diff --git a/vulnerabilities/importers/apache_httpd.py b/vulnerabilities/importers/apache_httpd.py index 6f120addd..e46976882 100644 --- a/vulnerabilities/importers/apache_httpd.py +++ b/vulnerabilities/importers/apache_httpd.py @@ -9,15 +9,9 @@ import logging import urllib -from datetime import datetime -from typing import Iterable -from typing import List -from typing import Mapping -from typing import Optional import requests from bs4 import BeautifulSoup -from django.db.models.query import QuerySet from packageurl import PackageURL from univers.version_constraint import VersionConstraint from univers.version_range import ApacheVersionRange @@ -27,18 +21,8 @@ from vulnerabilities.importer import AffectedPackage from vulnerabilities.importer import Importer from vulnerabilities.importer import Reference -from vulnerabilities.importer import UnMergeablePackageError from vulnerabilities.importer import VulnerabilitySeverity -from vulnerabilities.improver import Improver -from vulnerabilities.improver import Inference -from vulnerabilities.models import Advisory -from vulnerabilities.package_managers import GitHubTagsAPI -from vulnerabilities.package_managers import VersionAPI from vulnerabilities.severity_systems import APACHE_HTTPD -from vulnerabilities.utils import AffectedPackage as LegacyAffectedPackage -from vulnerabilities.utils import get_affected_packages_by_patched_package -from vulnerabilities.utils import nearest_patched_package -from vulnerabilities.utils import resolve_version_range logger = logging.getLogger(__name__) @@ -163,144 +147,3 @@ def fetch_links(url): continue links.append(urllib.parse.urljoin(url, link)) return links - - -IGNORE_TAGS = { - "AGB_BEFORE_AAA_CHANGES", - "APACHE_1_2b1", - "APACHE_1_2b10", - "APACHE_1_2b11", - "APACHE_1_2b2", - "APACHE_1_2b3", - "APACHE_1_2b4", - "APACHE_1_2b5", - "APACHE_1_2b6", - "APACHE_1_2b7", - "APACHE_1_2b8", - "APACHE_1_2b9", - "APACHE_1_3_PRE_NT", - "APACHE_1_3a1", - "APACHE_1_3b1", - "APACHE_1_3b2", - "APACHE_1_3b3", - "APACHE_1_3b5", - "APACHE_1_3b6", - "APACHE_1_3b7", - "APACHE_2_0_2001_02_09", - "APACHE_2_0_52_WROWE_RC1", - "APACHE_2_0_ALPHA", - "APACHE_2_0_ALPHA_2", - "APACHE_2_0_ALPHA_3", - "APACHE_2_0_ALPHA_4", - "APACHE_2_0_ALPHA_5", - "APACHE_2_0_ALPHA_6", - "APACHE_2_0_ALPHA_7", - "APACHE_2_0_ALPHA_8", - "APACHE_2_0_ALPHA_9", - "APACHE_2_0_BETA_CANDIDATE_1", - "APACHE_BIG_SYMBOL_RENAME_POST", - "APACHE_BIG_SYMBOL_RENAME_PRE", - "CHANGES", - "HTTPD_LDAP_1_0_0", - "INITIAL", - "MOD_SSL_2_8_3", - "PCRE_3_9", - "POST_APR_SPLIT", - "PRE_APR_CHANGES", - "STRIKER_2_0_51_RC1", - "STRIKER_2_0_51_RC2", - "STRIKER_2_1_0_RC1", - "WROWE_2_0_43_PRE1", - "apache-1_3-merge-1-post", - "apache-1_3-merge-1-pre", - "apache-1_3-merge-2-post", - "apache-1_3-merge-2-pre", - "apache-apr-merge-3", - "apache-doc-split-01", - "dg_last_1_2_doc_merge", - "djg-apache-nspr-07", - "djg_nspr_split", - "moving_to_httpd_module", - "mpm-3", - "mpm-merge-1", - "mpm-merge-2", - "post_ajp_proxy", - "pre_ajp_proxy", -} - - -class ApacheHTTPDImprover(Improver): - def __init__(self) -> None: - self.versions_fetcher_by_purl: Mapping[str, VersionAPI] = {} - self.vesions_by_purl = {} - - @property - def interesting_advisories(self) -> QuerySet: - return Advisory.objects.filter(created_by=ApacheHTTPDImporter.qualified_name) - - def get_package_versions( - self, package_url: PackageURL, until: Optional[datetime] = None - ) -> List[str]: - """ - Return a list of `valid_versions` for the `package_url` - """ - api_name = "apache/httpd" - versions_fetcher = GitHubTagsAPI() - return versions_fetcher.get_until(package_name=api_name, until=until).valid_versions - - def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: - """ - Yield Inferences for the given advisory data - """ - if not advisory_data.affected_packages: - return - try: - purl, affected_version_ranges, _ = AffectedPackage.merge( - advisory_data.affected_packages - ) - except UnMergeablePackageError: - logger.error(f"Cannot merge with different purls {advisory_data.affected_packages!r}") - return iter([]) - - pkg_type = purl.type - pkg_namespace = purl.namespace - pkg_name = purl.name - - if not self.vesions_by_purl.get(str(purl)): - valid_versions = self.get_package_versions( - package_url=purl, until=advisory_data.date_published - ) - self.vesions_by_purl[str(purl)] = valid_versions - - valid_versions = self.vesions_by_purl[str(purl)] - - for affected_version_range in affected_version_ranges: - aff_vers, unaff_vers = resolve_version_range( - affected_version_range=affected_version_range, - package_versions=valid_versions, - ignorable_versions=IGNORE_TAGS, - ) - affected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in aff_vers - ] - - unaffected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in unaff_vers - ] - - affected_packages: List[LegacyAffectedPackage] = nearest_patched_package( - vulnerable_packages=affected_purls, resolved_packages=unaffected_purls - ) - - for ( - fixed_package, - affected_packages, - ) in get_affected_packages_by_patched_package(affected_packages).items(): - yield Inference.from_advisory_data( - advisory_data, - confidence=100, # We are getting all valid versions to get this inference - affected_purls=affected_packages, - fixed_purl=fixed_package, - ) diff --git a/vulnerabilities/importers/debian.py b/vulnerabilities/importers/debian.py index 5191639db..113550673 100644 --- a/vulnerabilities/importers/debian.py +++ b/vulnerabilities/importers/debian.py @@ -14,7 +14,6 @@ from typing import Mapping import requests -from django.db.models.query import QuerySet from packageurl import PackageURL from univers.version_range import DebianVersionRange from univers.versions import DebianVersion @@ -23,16 +22,8 @@ from vulnerabilities.importer import AffectedPackage from vulnerabilities.importer import Importer from vulnerabilities.importer import Reference -from vulnerabilities.importer import UnMergeablePackageError -from vulnerabilities.improver import MAX_CONFIDENCE -from vulnerabilities.improver import Improver -from vulnerabilities.improver import Inference -from vulnerabilities.models import Advisory -from vulnerabilities.utils import AffectedPackage as LegacyAffectedPackage from vulnerabilities.utils import dedupe -from vulnerabilities.utils import get_affected_packages_by_patched_package from vulnerabilities.utils import get_item -from vulnerabilities.utils import nearest_patched_package logger = logging.getLogger(__name__) @@ -164,74 +155,3 @@ def parse(self, pkg_name: str, records: Mapping[str, Any]) -> Iterable[AdvisoryD affected_packages=affected_packages, references=references, ) - - -class DebianBasicImprover(Improver): - @property - def interesting_advisories(self) -> QuerySet: - return Advisory.objects.filter(created_by=DebianImporter.qualified_name) - - def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: - """ - Yield Inferences for the given advisory data - """ - if not advisory_data.affected_packages: - return - try: - purl, affected_version_ranges, fixed_versions = AffectedPackage.merge( - advisory_data.affected_packages - ) - except UnMergeablePackageError: - logger.error(f"Cannot merge with different purls {advisory_data.affected_packages!r}") - return - - pkg_type = purl.type - pkg_namespace = purl.namespace - pkg_name = purl.name - pkg_qualifiers = purl.qualifiers - fixed_purls = [ - PackageURL( - type=pkg_type, - namespace=pkg_namespace, - name=pkg_name, - version=str(version), - qualifiers=pkg_qualifiers, - ) - for version in fixed_versions - ] - if not affected_version_ranges: - for fixed_purl in fixed_purls: - yield Inference.from_advisory_data( - advisory_data, # We are getting all valid versions to get this inference - confidence=MAX_CONFIDENCE, - affected_purls=[], - fixed_purl=fixed_purl, - ) - else: - aff_versions = set() - for affected_version_range in affected_version_ranges: - for constraint in affected_version_range.constraints: - aff_versions.add(constraint.version.string) - affected_purls = [ - PackageURL( - type=pkg_type, - namespace=pkg_namespace, - name=pkg_name, - version=version, - qualifiers=pkg_qualifiers, - ) - for version in aff_versions - ] - affected_packages: List[LegacyAffectedPackage] = nearest_patched_package( - vulnerable_packages=affected_purls, resolved_packages=fixed_purls - ) - - for (fixed_package, affected_packages,) in get_affected_packages_by_patched_package( - affected_packages=affected_packages - ).items(): - yield Inference.from_advisory_data( - advisory_data, - confidence=MAX_CONFIDENCE, # We are getting all valid versions to get this inference - affected_purls=affected_packages, - fixed_purl=fixed_package, - ) diff --git a/vulnerabilities/importers/github.py b/vulnerabilities/importers/github.py index f129e8e68..c816d3faa 100644 --- a/vulnerabilities/importers/github.py +++ b/vulnerabilities/importers/github.py @@ -8,14 +8,10 @@ # import logging -from datetime import datetime from typing import Iterable -from typing import List -from typing import Mapping from typing import Optional from dateutil import parser as dateparser -from django.db.models.query import QuerySet from packageurl import PackageURL from univers.version_range import RANGE_CLASS_BY_SCHEMES from univers.version_range import build_range_from_github_advisory_constraint @@ -26,87 +22,12 @@ from vulnerabilities.importer import AffectedPackage from vulnerabilities.importer import Importer from vulnerabilities.importer import Reference -from vulnerabilities.importer import UnMergeablePackageError from vulnerabilities.importer import VulnerabilitySeverity -from vulnerabilities.improver import Improver -from vulnerabilities.improver import Inference -from vulnerabilities.models import Advisory -from vulnerabilities.package_managers import VERSION_API_CLASSES_BY_PACKAGE_TYPE -from vulnerabilities.package_managers import GoproxyVersionAPI -from vulnerabilities.package_managers import VersionAPI -from vulnerabilities.package_managers import get_api_package_name -from vulnerabilities.utils import AffectedPackage as LegacyAffectedPackage from vulnerabilities.utils import dedupe -from vulnerabilities.utils import get_affected_packages_by_patched_package from vulnerabilities.utils import get_item -from vulnerabilities.utils import nearest_patched_package -from vulnerabilities.utils import resolve_version_range logger = logging.getLogger(__name__) -WEIRD_IGNORABLE_VERSIONS = frozenset( - [ - "0.1-bulbasaur", - "0.1-charmander", - "0.3m1", - "0.3m2", - "0.3m3", - "0.3m4", - "0.3m5", - "0.4m1", - "0.4m2", - "0.4m3", - "0.4m4", - "0.4m5", - "0.5m1", - "0.5m2", - "0.5m3", - "0.5m4", - "0.5m5", - "0.6m1", - "0.6m2", - "0.6m3", - "0.6m4", - "0.6m5", - "0.6m6", - "0.7.10p1", - "0.7.11p1", - "0.7.11p2", - "0.7.11p3", - "0.8.1p1", - "0.8.3p1", - "0.8.4p1", - "0.8.4p2", - "0.8.6p1", - "0.8.7p1", - "0.9-doduo", - "0.9-eevee", - "0.9-fearow", - "0.9-gyarados", - "0.9-horsea", - "0.9-ivysaur", - "2013-01-21T20:33:09+0100", - "2013-01-23T17:11:52+0100", - "2013-02-01T20:50:46+0100", - "2013-02-02T19:59:03+0100", - "2013-02-02T20:23:17+0100", - "2013-02-08T17:40:57+0000", - "2013-03-27T16:32:26+0100", - "2013-05-09T12:47:53+0200", - "2013-05-10T17:55:56+0200", - "2013-05-14T20:16:05+0200", - "2013-06-01T10:32:51+0200", - "2013-07-19T09:11:08+0000", - "2013-08-12T21:48:56+0200", - "2013-09-11T19-27-10", - "2013-12-23T17-51-15", - "2014-01-12T15-52-10", - "2.0.1rc2-git", - "3.0.0b3-", - "3.0b6dev-r41684", - "-class.-jw.util.version.Version-", - ] -) PACKAGE_TYPE_BY_GITHUB_ECOSYSTEM = { "MAVEN": "maven", @@ -313,92 +234,3 @@ def process_response(resp: dict, package_type: str) -> Iterable[AdvisoryData]: affected_packages=affected_packages, date_published=date_published, ) - - -class GitHubBasicImprover(Improver): - def __init__(self) -> None: - self.versions_fetcher_by_purl: Mapping[str, VersionAPI] = {} - - @property - def interesting_advisories(self) -> QuerySet: - return Advisory.objects.filter(created_by=GitHubAPIImporter.qualified_name) - - def get_package_versions( - self, package_url: PackageURL, until: Optional[datetime] = None - ) -> List[str]: - """ - Return a list of `valid_versions` for the `package_url` - """ - api_name = get_api_package_name(package_url) - if not api_name: - logger.error(f"Could not get versions for {package_url!r}") - return [] - versions_fetcher = self.versions_fetcher_by_purl.get(package_url) - if not versions_fetcher: - versions_fetcher: VersionAPI = VERSION_API_CLASSES_BY_PACKAGE_TYPE[package_url.type] - self.versions_fetcher_by_purl[package_url] = versions_fetcher() - - versions_fetcher = self.versions_fetcher_by_purl[package_url] - - self.versions_fetcher_by_purl[package_url] = versions_fetcher - return versions_fetcher.get_until(package_name=api_name, until=until).valid_versions - - def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: - """ - Yield Inferences for the given advisory data - """ - if not advisory_data.affected_packages: - return - try: - purl, affected_version_ranges, _ = AffectedPackage.merge( - advisory_data.affected_packages - ) - except UnMergeablePackageError: - logger.error(f"Cannot merge with different purls {advisory_data.affected_packages!r}") - return iter([]) - - pkg_type = purl.type - pkg_namespace = purl.namespace - pkg_name = purl.name - if purl.type == "golang": - # Problem with the Golang and Go that they provide full path - # FIXME: We need to get the PURL subpath for Go module - versions_fetcher = self.versions_fetcher_by_purl.get(purl) - if not versions_fetcher: - versions_fetcher = GoproxyVersionAPI() - self.versions_fetcher_by_purl[purl] = versions_fetcher - pkg_name = versions_fetcher.module_name_by_package_name.get(pkg_name, pkg_name) - - valid_versions = self.get_package_versions( - package_url=purl, until=advisory_data.date_published - ) - for