Skip to content

Commit ed064ae

Browse files
RTannRTann
authored
fix: do not skip NVD vulns with just CVSSv3 (#1236)
1 parent e3edee0 commit ed064ae

File tree

5 files changed

+94
-172
lines changed

5 files changed

+94
-172
lines changed

‎e2etests/testcase_test.go

Lines changed: 84 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2817,7 +2817,7 @@ var testCases = []testCase{
28172817
},
28182818
},
28192819
AddedBy: "sha256:2408cc74d12b6cd092bb8b516ba7d5e290f485d3eb9672efc00f0583730179e8",
2820-
FixedBy: "1.1.1q-r0",
2820+
FixedBy: "1.1.1v-r0",
28212821
},
28222822
},
28232823
},
@@ -3808,9 +3808,9 @@ Applications using RegexRequestMatcher with '.' in the regular expression are po
38083808
},
38093809
"CVSSv3": map[string]interface{}{
38103810
"ExploitabilityScore": 3.9,
3811-
"ImpactScore": 5.9,
3812-
"Score": 9.8,
3813-
"Vectors": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
3811+
"ImpactScore": 3.6,
3812+
"Score": 7.5,
3813+
"Vectors": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
38143814
},
38153815
},
38163816
},
@@ -3819,7 +3819,7 @@ Applications using RegexRequestMatcher with '.' in the regular expression are po
38193819
{
38203820
Name: "CVE-2022-3786",
38213821
NamespaceName: "ubuntu:22.04",
3822-
Description: "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).",
3822+
Description: "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
38233823
Link: "https://ubuntu.com/security/CVE-2022-3786",
38243824
Severity: "Important",
38253825
Metadata: map[string]interface{}{
@@ -3841,7 +3841,7 @@ Applications using RegexRequestMatcher with '.' in the regular expression are po
38413841
FixedBy: "3.0.2-0ubuntu1.7",
38423842
},
38433843
},
3844-
FixedBy: "3.0.2-0ubuntu1.7",
3844+
FixedBy: "3.0.2-0ubuntu1.10",
38453845
// This image installs the openssl pacakge in the second layer;
38463846
// however, the first layer already installed libssl3 whose source package is openssl.
38473847
// Therefore, we claim openssl was installed in the first layer.
@@ -3864,6 +3864,7 @@ Applications using RegexRequestMatcher with '.' in the regular expression are po
38643864
NamespaceName: "ubuntu:22.10",
38653865
VersionFormat: "dpkg",
38663866
Version: "3.0.5-2ubuntu2",
3867+
FixedBy: "3.0.5-2ubuntu2.3",
38673868
AddedBy: "sha256:2b441754735ea7decb684ef19d54115fc309c270fe7b87ed36aa3773ce50b78b",
38683869
},
38693870
},
@@ -4152,4 +4153,81 @@ All OpenShift Container Platform 4.10 users are advised to upgrade to these upda
41524153
},
41534154
},
41544155
},
4156+
{
4157+
image: "nginx:1.25.0-alpine",
4158+
registry: "https://registry-1.docker.io",
4159+
source: "NVD",
4160+
namespace: "alpine:v3.17",
4161+
onlyCheckSpecifiedVulns: true,
4162+
expectedFeatures: []apiV1.Feature{
4163+
{
4164+
Name: "libx11",
4165+
NamespaceName: "alpine:v3.17",
4166+
VersionFormat: "apk",
4167+
Version: "1.8.4-r0",
4168+
Vulnerabilities: []apiV1.Vulnerability{
4169+
{
4170+
Name: "CVE-2023-3138",
4171+
NamespaceName: "alpine:v3.17",
4172+
Description: "A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.",
4173+
Link: "https://www.cve.org/CVERecord?id=CVE-2023-3138",
4174+
Severity: "Important",
4175+
FixedBy: "1.8.4-r1",
4176+
Metadata: map[string]interface{}{
4177+
"NVD": map[string]interface{}{
4178+
"CVSSv2": map[string]interface{}{
4179+
"ExploitabilityScore": 0.0,
4180+
"ImpactScore": 0.0,
4181+
"Score": 0.0,
4182+
"Vectors": "",
4183+
},
4184+
"CVSSv3": map[string]interface{}{
4185+
"ExploitabilityScore": 3.9,
4186+
"ImpactScore": 3.6,
4187+
"Score": 7.5,
4188+
"Vectors": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
4189+
},
4190+
},
4191+
},
4192+
},
4193+
},
4194+
FixedBy: "1.8.4-r1",
4195+
AddedBy: "sha256:4aacde79cec42c8d0c5886185e70a16b107ae8c6b1a67d63d6efdb6d6978ed97",
4196+
},
4197+
{
4198+
Name: "nghttp2",
4199+
NamespaceName: "alpine:v3.17",
4200+
VersionFormat: "apk",
4201+
Version: "1.51.0-r0",
4202+
Vulnerabilities: []apiV1.Vulnerability{
4203+
{
4204+
Name: "CVE-2023-35945",
4205+
NamespaceName: "alpine:v3.17",
4206+
Description: "Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.",
4207+
Link: "https://www.cve.org/CVERecord?id=CVE-2023-35945",
4208+
Severity: "Important",
4209+
FixedBy: "1.51.0-r1",
4210+
Metadata: map[string]interface{}{
4211+
"NVD": map[string]interface{}{
4212+
"CVSSv2": map[string]interface{}{
4213+
"ExploitabilityScore": 0.0,
4214+
"ImpactScore": 0.0,
4215+
"Score": 0.0,
4216+
"Vectors": "",
4217+
},
4218+
"CVSSv3": map[string]interface{}{
4219+
"ExploitabilityScore": 3.9,
4220+
"ImpactScore": 3.6,
4221+
"Score": 7.5,
4222+
"Vectors": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
4223+
},
4224+
},
4225+
},
4226+
},
4227+
},
4228+
FixedBy: "1.51.0-r1",
4229+
AddedBy: "sha256:4aacde79cec42c8d0c5886185e70a16b107ae8c6b1a67d63d6efdb6d6978ed97",
4230+
},
4231+
},
4232+
},
41554233
}

