRuleName: "ProgrammingLanguageVulnerability", diff --git a/pkg/result/result.go b/pkg/result/result.go index 7ba35e9e72c8..4f3569720873 100644 --- a/pkg/result/result.go +++ b/pkg/result/result.go @@ -94,7 +94,7 @@ func (c Client) detectSource(reportType string) []string { switch reportType { case vulnerability.Ubuntu, vulnerability.Alpine, vulnerability.RedHat, vulnerability.RedHatOVAL, vulnerability.Debian, vulnerability.DebianOVAL, vulnerability.Fedora, vulnerability.Amazon, - vulnerability.OracleOVAL, vulnerability.SuseCVRF, vulnerability.OpenSuseCVRF, vulnerability.Photon: + vulnerability.OracleOVAL, vulnerability.SuseCVRF, vulnerability.OpenSuseCVRF, vulnerability.Photon, vulnerability.Alma: sources = []string{reportType} case vulnerability.CentOS: // CentOS doesn't have its own so we use RedHat sources = []string{vulnerability.RedHat}