affected_version_range in affected_version_ranges: - aff_vers, unaff_vers = resolve_version_range( - affected_version_range=affected_version_range, - package_versions=valid_versions, - ignorable_versions=WEIRD_IGNORABLE_VERSIONS, - ) - affected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in aff_vers - ] - - unaffected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in unaff_vers - ] - - affected_packages: List[LegacyAffectedPackage] = nearest_patched_package( - vulnerable_packages=affected_purls, resolved_packages=unaffected_purls - ) - - for ( - fixed_package, - affected_packages, - ) in get_affected_packages_by_patched_package(affected_packages).items(): - yield Inference.from_advisory_data( - advisory_data, - confidence=100, # We are getting all valid versions to get this inference - affected_purls=affected_packages, - fixed_purl=fixed_package, - ) diff --git a/vulnerabilities/importers/gitlab.py b/vulnerabilities/importers/gitlab.py index afdb3f865..21c349f93 100644 --- a/vulnerabilities/importers/gitlab.py +++ b/vulnerabilities/importers/gitlab.py @@ -9,17 +9,14 @@ import logging import traceback -from datetime import datetime from pathlib import Path from typing import Iterable from typing import List -from typing import Mapping from typing import Optional import pytz import saneyaml from dateutil import parser as dateparser -from django.db.models.query import QuerySet from packageurl import PackageURL from univers.version_range import RANGE_CLASS_BY_SCHEMES from univers.version_range import VersionRange @@ -30,19 +27,7 @@ from vulnerabilities.importer import AffectedPackage from vulnerabilities.importer import GitImporter from vulnerabilities.importer import Reference -from vulnerabilities.importer import UnMergeablePackageError -from vulnerabilities.improver import Improver -from vulnerabilities.improver import Inference -from vulnerabilities.models import Advisory -from vulnerabilities.package_managers import VERSION_API_CLASSES_BY_PACKAGE_TYPE -from vulnerabilities.package_managers import GoproxyVersionAPI -from vulnerabilities.package_managers import VersionAPI -from vulnerabilities.package_managers import get_api_package_name -from vulnerabilities.utils import AffectedPackage as LegacyAffectedPackage from vulnerabilities.utils import build_description -from vulnerabilities.utils import get_affected_packages_by_patched_package -from vulnerabilities.utils import nearest_patched_package -from vulnerabilities.utils import resolve_version_range logger = logging.getLogger(__name__) @@ -269,100 +254,3 @@ def parse_gitlab_advisory(file): date_published=date_published, affected_packages=affected_packages, ) - - -class GitLabBasicImprover(Improver): - """ - Get the nearest fixed_version and then resolve the version range with the help of all valid versions. - Generate inference between all the affected packages and the fixed_version that fixes all those affected packages. - - In case of gitlab advisory data we get a list of fixed_versions and a affected_version_range. - Since we can not determine which package fixes which range. - """ - - def __init__(self) -> None: - self.versions_fetcher_by_purl: Mapping[str, VersionAPI] = {} - - @property - def interesting_advisories(self) -> QuerySet: - return Advisory.objects.filter(created_by=GitLabAPIImporter.qualified_name) - - def get_package_versions( - self, package_url: PackageURL, until: Optional[datetime] = None - ) -> List[str]: - """ - Return a list of `valid_versions` for the `package_url` - """ - api_name = get_api_package_name(purl=package_url) - if not api_name: - logger.error(f"Could not get versions for {package_url!r}") - return [] - versions_fetcher = self.versions_fetcher_by_purl.get(package_url) - if not versions_fetcher: - versions_fetcher: VersionAPI = VERSION_API_CLASSES_BY_PACKAGE_TYPE[package_url.type] - self.versions_fetcher_by_purl[package_url] = versions_fetcher() - - versions_fetcher = self.versions_fetcher_by_purl[package_url] - - self.versions_fetcher_by_purl[package_url] = versions_fetcher - return versions_fetcher.get_until(package_name=api_name, until=until).valid_versions - - def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: - """ - Yield Inferences for the given advisory data - """ - if not advisory_data.affected_packages: - return iter([]) - try: - purl, affected_version_ranges, _ = AffectedPackage.merge( - advisory_data.affected_packages - ) - except UnMergeablePackageError: - logger.error(f"Cannot merge with different purls {advisory_data.affected_packages!r}") - return iter([]) - - pkg_type = purl.type - pkg_namespace = purl.namespace - pkg_name = purl.name - if purl.type == "golang": - # Problem with the Golang and Go that they provide full path - # FIXME: We need to get the PURL subpath for Go module - versions_fetcher = self.versions_fetcher_by_purl.get(purl) - if not versions_fetcher: - versions_fetcher = GoproxyVersionAPI() - self.versions_fetcher_by_purl[purl] = versions_fetcher - pkg_name = versions_fetcher.module_name_by_package_name.get(pkg_name, pkg_name) - - valid_versions = self.get_package_versions( - package_url=purl, until=advisory_data.date_published - ) - for affected_version_range in affected_version_ranges: - aff_vers, unaff_vers = resolve_version_range( - affected_version_range=affected_version_range, - package_versions=valid_versions, - ignorable_versions=[], - ) - affected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in aff_vers - ] - - unaffected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in unaff_vers - ] - - affected_packages: List[LegacyAffectedPackage] = nearest_patched_package( - vulnerable_packages=affected_purls, resolved_packages=unaffected_purls - ) - - for ( - fixed_package, - affected_packages, - ) in get_affected_packages_by_patched_package(affected_packages).items(): - yield Inference.from_advisory_data( - advisory_data, # We are getting all valid versions to get this inference - confidence=100, - affected_purls=affected_packages, - fixed_purl=fixed_package, - ) diff --git a/vulnerabilities/importers/istio.py b/vulnerabilities/importers/istio.py index 951fa5297..6030faeac 100644 --- a/vulnerabilities/importers/istio.py +++ b/vulnerabilities/importers/istio.py @@ -155,70 +155,3 @@ def get_data_from_md(self, path): with open(path) as f: front_matter, _ = split_markdown_front_matter(f.read()) return saneyaml.load(front_matter) - - -class IstioImprover(Improver): - def __init__(self) -> None: - self.versions_fetcher_by_purl: Mapping[str, VersionAPI] = {} - self.vesions_by_purl = {} - - @property - def interesting_advisories(self) -> QuerySet: - return Advisory.objects.filter(created_by=IstioImporter.qualified_name) - - def get_package_versions( - self, package_url: PackageURL, until: Optional[datetime] = None - ) -> List[str]: - """ - Return a list of `valid_versions` for the `package_url` - """ - api_name = "istio/istio" - versions_fetcher = GitHubTagsAPI() - return versions_fetcher.get_until(package_name=api_name, until=until).valid_versions - - def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: - """ - Yield Inferences for the given advisory data - """ - if not advisory_data.affected_packages: - return - for affected_package in advisory_data.affected_packages: - purl = affected_package.package - affected_version_range = affected_package.affected_version_range - pkg_type = purl.type - pkg_namespace = purl.namespace - pkg_name = purl.name - if not self.vesions_by_purl.get("istio/istio"): - valid_versions = self.get_package_versions( - package_url=purl, until=advisory_data.date_published - ) - self.vesions_by_purl["istio/istio"] = valid_versions - valid_versions = self.vesions_by_purl["istio/istio"] - aff_vers, unaff_vers = resolve_version_range( - affected_version_range=affected_version_range, - package_versions=valid_versions, - ) - affected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in aff_vers - ] - - unaffected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in unaff_vers - ] - - affected_packages: List[LegacyAffectedPackage] = nearest_patched_package( - vulnerable_packages=affected_purls, resolved_packages=unaffected_purls - ) - - for ( - fixed_package, - affected_packages, - ) in get_affected_packages_by_patched_package(affected_packages).items(): - yield Inference.from_advisory_data( - advisory_data, - confidence=100, # We are getting all valid versions to get this inference - affected_purls=affected_packages, - fixed_purl=fixed_package, - ) diff --git a/vulnerabilities/importers/nginx.py b/vulnerabilities/importers/nginx.py index 1320fc895..918f29f20 100644 --- a/vulnerabilities/importers/nginx.py +++ b/vulnerabilities/importers/nginx.py @@ -23,15 +23,8 @@ from vulnerabilities.importer import AffectedPackage from vulnerabilities.importer import Importer from vulnerabilities.importer import Reference -from vulnerabilities.importer import UnMergeablePackageError from vulnerabilities.importer import VulnerabilitySeverity -from vulnerabilities.improver import Improver -from vulnerabilities.improver import Inference -from vulnerabilities.models import Advisory -from vulnerabilities.package_managers import GitHubTagsAPI -from vulnerabilities.package_managers import PackageVersion from vulnerabilities.severity_systems import GENERIC -from vulnerabilities.utils import evolve_purl logger = logging.getLogger(__name__) @@ -223,122 +216,3 @@ def build_severity(severity): severity = severity.strip() if severity: return VulnerabilitySeverity(system=GENERIC, value=severity) - - -class NginxBasicImprover(Improver): - """ - Improve Nginx data by fetching the its GitHub repo versions and resolving - the vulnerable ranges. - """ - - @property - def interesting_advisories(self) -> QuerySet: - return Advisory.objects.filter(created_by=NginxImporter.qualified_name) - - def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: - all_versions = list(self.fetch_nginx_version_from_git_tags()) - yield from self.get_inferences_from_versions( - advisory_data=advisory_data, all_versions=all_versions - ) - - def get_inferences_from_versions( - self, advisory_data: AdvisoryData, all_versions: List[PackageVersion] - ) -> Iterable[Inference]: - """ - Yield inferences given an ``advisory_data`` and a ``all_versions`` of - PackageVersion. - """ - - try: - purl, affected_version_ranges, fixed_versions = AffectedPackage.merge( - advisory_data.affected_packages - ) - except UnMergeablePackageError: - logger.error( - f"NginxBasicImprover: Cannot merge with different purls: " - f"{advisory_data.affected_packages!r}" - ) - return iter([]) - - affected_purls = [] - for affected_version_range in affected_version_ranges: - for package_version in all_versions: - # FIXME: we should reference an NginxVersion tbd in univers - version = NginxVersion(package_version.value) - if is_vulnerable( - version=version, - affected_version_range=affected_version_range, - fixed_versions=fixed_versions, - ): - new_purl = evolve_purl(purl=purl, version=str(version)) - affected_purls.append(new_purl) - - # TODO: This also yields with a lower fixed version, maybe we should - # only yield fixes that are upgrades ? - for fixed_version in fixed_versions: - fixed_purl = evolve_purl(purl=purl, version=str(fixed_version)) - - yield Inference.from_advisory_data( - advisory_data, - # TODO: is 90 a correct confidence?? - confidence=90, - affected_purls=affected_purls, - fixed_purl=fixed_purl, - ) - - def fetch_nginx_version_from_git_tags(self): - """ - Yield all nginx PackageVersion from its git tags. - """ - nginx_versions = GitHubTagsAPI().fetch("nginx/nginx") - for version in nginx_versions: - cleaned = clean_nginx_git_tag(version.value) - yield PackageVersion(value=cleaned, release_date=version.release_date) - - -def clean_nginx_git_tag(tag): - """ - Return a cleaned ``version`` string from an nginx git tag. - - Nginx tags git release as in `release-1.2.3` - This removes the the `release-` prefix. - - For example: - >>> clean_nginx_git_tag("release-1.2.3") == "1.2.3" - True - >>> clean_nginx_git_tag("1.2.3") == "1.2.3" - True - """ - if tag.startswith("release-"): - _, _, tag = tag.partition("release-") - return tag - - -def is_vulnerable(version, affected_version_range, fixed_versions): - """ - Return True if the ``version`` Version for nginx is vulnerable according to - the nginx approach. - - A ``version`` is vulnerable as explained by @mdounin - in https://marc.info/?l=nginx&m=164070162912710&w=2 : - - "Note that it is generally trivial to find out if a version is - vulnerable or not from the information about a vulnerability, - without any knowledge about nginx branches. That is: - - - Check if the version is in "Vulnerable" range. If it's not, the - version is not vulnerable. - - - If it is, check if the branch is explicitly listed in the "Not - vulnerable". If it's not, the version is vulnerable. If it - is, check the minor number: if it's greater or equal to the - version listed as not vulnerable, the version is not vulnerable, - else the version is vulnerable." - - """ - if version in NginxVersionRange.from_string(affected_version_range.to_string()): - for fixed_version in fixed_versions: - if version.value.minor == fixed_version.value.minor and version >= fixed_version: - return False - return True - return False diff --git a/vulnerabilities/importers/npm.py b/vulnerabilities/importers/npm.py index 4b6df9055..da4e95828 100644 --- a/vulnerabilities/importers/npm.py +++ b/vulnerabilities/importers/npm.py @@ -52,7 +52,9 @@ def to_advisory_data(self, file: Path) -> List[AdvisoryData]: id = data.get("id") description = data.get("overview") or "" summary = data.get("title") or "" - date_published = parse(data.get("created_at")).replace(tzinfo=pytz.UTC) + date_published = None + if isinstance(data.get("created_at"), str): + date_published = parse(data.get("created_at")).replace(tzinfo=pytz.UTC) references = [] cvss_vector = data.get("cvss_vector") cvss_score = data.get("cvss_score") diff --git a/vulnerabilities/improvers/__init__.py b/vulnerabilities/improvers/__init__.py index 50e8ead0a..629ece67f 100644 --- a/vulnerabilities/improvers/__init__.py +++ b/vulnerabilities/improvers/__init__.py @@ -7,20 +7,23 @@ # See https://aboutcode.org for more information about nexB OSS projects. # -from vulnerabilities import importers from vulnerabilities.improvers import default -from vulnerabilities.improvers import oval +from vulnerabilities.improvers import valid_versions IMPROVERS_REGISTRY = [ default.DefaultImprover, - importers.nginx.NginxBasicImprover, - importers.github.GitHubBasicImprover, - importers.debian.DebianBasicImprover, - importers.gitlab.GitLabBasicImprover, - importers.istio.IstioImprover, - oval.DebianOvalBasicImprover, - oval.UbuntuOvalBasicImprover, - importers.apache_httpd.ApacheHTTPDImprover, + valid_versions.NginxBasicImprover, + valid_versions.ApacheHTTPDImprover, + valid_versions.DebianBasicImprover, + valid_versions.GitHubBasicImprover, + valid_versions.GitLabBasicImprover, + valid_versions.NpmImprover, + valid_versions.ElixirImprover, + valid_versions.ApacheTomcatImprover, + valid_versions.ApacheKafkaImprover, + valid_versions.IstioImprover, + valid_versions.DebianOvalImprover, + valid_versions.UbuntuOvalImprover, ] IMPROVERS_REGISTRY = {x.qualified_name: x for x in IMPROVERS_REGISTRY} diff --git a/vulnerabilities/improvers/oval.py b/vulnerabilities/improvers/oval.py deleted file mode 100644 index f489dab8a..000000000 --- a/vulnerabilities/improvers/oval.py +++ /dev/null @@ -1,177 +0,0 @@ -import logging -from datetime import datetime -from typing import Iterable -from typing import List -from typing import Mapping -from typing import Optional - -from django.db.models import Q -from django.db.models.query import QuerySet -from packageurl import PackageURL - -from vulnerabilities.importer import AdvisoryData -from vulnerabilities.importer import AffectedPackage -from vulnerabilities.importer import UnMergeablePackageError -from vulnerabilities.importers.debian_oval import DebianOvalImporter -from vulnerabilities.importers.github import get_api_package_name -from vulnerabilities.importers.github import resolve_version_range -from vulnerabilities.importers.ubuntu import UbuntuImporter -from vulnerabilities.improver import Improver -from vulnerabilities.improver import Inference -from vulnerabilities.models import Advisory -from vulnerabilities.package_managers import DebianVersionAPI -from vulnerabilities.package_managers import LaunchpadVersionAPI -from vulnerabilities.package_managers import VersionAPI -from vulnerabilities.utils import AffectedPackage as LegacyAffectedPackage -from vulnerabilities.utils import get_affected_packages_by_patched_package -from vulnerabilities.utils import nearest_patched_package - -logger = logging.getLogger(__name__) - - -VERSION_API_CLASS_BY_NAMESPACE = { - "debian": DebianVersionAPI, - "ubuntu": LaunchpadVersionAPI, -} - - -def get_package_versions( - package_url: PackageURL, - until: Optional[datetime] = None, - versions_fetcher_by_purl: Mapping[PackageURL, VersionAPI] = {}, -) -> List[str]: - """ - Return a list of `valid_versions` for the `package_url` - """ - api_name = get_api_package_name(package_url) - if not api_name: - logger.error(f"Could not get versions for {package_url!r}") - return [] - versions_fetcher = versions_fetcher_by_purl.get(package_url) - if not versions_fetcher: - versions_fetcher: VersionAPI = VERSION_API_CLASS_BY_NAMESPACE[package_url.namespace] - versions_fetcher_by_purl[package_url] = versions_fetcher() - - versions_fetcher = versions_fetcher_by_purl[package_url] - - versions_fetcher_by_purl[package_url] = versions_fetcher - return versions_fetcher.get_until(package_name=api_name, until=until).valid_versions - - -class DebianOvalBasicImprover(Improver): - def __init__(self) -> None: - self.versions_fetcher_by_purl: Mapping[str, VersionAPI] = {} - - @property - def interesting_advisories(self) -> QuerySet: - return Advisory.objects.filter(Q(created_by=DebianOvalImporter.qualified_name)) - - def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: - """ - Yield Inferences for the given advisory data - """ - if not advisory_data.affected_packages: - return - try: - purl, affected_version_ranges, _ = AffectedPackage.merge( - advisory_data.affected_packages - ) - except UnMergeablePackageError: - logger.error(f"Cannot merge with different purls {advisory_data.affected_packages!r}") - return iter([]) - - pkg_type = purl.type - pkg_namespace = purl.namespace - pkg_name = purl.name - valid_versions = get_package_versions( - package_url=purl, - until=advisory_data.date_published, - versions_fetcher_by_purl=self.versions_fetcher_by_purl, - ) - - for affected_version_range in affected_version_ranges: - aff_vers, unaff_vers = resolve_version_range( - affected_version_range=affected_version_range, - package_versions=valid_versions, - ) - affected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in aff_vers - ] - - unaffected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in unaff_vers - ] - - affected_packages: List[LegacyAffectedPackage] = nearest_patched_package( - vulnerable_packages=affected_purls, resolved_packages=unaffected_purls - ) - - for ( - fixed_package, - affected_packages, - ) in get_affected_packages_by_patched_package(affected_packages).items(): - yield Inference.from_advisory_data( - advisory_data, - confidence=100, # We are getting all valid versions to get this inference - affected_purls=affected_packages, - fixed_purl=fixed_package, - ) - - -class UbuntuOvalBasicImprover(Improver): - def __init__(self) -> None: - self.versions_fetcher_by_purl: Mapping[str, VersionAPI] = {} - - @property - def interesting_advisories(self) -> QuerySet: - return Advisory.objects.filter(Q(created_by=UbuntuImporter.qualified_name)) - - def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: - """ - Yield Inferences for the given advisory data - """ - if not advisory_data.affected_packages: - return - - for affected_package in advisory_data.affected_packages: - purl = affected_package.package - affected_version_range = affected_package.affected_version_range - pkg_type = purl.type - pkg_namespace = purl.namespace - pkg_name = purl.name - valid_versions = get_package_versions( - package_url=purl, - until=advisory_data.date_published, - versions_fetcher_by_purl=self.versions_fetcher_by_purl, - ) - - aff_vers, unaff_vers = resolve_version_range( - affected_version_range=affected_version_range, - package_versions=valid_versions, - ) - affected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in aff_vers - ] - - unaffected_purls = [ - PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) - for version in unaff_vers - ] - - affected_packages: List[LegacyAffectedPackage] = nearest_patched_package( - vulnerable_packages=affected_purls, resolved_packages=unaffected_purls - ) - - for ( - fixed_package, - affected_packages, - ) in get_affected_packages_by_patched_package(affected_packages).items(): - yield Inference.from_advisory_data( - advisory_data, - confidence=100, # We are getting all valid versions to get this inference - affected_purls=affected_packages, - fixed_purl=fixed_package, - ) diff --git a/vulnerabilities/improvers/valid_versions.py b/vulnerabilities/improvers/valid_versions.py new file mode 100644 index 000000000..26ee5033b --- /dev/null +++ b/vulnerabilities/improvers/valid_versions.py @@ -0,0 +1,479 @@ +# +# Copyright (c) nexB Inc. and others. All rights reserved. +# VulnerableCode is a trademark of nexB Inc. +# SPDX-License-Identifier: Apache-2.0 +# See http://www.apache.org/licenses/LICENSE-2.0 for the license text. +# See https://github.com/nexB/vulnerablecode for support or download. +# See https://aboutcode.org for more information about nexB OSS projects. +# + +import dataclasses +import logging +from datetime import datetime +from typing import Iterable +from typing import List +from typing import Mapping +from typing import Optional + +from django.db.models import Q +from django.db.models.query import QuerySet +from packageurl import PackageURL +from univers.versions import NginxVersion + +from vulnerabilities.importer import AdvisoryData +from vulnerabilities.importer import AffectedPackage +from vulnerabilities.importer import Importer +from vulnerabilities.importer import UnMergeablePackageError +from vulnerabilities.importers.apache_httpd import ApacheHTTPDImporter +from vulnerabilities.importers.apache_kafka import ApacheKafkaImporter +from vulnerabilities.importers.apache_tomcat import ApacheTomcatImporter +from vulnerabilities.importers.debian import DebianImporter +from vulnerabilities.importers.debian_oval import DebianOvalImporter +from vulnerabilities.importers.elixir_security import ElixirSecurityImporter +from vulnerabilities.importers.github import GitHubAPIImporter +from vulnerabilities.importers.gitlab import GitLabAPIImporter +from vulnerabilities.importers.istio import IstioImporter +from vulnerabilities.importers.nginx import NginxImporter +from vulnerabilities.importers.npm import NpmImporter +from vulnerabilities.importers.ubuntu import UbuntuImporter +from vulnerabilities.improver import MAX_CONFIDENCE +from vulnerabilities.improver import Improver +from vulnerabilities.improver import Inference +from vulnerabilities.models import Advisory +from vulnerabilities.package_managers import GitHubTagsAPI +from vulnerabilities.package_managers import GoproxyVersionAPI +from vulnerabilities.package_managers import PackageVersion +from vulnerabilities.package_managers import VersionAPI +from vulnerabilities.package_managers import get_api_package_name +from vulnerabilities.package_managers import get_version_fetcher +from vulnerabilities.utils import AffectedPackage as LegacyAffectedPackage +from vulnerabilities.utils import clean_nginx_git_tag +from vulnerabilities.utils import evolve_purl +from vulnerabilities.utils import get_affected_packages_by_patched_package +from vulnerabilities.utils import is_vulnerable_nginx_version +from vulnerabilities.utils import nearest_patched_package +from vulnerabilities.utils import resolve_version_range + +logger = logging.getLogger(__name__) + + +@dataclasses.dataclass(order=True) +class ValidVersionImprover(Improver): + importer: Importer + ignorable_versions: List[str] = dataclasses.field(default_factory=list) + + def __init__(self) -> None: + self.versions_fetcher_by_purl: Mapping[str, VersionAPI] = {} + + @property + def interesting_advisories(self) -> QuerySet: + return Advisory.objects.filter(Q(created_by=self.importer.qualified_name)) + + def get_package_versions( + self, package_url: PackageURL, until: Optional[datetime] = None + ) -> List[str]: + """ + Return a list of `valid_versions` for the `package_url` + """ + api_name = get_api_package_name(package_url) + if not api_name: + logger.error(f"Could not get versions for {package_url!r}") + return [] + versions_fetcher = self.versions_fetcher_by_purl.get(package_url) + if not versions_fetcher: + versions_fetcher = get_version_fetcher(package_url) + self.versions_fetcher_by_purl[package_url] = versions_fetcher() + + versions_fetcher = self.versions_fetcher_by_purl[package_url] + + self.versions_fetcher_by_purl[package_url] = versions_fetcher + return versions_fetcher.get_until(package_name=api_name, until=until).valid_versions + + def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: + """ + Yield Inferences for the given advisory data + """ + mergable = True + if not advisory_data.affected_packages: + return + + try: + purl, affected_version_ranges, fixed_versions = AffectedPackage.merge( + advisory_data.affected_packages + ) + except UnMergeablePackageError: + logger.error(f"Cannot merge with different purls {advisory_data.affected_packages!r}") + mergable = False + + if not mergable: + for affected_package in advisory_data.affected_packages: + purl = affected_package.package + affected_version_range = affected_package.affected_version_range + fixed_version = affected_package.fixed_version + pkg_type = purl.type + pkg_namespace = purl.namespace + pkg_name = purl.name + if not affected_version_range and fixed_version: + yield Inference.from_advisory_data( + advisory_data, # We are getting all valid versions to get this inference + confidence=MAX_CONFIDENCE, + affected_purls=[], + fixed_purl=PackageURL( + type=pkg_type, + namespace=pkg_namespace, + name=pkg_name, + version=str(fixed_version), + ), + ) + else: + valid_versions = self.get_package_versions( + package_url=purl, until=advisory_data.date_published + ) + yield from self.generate_inferences( + affected_version_range=affected_version_range, + pkg_type=pkg_type, + pkg_namespace=pkg_namespace, + pkg_name=pkg_name, + valid_versions=valid_versions, + advisory_data=advisory_data, + ) + + else: + pkg_type = purl.type + pkg_namespace = purl.namespace + pkg_name = purl.name + pkg_qualifiers = purl.qualifiers + fixed_purls = [ + PackageURL( + type=pkg_type, + namespace=pkg_namespace, + name=pkg_name, + version=str(version), + qualifiers=pkg_qualifiers, + ) + for version in fixed_versions + ] + if not affected_version_ranges: + for fixed_purl in fixed_purls or []: + yield Inference.from_advisory_data( + advisory_data, # We are getting all valid versions to get this inference + confidence=MAX_CONFIDENCE, + affected_purls=[], + fixed_purl=fixed_purl, + ) + else: + if purl.type == "golang": + # Problem with the Golang and Go that they provide full path + # FIXME: We need to get the PURL subpath for Go module + versions_fetcher = self.versions_fetcher_by_purl.get(purl) + if not versions_fetcher: + versions_fetcher = GoproxyVersionAPI() + self.versions_fetcher_by_purl[purl] = versions_fetcher + pkg_name = versions_fetcher.module_name_by_package_name.get(pkg_name, pkg_name) + + valid_versions = self.get_package_versions( + package_url=purl, until=advisory_data.date_published + ) + for affected_version_range in affected_version_ranges: + yield from self.generate_inferences( + affected_version_range=affected_version_range, + pkg_type=pkg_type, + pkg_namespace=pkg_namespace, + pkg_name=pkg_name, + valid_versions=valid_versions, + advisory_data=advisory_data, + ) + + def generate_inferences( + self, + affected_version_range, + pkg_type, + pkg_namespace, + pkg_name, + valid_versions, + advisory_data, + ): + """ + Generate Inferences for the given `affected_version_range` and `valid_versions` + """ + aff_vers, unaff_vers = resolve_version_range( + affected_version_range=affected_version_range, + ignorable_versions=self.ignorable_versions, + package_versions=valid_versions, + ) + + affected_purls = list( + self.expand_verion_range_to_purls(pkg_type, pkg_namespace, pkg_name, aff_vers) + ) + + unaffected_purls = list( + self.expand_verion_range_to_purls(pkg_type, pkg_namespace, pkg_name, unaff_vers) + ) + + affected_packages: List[LegacyAffectedPackage] = nearest_patched_package( + vulnerable_packages=affected_purls, resolved_packages=unaffected_purls + ) + + for ( + fixed_package, + affected_purls, + ) in get_affected_packages_by_patched_package(affected_packages).items(): + yield Inference.from_advisory_data( + advisory_data, + confidence=100, # We are getting all valid versions to get this inference + affected_purls=affected_purls, + fixed_purl=fixed_package, + ) + + def expand_verion_range_to_purls(self, pkg_type, pkg_namespace, pkg_name, versions): + for version in versions: + yield PackageURL(type=pkg_type, namespace=pkg_namespace, name=pkg_name, version=version) + + +class NginxBasicImprover(Improver): + """ + Improve Nginx data by fetching the its GitHub repo versions and resolving + the vulnerable ranges. + """ + + @property + def interesting_advisories(self) -> QuerySet: + return Advisory.objects.filter(created_by=NginxImporter.qualified_name) + + def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: + all_versions = list(self.fetch_nginx_version_from_git_tags()) + yield from self.get_inferences_from_versions( + advisory_data=advisory_data, all_versions=all_versions + ) + + def get_inferences_from_versions( + self, advisory_data: AdvisoryData, all_versions: List[PackageVersion] + ) -> Iterable[Inference]: + """ + Yield inferences given an ``advisory_data`` and a ``all_versions`` of + PackageVersion. + """ + + try: + purl, affected_version_ranges, fixed_versions = AffectedPackage.merge( + advisory_data.affected_packages + ) + except UnMergeablePackageError: + logger.error( + f"NginxBasicImprover: Cannot merge with different purls: " + f"{advisory_data.affected_packages!r}" + ) + return iter([]) + + affected_purls = [] + for affected_version_range in affected_version_ranges: + for package_version in all_versions: + # FIXME: we should reference an NginxVersion tbd in univers + version = NginxVersion(package_version.value) + if is_vulnerable_nginx_version( + version=version, + affected_version_range=affected_version_range, + fixed_versions=fixed_versions, + ): + new_purl = evolve_purl(purl=purl, version=str(version)) + affected_purls.append(new_purl) + + # TODO: This also yields with a lower fixed version, maybe we should + # only yield fixes that are upgrades ? + for fixed_version in fixed_versions: + fixed_purl = evolve_purl(purl=purl, version=str(fixed_version)) + + yield Inference.from_advisory_data( + advisory_data, + # TODO: is 90 a correct confidence?? + confidence=90, + affected_purls=affected_purls, + fixed_purl=fixed_purl, + ) + + def fetch_nginx_version_from_git_tags(self): + """ + Yield all nginx PackageVersion from its git tags. + """ + nginx_versions = GitHubTagsAPI().fetch("nginx/nginx") + for version in nginx_versions: + cleaned = clean_nginx_git_tag(version.value) + yield PackageVersion(value=cleaned, release_date=version.release_date) + + +class ApacheHTTPDImprover(ValidVersionImprover): + importer = ApacheHTTPDImporter + ignorable_versions = { + "AGB_BEFORE_AAA_CHANGES", + "APACHE_1_2b1", + "APACHE_1_2b10", + "APACHE_1_2b11", + "APACHE_1_2b2", + "APACHE_1_2b3", + "APACHE_1_2b4", + "APACHE_1_2b5", + "APACHE_1_2b6", + "APACHE_1_2b7", + "APACHE_1_2b8", + "APACHE_1_2b9", + "APACHE_1_3_PRE_NT", + "APACHE_1_3a1", + "APACHE_1_3b1", + "APACHE_1_3b2", + "APACHE_1_3b3", + "APACHE_1_3b5", + "APACHE_1_3b6", + "APACHE_1_3b7", + "APACHE_2_0_2001_02_09", + "APACHE_2_0_52_WROWE_RC1", + "APACHE_2_0_ALPHA", + "APACHE_2_0_ALPHA_2", + "APACHE_2_0_ALPHA_3", + "APACHE_2_0_ALPHA_4", + "APACHE_2_0_ALPHA_5", + "APACHE_2_0_ALPHA_6", + "APACHE_2_0_ALPHA_7", + "APACHE_2_0_ALPHA_8", + "APACHE_2_0_ALPHA_9", + "APACHE_2_0_BETA_CANDIDATE_1", + "APACHE_BIG_SYMBOL_RENAME_POST", + "APACHE_BIG_SYMBOL_RENAME_PRE", + "CHANGES", + "HTTPD_LDAP_1_0_0", + "INITIAL", + "MOD_SSL_2_8_3", + "PCRE_3_9", + "POST_APR_SPLIT", + "PRE_APR_CHANGES", + "STRIKER_2_0_51_RC1", + "STRIKER_2_0_51_RC2", + "STRIKER_2_1_0_RC1", + "WROWE_2_0_43_PRE1", + "apache-1_3-merge-1-post", + "apache-1_3-merge-1-pre", + "apache-1_3-merge-2-post", + "apache-1_3-merge-2-pre", + "apache-apr-merge-3", + "apache-doc-split-01", + "dg_last_1_2_doc_merge", + "djg-apache-nspr-07", + "djg_nspr_split", + "moving_to_httpd_module", + "mpm-3", + "mpm-merge-1", + "mpm-merge-2", + "post_ajp_proxy", + "pre_ajp_proxy", + } + + +class ApacheTomcatImprover(ValidVersionImprover): + importer = ApacheTomcatImporter + ignorable_versions = [] + + +class ApacheKafkaImprover(ValidVersionImprover): + importer = ApacheKafkaImporter + ignorable_versions = [] + + +class DebianBasicImprover(ValidVersionImprover): + importer = DebianImporter + ignorable_versions = [] + + +class GitLabBasicImprover(ValidVersionImprover): + importer = GitLabAPIImporter + ignorable_versions = [] + + +class GitHubBasicImprover(ValidVersionImprover): + importer = GitHubAPIImporter + ignorable_versions = frozenset( + [ + "0.1-bulbasaur", + "0.1-charmander", + "0.3m1", + "0.3m2", + "0.3m3", + "0.3m4", + "0.3m5", + "0.4m1", + "0.4m2", + "0.4m3", + "0.4m4", + "0.4m5", + "0.5m1", + "0.5m2", + "0.5m3", + "0.5m4", + "0.5m5", + "0.6m1", + "0.6m2", + "0.6m3", + "0.6m4", + "0.6m5", + "0.6m6", + "0.7.10p1", + "0.7.11p1", + "0.7.11p2", + "0.7.11p3", + "0.8.1p1", + "0.8.3p1", + "0.8.4p1", + "0.8.4p2", + "0.8.6p1", + "0.8.7p1", + "0.9-doduo", + "0.9-eevee", + "0.9-fearow", + "0.9-gyarados", + "0.9-horsea", + "0.9-ivysaur", + "2013-01-21T20:33:09+0100", + "2013-01-23T17:11:52+0100", + "2013-02-01T20:50:46+0100", + "2013-02-02T19:59:03+0100", + "2013-02-02T20:23:17+0100", + "2013-02-08T17:40:57+0000", + "2013-03-27T16:32:26+0100", + "2013-05-09T12:47:53+0200", + "2013-05-10T17:55:56+0200", + "2013-05-14T20:16:05+0200", + "2013-06-01T10:32:51+0200", + "2013-07-19T09:11:08+0000", + "2013-08-12T21:48:56+0200", + "2013-09-11T19-27-10", + "2013-12-23T17-51-15", + "2014-01-12T15-52-10", + "2.0.1rc2-git", + "3.0.0b3-", + "3.0b6dev-r41684", + "-class.-jw.util.version.Version-", + ] + ) + + +class NpmImprover(ValidVersionImprover): + importer = NpmImporter + ignorable_versions = [] + + +class ElixirImprover(ValidVersionImprover): + importer = ElixirSecurityImporter + ignorable_versions = [] + + +class IstioImprover(ValidVersionImprover): + importer = IstioImporter + ignorable_versions = [] + + +class DebianOvalImprover(ValidVersionImprover): + importer = DebianOvalImporter + ignorable_versions = [] + + +class UbuntuOvalImprover(ValidVersionImprover): + importer = UbuntuImporter + ignorable_versions = [] diff --git a/vulnerabilities/package_managers.py b/vulnerabilities/package_managers.py index f210f0f98..e9cc34af6 100644 --- a/vulnerabilities/package_managers.py +++ b/vulnerabilities/package_managers.py @@ -692,6 +692,13 @@ def fetch(self, pkg: str) -> Iterable[PackageVersion]: VERSION_API_CLASSES_BY_PACKAGE_TYPE = {cls.package_type: cls for cls in VERSION_API_CLASSES} +VERSION_API_CLASSES_BY_PACKAGE_TYPE["apache"] = GitHubTagsAPI + +VERSION_API_CLASS_BY_PACKAGE_NAMESPACE = { + "debian": DebianVersionAPI, + "ubuntu": LaunchpadVersionAPI, +} + def get_api_package_name(purl: PackageURL) -> str: """ @@ -703,11 +710,21 @@ def get_api_package_name(purl: PackageURL) -> str: """ if not purl.name: return None + if purl.type == "apache": + return f"{purl.type}/{purl.name}" if purl.type in ("nuget", "pypi", "gem", "deb") or not purl.namespace: return purl.name if purl.type == "maven": return f"{purl.namespace}:{purl.name}" - if purl.type in ("composer", "golang", "npm"): + if purl.type in ("composer", "golang", "npm", "github"): return f"{purl.namespace}/{purl.name}" logger.error(f"get_api_package_name: Unknown PURL {purl!r}") + + +def get_version_fetcher(package_url): + if package_url.type == "deb": + versions_fetcher: VersionAPI = VERSION_API_CLASS_BY_PACKAGE_NAMESPACE[package_url.namespace] + else: + versions_fetcher: VersionAPI = VERSION_API_CLASSES_BY_PACKAGE_TYPE[package_url.type] + return versions_fetcher diff --git a/vulnerabilities/tests/test_apache_httpd.py b/vulnerabilities/tests/test_apache_httpd.py index 48d0a028e..a57437d01 100644 --- a/vulnerabilities/tests/test_apache_httpd.py +++ b/vulnerabilities/tests/test_apache_httpd.py @@ -18,8 +18,8 @@ from vulnerabilities.importer import AdvisoryData from vulnerabilities.importers.apache_httpd import ApacheHTTPDImporter -from vulnerabilities.importers.apache_httpd import ApacheHTTPDImprover from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import ApacheHTTPDImprover from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -122,7 +122,7 @@ def test_to_advisory_CVE_2022_28614(): util_tests.check_results_against_json(result, expected_file) -@mock.patch("vulnerabilities.importers.apache_httpd.ApacheHTTPDImprover.get_package_versions") +@mock.patch("vulnerabilities.improvers.valid_versions.ApacheHTTPDImprover.get_package_versions") def test_apache_httpd_improver(mock_response): advisory_file = os.path.join(TEST_DATA, f"CVE-2021-44224-apache-httpd-expected.json") expected_file = os.path.join(TEST_DATA, f"apache-httpd-improver-expected.json") diff --git a/vulnerabilities/tests/test_apache_kafka.py b/vulnerabilities/tests/test_apache_kafka.py index 5646b5554..36e387c4e 100644 --- a/vulnerabilities/tests/test_apache_kafka.py +++ b/vulnerabilities/tests/test_apache_kafka.py @@ -7,11 +7,16 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import json import os +from unittest.mock import patch import pytest +from vulnerabilities.importer import AdvisoryData from vulnerabilities.importers.apache_kafka import ApacheKafkaImporter +from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import ApacheKafkaImprover from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -32,6 +37,32 @@ def test_to_advisory(): util_tests.check_results_against_json(result, expected_file) +@patch("vulnerabilities.improvers.valid_versions.ApacheKafkaImprover.get_package_versions") +def test_apache_tomcat_improver(mock_response): + advisory_file = os.path.join(TEST_DATA, f"to-advisory-apache_kafka-expected.json") + with open(advisory_file) as exp: + advisories = [AdvisoryData.from_dict(adv) for adv in (json.load(exp))] + mock_response.return_value = [ + "1.1.0", + "1.1.1", + "1.1.2", + "1.1.3", + "1.1.4", + "1.1.5", + "1.1.6", + "1.1.7", + "1.1.8", + ] + improvers = [ApacheKafkaImprover(), DefaultImprover()] + result = [] + for improver in improvers: + for advisory in advisories: + inference = [data.to_dict() for data in improver.get_inferences(advisory)] + result.extend(inference) + expected_file = os.path.join(TEST_DATA, f"apache-kafka-improver-expected.json") + util_tests.check_results_against_json(result, expected_file) + + def to_advisory_changed_cve(): with open(os.path.join(TEST_DATA, "cve-list-changed-cve.html")) as f: raw_data = f.read() diff --git a/vulnerabilities/tests/test_apache_tomcat.py b/vulnerabilities/tests/test_apache_tomcat.py index 4c5033e14..7005e7d26 100644 --- a/vulnerabilities/tests/test_apache_tomcat.py +++ b/vulnerabilities/tests/test_apache_tomcat.py @@ -7,8 +7,9 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import json import os -from unittest import TestCase +from unittest.mock import patch from univers.version_constraint import VersionConstraint from univers.version_range import ApacheVersionRange @@ -16,10 +17,13 @@ from univers.versions import MavenVersion from univers.versions import SemverVersion +from vulnerabilities.importer import AdvisoryData from vulnerabilities.importers.apache_tomcat import ApacheTomcatImporter from vulnerabilities.importers.apache_tomcat import extract_tomcat_advisory_data_from_page from vulnerabilities.importers.apache_tomcat import to_version_ranges_apache from vulnerabilities.importers.apache_tomcat import to_version_ranges_maven +from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import ApacheTomcatImprover from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -39,6 +43,34 @@ def test_method_extract_advisories_from_page(): util_tests.check_results_against_json(results, expected_file) +@patch("vulnerabilities.improvers.valid_versions.ApacheTomcatImprover.get_package_versions") +def test_apache_tomcat_improver(mock_response): + advisory_file = os.path.join( + TEST_DATA, f"parse-apache_tomcat-selected-advisories-expected.json" + ) + with open(advisory_file) as exp: + advisories = [AdvisoryData.from_dict(adv) for adv in (json.load(exp))] + mock_response.return_value = [ + "1.1.0", + "1.1.1", + "1.1.2", + "1.1.3", + "1.1.4", + "1.1.5", + "1.1.6", + "1.1.7", + "1.1.8", + ] + improvers = [ApacheTomcatImprover(), DefaultImprover()] + result = [] + for improver in improvers: + for advisory in advisories: + inference = [data.to_dict() for data in improver.get_inferences(advisory)] + result.extend(inference) + expected_file = os.path.join(TEST_DATA, f"apache-tomcat-improver-expected.json") + util_tests.check_results_against_json(result, expected_file) + + def test_extract_advisories_from_page(): page = """