‎ext/vulnmdsrc/nvd/json.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ func (n *nvdEntry) Summary() string {
121121
}
122122

123123
func (n *nvdEntry) Metadata() *types.Metadata {
124-
if n.Impact.BaseMetricV2.CVSSv2.String() == "" {
124+
if n.Impact.BaseMetricV2.CVSSv2.String() == "" && n.Impact.BaseMetricV3.CVSSv3.String() == "" {
125125
return nil
126126
}
127127
metadata := &types.Metadata{

‎ext/vulnmdsrc/nvd/nvd.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ const (
3939

4040
type appender struct {
4141
metadata map[string]*metadataEnricher
42+
skipped int
4243
}
4344

4445
type metadataEnricher struct {
@@ -85,7 +86,7 @@ func (a *appender) BuildCache(dumpDir string) error {
8586
}
8687
_ = f.Close()
8788
}
88-
log.Infof("Obtained metadata for %d vulns", len(a.metadata))
89+
log.Infof("Obtained metadata for %d NVD vulns (skipped %d)", len(a.metadata), a.skipped)
8990

9091
return nil
9192
}
@@ -104,6 +105,8 @@ func (a *appender) parseDataFeed(r io.Reader) error {
104105
enricher := newMetadataEnricher(&nvdEntry)
105106
if enricher.metadata != nil {
106107
a.metadata[nvdEntry.Name()] = enricher
108+
} else {
109+
a.skipped++
107110
}
108111
}
109112

‎ext/vulnmdsrc/redhat/redhat.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ const (
2323

2424
type appender struct {
2525
metadata map[string]*metadataEnricher
26+
skipped int
2627
}
2728

2829
type metadataEnricher struct {
@@ -69,7 +70,7 @@ func (a *appender) BuildCache(dumpDir string) error {
6970
}
7071
_ = f.Close()
7172
}
72-
log.Infof("Obtained metadata for %d vulns", len(a.metadata))
73+
log.Infof("Obtained metadata for %d Red Hat vulns (skipped %d)", len(a.metadata), a.skipped)
7374

7475
return nil
7576
}
@@ -87,6 +88,8 @@ func (a *appender) parseDataFeed(r io.Reader) error {
8788
enricher := newMetadataEnricher(&redhatEntry)
8889
if enricher.metadata != nil {
8990
a.metadata[redhatEntry.Name()] = enricher
91+
} else {
92+
a.skipped++
9093
}
9194
}
9295

‎ext/vulnsrc/manual/manual.go

Lines changed: 1 addition & 163 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package manual
33
import (
44
log "github.com/sirupsen/logrus"
55
"github.com/stackrox/scanner/database"
6-
"github.com/stackrox/scanner/ext/versionfmt/dpkg"
76
"github.com/stackrox/scanner/ext/vulnsrc"
87
)
98

@@ -13,168 +12,7 @@ type updater struct {
1312
}
1413

1514
// Vulnerabilities lists vulnerabilities which may not already exist in the feeds for other distros.
16-
var Vulnerabilities = []database.Vulnerability{
17-
{
18-
Name: "CVE-2022-3602",
19-
Namespace: database.Namespace{
20-
Name: "ubuntu:22.04",
21-
VersionFormat: dpkg.ParserName,
22-
},
23-
Description: "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).",
24-
Link: "https://ubuntu.com/security/CVE-2022-3602",
25-
Severity: database.HighSeverity,
26-
FixedIn: []database.FeatureVersion{
27-
{
28-
Feature: database.Feature{
29-
Name: "openssl",
30-
Namespace: database.Namespace{
31-
Name: "ubuntu:22.04",
32-
VersionFormat: dpkg.ParserName,
33-
},
34-
},
35-
Version: "3.0.2-0ubuntu1.7",
36-
},
37-
},
38-
Metadata: map[string]interface{}{
39-
"NVD": map[string]interface{}{
40-
"PublishedDateTime": "2022-11-01T16:00Z",
41-
"LastModifiedDateTime": "2022-11-02T16:00Z",
42-
"CVSSv2": map[string]interface{}{
43-
"ExploitabilityScore": 0.0,
44-
"ImpactScore": 0.0,
45-
"Score": 0.0,
46-
"Vectors": "",
47-
},
48-
"CVSSv3": map[string]interface{}{
49-
"ExploitabilityScore": 3.9,
50-
"ImpactScore": 5.9,
51-
"Score": 9.8,
52-
"Vectors": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
53-
},
54-
},
55-
},
56-
},
57-
{
58-
Name: "CVE-2022-3602",
59-
Namespace: database.Namespace{
60-
Name: "ubuntu:22.10",
61-
VersionFormat: dpkg.ParserName,
62-
},
63-
Description: "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).",
64-
Link: "https://ubuntu.com/security/CVE-2022-3602",
65-
Severity: database.HighSeverity,
66-
FixedIn: []database.FeatureVersion{
67-
{
68-
Feature: database.Feature{
69-
Name: "openssl",
70-
Namespace: database.Namespace{
71-
Name: "ubuntu:22.10",
72-
VersionFormat: dpkg.ParserName,
73-
},
74-
},
75-
Version: "3.0.5-2ubuntu2",
76-
},
77-
},
78-
Metadata: map[string]interface{}{
79-
"NVD": map[string]interface{}{
80-
"PublishedDateTime": "2022-11-01T16:00Z",
81-
"LastModifiedDateTime": "2022-11-02T16:00Z",
82-
"CVSSv2": map[string]interface{}{
83-
"ExploitabilityScore": 0.0,
84-
"ImpactScore": 0.0,
85-
"Score": 0.0,
86-
"Vectors": "",
87-
},
88-
"CVSSv3": map[string]interface{}{
89-
"ExploitabilityScore": 3.9,
90-
"ImpactScore": 5.9,
91-
"Score": 9.8,
92-
"Vectors": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
93-
},
94-
},
95-
},
96-
},
97-
{
98-
Name: "CVE-2022-3786",
99-
Namespace: database.Namespace{
100-
Name: "ubuntu:22.04",
101-
VersionFormat: dpkg.ParserName,
102-
},
103-
Description: "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).",
104-
Link: "https://ubuntu.com/security/CVE-2022-3786",
105-
Severity: database.HighSeverity,
106-
FixedIn: []database.FeatureVersion{
107-
{
108-
Feature: database.Feature{
109-
Name: "openssl",
110-
Namespace: database.Namespace{
111-
Name: "ubuntu:22.04",
112-
VersionFormat: dpkg.ParserName,
113-
},
114-
},
115-
Version: "3.0.2-0ubuntu1.7",
116-
},
117-
},
118-
Metadata: map[string]interface{}{
119-
"NVD": map[string]interface{}{
120-
"PublishedDateTime": "2022-11-01T16:00Z",
121-
"LastModifiedDateTime": "2022-11-02T16:00Z",
122-
"CVSSv2": map[string]interface{}{
123-
"ExploitabilityScore": 0.0,
124-
"ImpactScore": 0.0,
125-
"Score": 0.0,
126-
"Vectors": "",
127-
},
128-
"CVSSv3": map[string]interface{}{
129-
"ExploitabilityScore": 3.9,
130-
"ImpactScore": 3.6,
131-
"Score": 7.5,
132-
"Vectors": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
133-
},
134-
},
135-
},
136-
},
137-
{
138-
Name: "CVE-2022-3786",
139-
Namespace: database.Namespace{
140-
Name: "ubuntu:22.10",
141-
VersionFormat: dpkg.ParserName,
142-
},
143-
Description: "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).",
144-
Link: "https://ubuntu.com/security/CVE-2022-3786",
145-
Severity: database.HighSeverity,
146-
FixedIn: []database.FeatureVersion{
147-
{
148-
Feature: database.Feature{
149-
Name: "openssl",
150-
Namespace: database.Namespace{
151-
Name: "ubuntu:22.10",
152-
VersionFormat: dpkg.ParserName,
153-
},
154-
},
155-
Version: "3.0.5-2ubuntu2",
156-
},
157-
},
158-
Metadata: map[string]interface{}{
159-
"NVD": map[string]interface{}{
160-
"PublishedDateTime": "2022-11-01T16:00Z",
161-
"LastModifiedDateTime": "2022-11-02T16:00Z",
162-
"CVSSv2": map[string]interface{}{
163-
"ExploitabilityScore": 0.0,
164-
"ImpactScore": 0.0,
165-
"Score": 0.0,
166-
"Vectors": "",
167-
},
168-
"CVSSv3": map[string]interface{}{
169-
"ExploitabilityScore": 3.9,
170-
"ImpactScore": 3.6,
171-
"Score": 7.5,
172-
"Vectors": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
173-
},
174-
},
175-
},
176-
},
177-
}
15+
var Vulnerabilities = []database.Vulnerability{}
17816

17917
func (u updater) Update(_ vulnsrc.DataStore) (resp vulnsrc.UpdateResponse, _ error) {
18018
log.WithField("package", "Manual Entries").Info("Start fetching vulnerabilities")

0 commit comments

Comments
 (0)