6 April 2021 Fixed in Apache Tomcat 10.0.5

diff --git a/vulnerabilities/tests/test_data/apache_kafka/apache-kafka-improver-expected.json b/vulnerabilities/tests/test_data/apache_kafka/apache-kafka-improver-expected.json new file mode 100644 index 000000000..451421759 --- /dev/null +++ b/vulnerabilities/tests/test_data/apache_kafka/apache-kafka-improver-expected.json @@ -0,0 +1,1768 @@ +[ + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-17196" + ], + "confidence": 100, + "summary": "In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.4", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.5", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.7", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.8", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [ + { + "reference_id": "CVE-2018-17196", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-17196", + "url": "https://kafka.apache.org/cve-list#CVE-2018-17196", + "severities": [] + }, + { + "reference_id": "CVE-2018-17196", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17196", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2022-34917" + ], + "confidence": 100, + "summary": "This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.0.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.2.1", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.2", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2022-34917", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://kafka.apache.org/cve-list#CVE-2022-34917", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34917", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2022-34917" + ], + "confidence": 100, + "summary": "This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.0.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.2.1", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.0.2", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2022-34917", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://kafka.apache.org/cve-list#CVE-2022-34917", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34917", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2022-34917" + ], + "confidence": 100, + "summary": "This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.0.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.2.1", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.1.2", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2022-34917", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://kafka.apache.org/cve-list#CVE-2022-34917", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34917", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2022-34917" + ], + "confidence": 100, + "summary": "This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.0.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.2.1", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "3.2.3", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2022-34917", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://kafka.apache.org/cve-list#CVE-2022-34917", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34917", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2021-38153" + ], + "confidence": 100, + "summary": "Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.0.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.3.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.3.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.4.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.4.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.5.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.7.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.7.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.3", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2021-38153", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2021-38153", + "url": "https://kafka.apache.org/cve-list#CVE-2021-38153", + "severities": [] + }, + { + "reference_id": "CVE-2021-38153", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38153", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2021-38153" + ], + "confidence": 100, + "summary": "Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.0.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.3.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.3.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.4.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.4.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.5.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.7.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.7.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.7.2", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2021-38153", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2021-38153", + "url": "https://kafka.apache.org/cve-list#CVE-2021-38153", + "severities": [] + }, + { + "reference_id": "CVE-2021-38153", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38153", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2021-38153" + ], + "confidence": 100, + "summary": "Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.0.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.3.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.3.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.4.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.4.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.5.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.6.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.7.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.7.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.8.1", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2021-38153", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2021-38153", + "url": "https://kafka.apache.org/cve-list#CVE-2021-38153", + "severities": [] + }, + { + "reference_id": "CVE-2021-38153", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38153", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2019-12399" + ], + "confidence": 100, + "summary": "When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value (the externalized secret variable is not the whole configuration property value), then any client can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret rather than the externalized secrets variable. Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher where this vulnerability has been fixed.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.0.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.3.0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "2.2.2", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2019-12399", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2019-12399", + "url": "https://kafka.apache.org/cve-list#CVE-2019-12399", + "severities": [] + }, + { + "reference_id": "CVE-2019-12399", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12399", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-17196" + ], + "confidence": 100, + "summary": "In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [ + { + "reference_id": "CVE-2018-17196", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-17196", + "url": "https://kafka.apache.org/cve-list#CVE-2018-17196", + "severities": [] + }, + { + "reference_id": "CVE-2018-17196", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17196", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-1288" + ], + "confidence": 100, + "summary": "Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.9.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.9.0+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.2+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.0.0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.2+2", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2018-1288", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://kafka.apache.org/cve-list#CVE-2018-1288", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1288", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-1288" + ], + "confidence": 100, + "summary": "Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.9.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.9.0+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.2+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.0.0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+3", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2018-1288", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://kafka.apache.org/cve-list#CVE-2018-1288", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1288", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-1288" + ], + "confidence": 100, + "summary": "Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.9.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.9.0+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.2+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.0.0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.0.1", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2018-1288", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://kafka.apache.org/cve-list#CVE-2018-1288", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1288", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-1288" + ], + "confidence": 100, + "summary": "Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.9.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.9.0+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.2+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.0.0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.1.0", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2018-1288", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://kafka.apache.org/cve-list#CVE-2018-1288", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1288", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2017-12610" + ], + "confidence": 100, + "summary": "Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.2+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+1", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.2+2", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2017-12610", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2017-12610", + "url": "https://kafka.apache.org/cve-list#CVE-2017-12610", + "severities": [] + }, + { + "reference_id": "CVE-2017-12610", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12610", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2017-12610" + ], + "confidence": 100, + "summary": "Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.2+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+1", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+2", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2017-12610", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2017-12610", + "url": "https://kafka.apache.org/cve-list#CVE-2017-12610", + "severities": [] + }, + { + "reference_id": "CVE-2017-12610", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12610", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2017-12610" + ], + "confidence": 100, + "summary": "Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.10.2+1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "0.11.0+1", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "kafka", + "version": "1.0.0", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2017-12610", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2017-12610", + "url": "https://kafka.apache.org/cve-list#CVE-2017-12610", + "severities": [] + }, + { + "reference_id": "CVE-2017-12610", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12610", + "severities": [] + } + ], + "weaknesses": [] + } +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/apache_tomcat/apache-tomcat-improver-expected.json b/vulnerabilities/tests/test_data/apache_tomcat/apache-tomcat-improver-expected.json new file mode 100644 index 000000000..41f28b3c9 --- /dev/null +++ b/vulnerabilities/tests/test_data/apache_tomcat/apache-tomcat-improver-expected.json @@ -0,0 +1,2278 @@ +[ + { + "vulnerability_id": null, + "aliases": [ + "CVE-2005-4836" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "1.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "1.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "1.1.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "1.1.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "1.1.4", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "1.1.5", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "1.1.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "1.1.7", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "1.1.8", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [ + { + "reference_id": "CVE-2005-4836", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4836", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2005-4836" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "1.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "1.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "1.1.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "1.1.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "1.1.4", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "1.1.5", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "1.1.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "1.1.7", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "1.1.8", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [ + { + "reference_id": "CVE-2005-4836", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4836", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2020-9484" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.0+M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.41", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.43", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2020-9484", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9484", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2020-9484" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.0.M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.41", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.43", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2020-9484", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9484", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2021-25329" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.0+M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.41", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.43", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2021-25329", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25329", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2021-25329" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.0.M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.41", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.43", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2021-25329", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25329", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2021-25122" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.0+M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.41", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.43", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2021-25122", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25122", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://github.com/apache/tomcat/commit/d47c20a776e8919eaca8da9390a32bc8bf8210b1", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2021-25122" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.0.M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.41", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.43", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2021-25122", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25122", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://github.com/apache/tomcat/commit/d47c20a776e8919eaca8da9390a32bc8bf8210b1", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2020-9484" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.0+M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.34", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.35", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2020-9484", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9484", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2020-9484" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.0.M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.34", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.35", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2020-9484", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9484", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-8014" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.0+M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.8", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "9.0.9", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2018-8014", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1831726", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-8014" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.0.M1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.8", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "9.0.9", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2018-8014", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1831726", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2016-3092" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.0.0+RC1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.0.35", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.5.2", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.0.36", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2016-3092", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1743722", + "severities": [] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1743738", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2016-3092" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.0.0+RC1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.0.35", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.5.2", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "8.5.3", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2016-3092", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1743722", + "severities": [] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1743738", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2016-3092" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.0.0.RC1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.0.35", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.5.2", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.0.36", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2016-3092", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1743722", + "severities": [] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1743738", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2016-3092" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.0.0.RC1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.0.35", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.5.2", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "8.5.3", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2016-3092", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1743722", + "severities": [] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=1743738", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2008-5515" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2008-5515", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5515", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=782757", + "severities": [] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=783291", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2008-5515" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2008-5515", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5515", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=782757", + "severities": [] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=783291", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2009-0033" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2009-0033", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0033", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=781362", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2009-0033" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2009-0033", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0033", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=781362", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2009-0580" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2009-0580", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0580", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=781379", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2009-0580" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2009-0580", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0580", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=781379", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2009-0781" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2009-0781", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0781", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=750928", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2009-0781" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2009-0781", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0781", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=750928", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2009-0783" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2009-0783", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0783", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=681156", + "severities": [] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=781542", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2009-0783" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.27", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "5.5.28", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2009-0783", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0783", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=681156", + "severities": [] + }, + { + "reference_id": "", + "url": "https://svn.apache.org/viewvc?view=rev&rev=781542", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2005-4836" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.1.0+SVN", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.1.15", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [ + { + "reference_id": "CVE-2005-4836", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4836", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2005-4836" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.1.SVN", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.1.15", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [ + { + "reference_id": "CVE-2005-4836", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4836", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2008-4308" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.1.32", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.1.34", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.1.35", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2008-4308", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4308", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2008-4308" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.1.32", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.1.34", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.1.35", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2008-4308", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4308", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2002-0935" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.0.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.0.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.0.4", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.0.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.1.2", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "4.1.3", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2002-0935", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0935", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2002-0935" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.0.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.0.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.0.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.0.4", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.0.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.1.2", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "4.1.3", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2002-0935", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0935", + "severities": [ + { + "system": "apache_tomcat", + "value": "Important", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2002-2007" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.2.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.2.4", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.3.0-a", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2002-2007", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2007", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2002-2007" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.2.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.2.4", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.3a", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2002-2007", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2007", + "severities": [ + { + "system": "apache_tomcat", + "value": "Moderate", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2002-2006" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.2.4", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.3.0-a", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2002-2006", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2006", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2002-2006" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.2.4", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.3a", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2002-2006", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2006", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2000-0760" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.2.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.2.4", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "apache", + "namespace": null, + "name": "tomcat", + "version": "3.3.0-a", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2000-0760", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0760", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2000-0760" + ], + "confidence": 100, + "summary": "", + "affected_purls": [ + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.2.4", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "maven", + "namespace": "org.apache.tomcat", + "name": "tomcat", + "version": "3.3a", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "CVE-2000-0760", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0760", + "severities": [ + { + "system": "apache_tomcat", + "value": "Low", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + } +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/debian-improver-expected.json b/vulnerabilities/tests/test_data/debian-improver-expected.json index b065c349b..428564017 100644 --- a/vulnerabilities/tests/test_data/debian-improver-expected.json +++ b/vulnerabilities/tests/test_data/debian-improver-expected.json @@ -161,102 +161,6 @@ ], "weaknesses": [] }, - { - "vulnerability_id": null, - "aliases": [ - "CVE-2021-37231" - ], - "confidence": 100, - "summary": "A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499f through APar_readX() in src/util.cpp while parsing a crafted mp4 file because of the missing boundary check.", - "affected_purls": [ - { - "type": "deb", - "namespace": "debian", - "name": "atomicparsley", - "version": "0.9.6-1", - "qualifiers": { - "distro": "stretch" - }, - "subpath": null - }, - { - "type": "deb", - "namespace": "debian", - "name": "atomicparsley", - "version": "0.9.6-2", - "qualifiers": { - "distro": "stretch" - }, - "subpath": null - } - ], - "fixed_purl": { - "type": "deb", - "namespace": "debian", - "name": "atomicparsley", - "version": "20210715.151551.e7ad03a-1", - "qualifiers": { - "distro": "stretch" - }, - "subpath": null - }, - "references": [ - { - "reference_id": "993372", - "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993372", - "severities": [] - } - ], - "weaknesses": [] - }, - { - "vulnerability_id": null, - "aliases": [ - "CVE-2021-37232" - ], - "confidence": 100, - "summary": "A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_buffer while reading more bytes in APar_read64.", - "affected_purls": [ - { - "type": "deb", - "namespace": "debian", - "name": "atomicparsley", - "version": "0.9.6-1", - "qualifiers": { - "distro": "stretch" - }, - "subpath": null - }, - { - "type": "deb", - "namespace": "debian", - "name": "atomicparsley", - "version": "0.9.6-2", - "qualifiers": { - "distro": "stretch" - }, - "subpath": null - } - ], - "fixed_purl": { - "type": "deb", - "namespace": "debian", - "name": "atomicparsley", - "version": "20210715.151551.e7ad03a-1", - "qualifiers": { - "distro": "stretch" - }, - "subpath": null - }, - "references": [ - { - "reference_id": "993366", - "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993366", - "severities": [] - } - ], - "weaknesses": [] - }, { "vulnerability_id": null, "aliases": [ diff --git a/vulnerabilities/tests/test_data/debian-oval-improver-expected.json b/vulnerabilities/tests/test_data/debian-oval-improver-expected.json new file mode 100644 index 000000000..6bbe60285 --- /dev/null +++ b/vulnerabilities/tests/test_data/debian-oval-improver-expected.json @@ -0,0 +1,196 @@ +[ + { + "vulnerability_id": null, + "aliases": [ + "CVE-2001-1593" + ], + "confidence": 100, + "summary": "security update", + "affected_purls": [ + { + "type": "deb", + "namespace": "debian", + "name": "a2ps", + "version": "1.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "a2ps", + "version": "1.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "a2ps", + "version": "1.1.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "a2ps", + "version": "1.1.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "a2ps", + "version": "1.1.4", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "a2ps", + "version": "1.1.5", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "a2ps", + "version": "1.1.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "a2ps", + "version": "1.1.7", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "a2ps", + "version": "1.1.8", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2002-2443" + ], + "confidence": 100, + "summary": "denial of service", + "affected_purls": [ + { + "type": "deb", + "namespace": "debian", + "name": "krb5", + "version": "1.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "krb5", + "version": "1.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "krb5", + "version": "1.1.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "krb5", + "version": "1.1.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "krb5", + "version": "1.1.4", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "krb5", + "version": "1.1.5", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "krb5", + "version": "1.1.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "krb5", + "version": "1.1.7", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "debian", + "name": "krb5", + "version": "1.1.8", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2001-1593" + ], + "confidence": 100, + "summary": "security update", + "affected_purls": [], + "fixed_purl": null, + "references": [], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2002-2443" + ], + "confidence": 100, + "summary": "denial of service", + "affected_purls": [], + "fixed_purl": null, + "references": [], + "weaknesses": [] + } +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/elixir_security/elixir-improver-expected.json b/vulnerabilities/tests/test_data/elixir_security/elixir-improver-expected.json new file mode 100644 index 000000000..f076bb881 --- /dev/null +++ b/vulnerabilities/tests/test_data/elixir_security/elixir-improver-expected.json @@ -0,0 +1,54 @@ +[ + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-20301" + ], + "confidence": 100, + "summary": "The Coherence library has \"Mass Assignment\"-like vulnerabilities.\n", + "affected_purls": [ + { + "type": "hex", + "namespace": null, + "name": "coherence", + "version": "0.1.0", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": { + "type": "hex", + "namespace": null, + "name": "coherence", + "version": "0.5.2", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "", + "url": "https://github.com/smpallen99/coherence/issues/270", + "severities": [] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2018-20301" + ], + "confidence": 100, + "summary": "The Coherence library has \"Mass Assignment\"-like vulnerabilities.\n", + "affected_purls": [], + "fixed_purl": null, + "references": [ + { + "reference_id": "", + "url": "https://github.com/smpallen99/coherence/issues/270", + "severities": [] + } + ], + "weaknesses": [] + } +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/npm-improver-expected.json b/vulnerabilities/tests/test_data/npm-improver-expected.json new file mode 100644 index 000000000..391b93c57 --- /dev/null +++ b/vulnerabilities/tests/test_data/npm-improver-expected.json @@ -0,0 +1,190 @@ +[ + { + "vulnerability_id": null, + "aliases": [ + "CVE-2013-4116" + ], + "confidence": 100, + "summary": "Predictable temp filenames allow overwrite of arbitrary files\nnpm versions before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.", + "affected_purls": [ + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "0.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "0.5.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "0.5.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "1.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "1.1.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "1.1.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "1.1.4", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "1.1.5", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "1.1.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "1.1.7", + "qualifiers": null, + "subpath": null + }, + { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "1.1.8", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [ + { + "reference_id": "", + "url": "https://github.com/npm/npm/issues/3635", + "severities": [ + { + "system": "cvssv3", + "value": 3.2, + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "http://www.openwall.com/lists/oss-security/2013/07/10/17", + "severities": [ + { + "system": "cvssv3", + "value": 3.2, + "scoring_elements": "" + } + ] + }, + { + "reference_id": 152, + "url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/152.json", + "severities": [ + { + "system": "cvssv3", + "value": 3.2, + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2013-4116" + ], + "confidence": 100, + "summary": "Predictable temp filenames allow overwrite of arbitrary files\nnpm versions before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.", + "affected_purls": [], + "fixed_purl": { + "type": "npm", + "namespace": null, + "name": "npm", + "version": "1.3.3", + "qualifiers": null, + "subpath": null + }, + "references": [ + { + "reference_id": "", + "url": "https://github.com/npm/npm/issues/3635", + "severities": [ + { + "system": "cvssv3", + "value": 3.2, + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "http://www.openwall.com/lists/oss-security/2013/07/10/17", + "severities": [ + { + "system": "cvssv3", + "value": 3.2, + "scoring_elements": "" + } + ] + }, + { + "reference_id": 152, + "url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/152.json", + "severities": [ + { + "system": "cvssv3", + "value": 3.2, + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + } +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/ubuntu-oval-improver-expected.json b/vulnerabilities/tests/test_data/ubuntu-oval-improver-expected.json new file mode 100644 index 000000000..49fa028eb --- /dev/null +++ b/vulnerabilities/tests/test_data/ubuntu-oval-improver-expected.json @@ -0,0 +1,246 @@ +[ + { + "vulnerability_id": null, + "aliases": [ + "CVE-2016-8703" + ], + "confidence": 100, + "summary": "Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8702.", + "affected_purls": [ + { + "type": "deb", + "namespace": "ubuntu", + "name": "potrace", + "version": "1.1.0", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "ubuntu", + "name": "potrace", + "version": "1.1.1", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "ubuntu", + "name": "potrace", + "version": "1.1.2", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "ubuntu", + "name": "potrace", + "version": "1.1.3", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "ubuntu", + "name": "potrace", + "version": "1.1.4", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "ubuntu", + "name": "potrace", + "version": "1.1.5", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "ubuntu", + "name": "potrace", + "version": "1.1.6", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "ubuntu", + "name": "potrace", + "version": "1.1.7", + "qualifiers": null, + "subpath": null + }, + { + "type": "deb", + "namespace": "ubuntu", + "name": "potrace", + "version": "1.1.8", + "qualifiers": null, + "subpath": null + } + ], + "fixed_purl": null, + "references": [ + { + "reference_id": "", + "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8703.html", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://blogs.gentoo.org/ago/2016/08/08/potrace-multiplesix-heap-based-buffer-overflow-in-bm_readbody_bmp-bitmap_io-c/", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8703", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2016-8703" + ], + "confidence": 100, + "summary": "Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8702.", + "affected_purls": [], + "fixed_purl": null, + "references": [ + { + "reference_id": "", + "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8703.html", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://blogs.gentoo.org/ago/2016/08/08/potrace-multiplesix-heap-based-buffer-overflow-in-bm_readbody_bmp-bitmap_io-c/", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8703", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + }, + { + "vulnerability_id": null, + "aliases": [ + "CVE-2016-8860" + ], + "confidence": 100, + "summary": "Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.", + "affected_purls": [], + "fixed_purl": null, + "references": [ + { + "reference_id": "", + "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8860.html", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "http://www.openwall.com/lists/oss-security/2016/10/18/11", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://blog.torproject.org/blog/tor-0289-released-important-fixes", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8860", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "", + "url": "https://trac.torproject.org/projects/tor/ticket/20384", + "severities": [ + { + "system": "generic_textual", + "value": "Medium", + "scoring_elements": "" + } + ] + } + ], + "weaknesses": [] + } +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_debian.py b/vulnerabilities/tests/test_debian.py index 1ee928f69..ad21ef92a 100644 --- a/vulnerabilities/tests/test_debian.py +++ b/vulnerabilities/tests/test_debian.py @@ -11,9 +11,10 @@ import os from unittest.mock import patch -from vulnerabilities.importers.debian import DebianBasicImprover +from vulnerabilities.importer import AdvisoryData from vulnerabilities.importers.debian import DebianImporter from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import DebianBasicImprover from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -30,16 +31,27 @@ def test_debian_importer(mock_response): util_tests.check_results_against_json(result, expected_file) -@patch("vulnerabilities.importers.debian.DebianImporter.get_response") +@patch("vulnerabilities.improvers.valid_versions.DebianBasicImprover.get_package_versions") def test_debian_improver(mock_response): - with open(os.path.join(TEST_DATA, "debian.json")) as f: - mock_response.return_value = json.load(f) - advisories = list(DebianImporter().advisory_data()) - result = [] + advisory_file = os.path.join(TEST_DATA, f"debian-expected.json") + with open(advisory_file) as exp: + advisories = [AdvisoryData.from_dict(adv) for adv in (json.load(exp))] + mock_response.return_value = [ + "1.1.0", + "1.1.1", + "1.1.2", + "1.1.3", + "1.1.4", + "1.1.5", + "1.1.6", + "1.1.7", + "1.1.8", + ] improvers = [DebianBasicImprover(), DefaultImprover()] + result = [] for improver in improvers: for advisory in advisories: - for data in improver.get_inferences(advisory_data=advisory): - result.append(data.to_dict()) + inference = [data.to_dict() for data in improver.get_inferences(advisory)] + result.extend(inference) expected_file = os.path.join(TEST_DATA, f"debian-improver-expected.json") util_tests.check_results_against_json(result, expected_file) diff --git a/vulnerabilities/tests/test_debian_oval.py b/vulnerabilities/tests/test_debian_oval.py index d9a6998c5..b8fb0935b 100644 --- a/vulnerabilities/tests/test_debian_oval.py +++ b/vulnerabilities/tests/test_debian_oval.py @@ -7,10 +7,15 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import json import os import xml.etree.ElementTree as ET +from unittest.mock import patch +from vulnerabilities.importer import AdvisoryData from vulnerabilities.importers.debian_oval import DebianOvalImporter +from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import DebianOvalImprover from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -27,3 +32,29 @@ def test_debian_oval_importer(): util_tests.check_results_against_json( [advisory.to_dict() for advisory in advsiories], expected_file ) + + +@patch("vulnerabilities.improvers.valid_versions.DebianOvalImprover.get_package_versions") +def test_debian_oval_improver(mock_response): + advisory_file = os.path.join(TEST_DATA, f"debian-oval-expected.json") + with open(advisory_file) as exp: + advisories = [AdvisoryData.from_dict(adv) for adv in (json.load(exp))] + mock_response.return_value = [ + "1.1.0", + "1.1.1", + "1.1.2", + "1.1.3", + "1.1.4", + "1.1.5", + "1.1.6", + "1.1.7", + "1.1.8", + ] + improvers = [DebianOvalImprover(), DefaultImprover()] + result = [] + for improver in improvers: + for advisory in advisories: + inference = [data.to_dict() for data in improver.get_inferences(advisory)] + result.extend(inference) + expected_file = os.path.join(TEST_DATA, f"debian-oval-improver-expected.json") + util_tests.check_results_against_json(result, expected_file) diff --git a/vulnerabilities/tests/test_elixir_security.py b/vulnerabilities/tests/test_elixir_security.py index 631f44450..611b92cd1 100644 --- a/vulnerabilities/tests/test_elixir_security.py +++ b/vulnerabilities/tests/test_elixir_security.py @@ -7,9 +7,14 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import json import os +from unittest.mock import patch +from vulnerabilities.importer import AdvisoryData from vulnerabilities.importers.elixir_security import ElixirSecurityImporter +from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import ElixirImprover from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -21,3 +26,32 @@ def test_elixir_process_file(): expected_file = os.path.join(TEST_DIR, f"elixir-expected.json") result = [data.to_dict() for data in list(ElixirSecurityImporter().process_file(path))] util_tests.check_results_against_json(result, expected_file) + + +@patch("vulnerabilities.improvers.valid_versions.ElixirImprover.get_package_versions") +def test_elixir_improver(mock_response): + advisory_file = os.path.join(TEST_DIR, f"elixir-expected.json") + with open(advisory_file) as exp: + advisories = [AdvisoryData.from_dict(adv) for adv in (json.load(exp))] + mock_response.return_value = [ + "0.1.0", + "0.5.6", + "0.5.2", + "1.1.0", + "1.1.1", + "1.1.2", + "1.1.3", + "1.1.4", + "1.1.5", + "1.1.6", + "1.1.7", + "1.1.8", + ] + improvers = [ElixirImprover(), DefaultImprover()] + result = [] + for improver in improvers: + for advisory in advisories: + inference = [data.to_dict() for data in improver.get_inferences(advisory)] + result.extend(inference) + expected_file = os.path.join(TEST_DIR, f"elixir-improver-expected.json") + util_tests.check_results_against_json(result, expected_file) diff --git a/vulnerabilities/tests/test_github.py b/vulnerabilities/tests/test_github.py index 45f43d5c6..81b913451 100644 --- a/vulnerabilities/tests/test_github.py +++ b/vulnerabilities/tests/test_github.py @@ -24,8 +24,8 @@ from vulnerabilities.importer import Reference from vulnerabilities.importer import VulnerabilitySeverity from vulnerabilities.importers.github import GitHubAPIImporter -from vulnerabilities.importers.github import GitHubBasicImprover from vulnerabilities.importers.github import process_response +from vulnerabilities.improvers.valid_versions import GitHubBasicImprover from vulnerabilities.tests.util_tests import VULNERABLECODE_REGEN_TEST_FIXTURES as REGEN from vulnerabilities.utils import GitHubTokenError @@ -175,7 +175,7 @@ def valid_versions(): ] -@mock.patch("vulnerabilities.importers.github.GitHubBasicImprover.get_package_versions") +@mock.patch("vulnerabilities.improvers.valid_versions.GitHubBasicImprover.get_package_versions") def test_github_improver(mock_response, regen=REGEN): advisory_data = AdvisoryData( aliases=["CVE-2022-21831", "GHSA-w749-p3v6-hccq"], diff --git a/vulnerabilities/tests/test_gitlab.py b/vulnerabilities/tests/test_gitlab.py index bad3eae4f..f0792c75b 100644 --- a/vulnerabilities/tests/test_gitlab.py +++ b/vulnerabilities/tests/test_gitlab.py @@ -14,9 +14,9 @@ import pytest from vulnerabilities.importer import AdvisoryData -from vulnerabilities.importers.gitlab import GitLabBasicImprover from vulnerabilities.importers.gitlab import parse_gitlab_advisory from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import GitLabBasicImprover from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -70,7 +70,7 @@ def valid_versions(pkg_type): return valid_versions_by_package_type[pkg_type] -@mock.patch("vulnerabilities.importers.gitlab.GitLabBasicImprover.get_package_versions") +@mock.patch("vulnerabilities.improvers.valid_versions.GitLabBasicImprover.get_package_versions") @pytest.mark.parametrize("pkg_type", ["maven", "nuget", "gem", "composer", "pypi", "npm"]) def test_gitlab_improver(mock_response, pkg_type): advisory_file = os.path.join(TEST_DATA, f"{pkg_type}-expected.json") diff --git a/vulnerabilities/tests/test_istio.py b/vulnerabilities/tests/test_istio.py index 93a714459..82a88ae04 100644 --- a/vulnerabilities/tests/test_istio.py +++ b/vulnerabilities/tests/test_istio.py @@ -13,8 +13,8 @@ from vulnerabilities.importer import AdvisoryData from vulnerabilities.importers.istio import IstioImporter -from vulnerabilities.importers.istio import IstioImprover from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import IstioImprover from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -50,7 +50,7 @@ def test_istio_process_file(): util_tests.check_results_against_json(result, expected_file) -@mock.patch("vulnerabilities.importers.istio.IstioImprover.get_package_versions") +@mock.patch("vulnerabilities.improvers.valid_versions.IstioImprover.get_package_versions") def test_istio_improver(mock_response): advisory_file = os.path.join(TEST_DIR, f"istio-expected.json") expected_file = os.path.join(TEST_DIR, f"istio-improver-expected.json") diff --git a/vulnerabilities/tests/test_nginx.py b/vulnerabilities/tests/test_nginx.py index 7f8da680f..1d59830ee 100644 --- a/vulnerabilities/tests/test_nginx.py +++ b/vulnerabilities/tests/test_nginx.py @@ -23,9 +23,11 @@ from vulnerabilities.importer import Reference from vulnerabilities.importer import VulnerabilitySeverity from vulnerabilities.importers import nginx +from vulnerabilities.improvers.valid_versions import NginxBasicImprover from vulnerabilities.models import Advisory from vulnerabilities.package_managers import PackageVersion from vulnerabilities.tests import util_tests +from vulnerabilities.utils import is_vulnerable_nginx_version ADVISORY_FIELDS_TO_TEST = ( "unique_content_id", @@ -50,43 +52,43 @@ def test_is_vulnerable(self): fixed_versions = [vcls("1.17.3"), vcls("1.16.1")] version = vcls("1.9.4") - assert not nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert not is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.9.5") - assert nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.9.6") - assert nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.16.0") - assert nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.16.1") - assert not nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert not is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.16.2") - assert not nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert not is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.16.99") - assert not nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert not is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.17.0") - assert nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.17.1") - assert nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.17.2") - assert nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.17.3") - assert not nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert not is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.17.4") - assert not nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert not is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) version = vcls("1.18.0") - assert not nginx.is_vulnerable(version, affected_version_range, fixed_versions) + assert not is_vulnerable_nginx_version(version, affected_version_range, fixed_versions) def test_parse_advisory_data_from_paragraph(self): paragraph = ( @@ -186,7 +188,7 @@ def fetch(self): def test_NginxBasicImprover__interesting_advisories(self): advisories, importer_class = self.run_import() - class MockNginxBasicImprover(nginx.NginxBasicImprover): + class MockNginxBasicImprover(NginxBasicImprover): @property def interesting_advisories(self) -> QuerySet: return Advisory.objects.filter(created_by=importer_class.qualified_name) @@ -213,9 +215,7 @@ def test_NginxBasicImprover_fetch_nginx_version_from_git_tags(self, mock_fetcher side_effects.append(json.load(f)) mock_fetcher.side_effect = side_effects - results = [ - pv.to_dict() for pv in nginx.NginxBasicImprover().fetch_nginx_version_from_git_tags() - ] + results = [pv.to_dict() for pv in NginxBasicImprover().fetch_nginx_version_from_git_tags()] expected_file = self.get_test_loc("improver/nginx-versions-expected.json", must_exist=False) util_tests.check_results_against_json(results, expected_file) @@ -229,7 +229,7 @@ def test_NginxBasicImprover__get_inferences_from_versions_end_to_end(self): all_versions = [PackageVersion(**vd) for vd in json.load(vf)] results = [] - improver = nginx.NginxBasicImprover() + improver = NginxBasicImprover() for advdata in advisories_data: advisory_data = AdvisoryData.from_dict(advdata) diff --git a/vulnerabilities/tests/test_npm.py b/vulnerabilities/tests/test_npm.py index afd72181b..28ca7a548 100644 --- a/vulnerabilities/tests/test_npm.py +++ b/vulnerabilities/tests/test_npm.py @@ -8,15 +8,20 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import json import os +from unittest.mock import patch from packageurl import PackageURL from univers.version_constraint import VersionConstraint from univers.version_range import NpmVersionRange from univers.versions import SemverVersion +from vulnerabilities.importer import AdvisoryData from vulnerabilities.importer import AffectedPackage from vulnerabilities.importers.npm import NpmImporter +from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import NpmImprover from vulnerabilities.tests import util_tests from vulnerabilities.utils import load_json @@ -43,3 +48,31 @@ def test_get_affected_package(): ), fixed_version=SemverVersion(string="1.3.3"), ) == NpmImporter().get_affected_package(data, "npm") + + +@patch("vulnerabilities.improvers.valid_versions.NpmImprover.get_package_versions") +def test_npm_improver(mock_response): + advisory_file = os.path.join(TEST_DATA, f"parse-advisory-npm-expected.json") + with open(advisory_file) as exp: + advisories = [AdvisoryData.from_dict(adv) for adv in (json.load(exp))] + mock_response.return_value = [ + "0.1.0", + "0.5.6", + "0.5.2", + "1.1.1", + "1.1.2", + "1.1.3", + "1.1.4", + "1.1.5", + "1.1.6", + "1.1.7", + "1.1.8", + ] + improvers = [NpmImprover(), DefaultImprover()] + result = [] + for improver in improvers: + for advisory in advisories: + inference = [data.to_dict() for data in improver.get_inferences(advisory)] + result.extend(inference) + expected_file = os.path.join(TEST_DATA, f"npm-improver-expected.json") + util_tests.check_results_against_json(result, expected_file) diff --git a/vulnerabilities/tests/test_package_managers.py b/vulnerabilities/tests/test_package_managers.py index 228c32fd2..adf46e1cd 100644 --- a/vulnerabilities/tests/test_package_managers.py +++ b/vulnerabilities/tests/test_package_managers.py @@ -15,8 +15,10 @@ import pytest from dateutil.tz import tzlocal +from packageurl import PackageURL from vulnerabilities.package_managers import ComposerVersionAPI +from vulnerabilities.package_managers import DebianVersionAPI from vulnerabilities.package_managers import GitHubTagsAPI from vulnerabilities.package_managers import GoproxyVersionAPI from vulnerabilities.package_managers import MavenVersionAPI @@ -25,6 +27,7 @@ from vulnerabilities.package_managers import PypiVersionAPI from vulnerabilities.package_managers import RubyVersionAPI from vulnerabilities.package_managers import VersionResponse +from vulnerabilities.package_managers import get_version_fetcher BASE_DIR = os.path.dirname(os.path.abspath(__file__)) TEST_DATA = os.path.join(BASE_DIR, "test_data", "package_manager_data") @@ -450,3 +453,10 @@ def test_fetch_small_repo_2(self, mock_graphql_response): PackageVersion(value="v22.01", release_date=dt_local(2022, 1, 24, 23, 48, 4)), ] assert results == expected + + +def test_get_version_fetcher(): + purl = "pkg:deb/debian/foo@1.2.3" + purl = PackageURL.from_string(purl) + fetcher = get_version_fetcher(purl) + assert isinstance(fetcher, DebianVersionAPI) diff --git a/vulnerabilities/tests/test_ubuntu.py b/vulnerabilities/tests/test_ubuntu.py index cc6c6630a..fa54fa1af 100644 --- a/vulnerabilities/tests/test_ubuntu.py +++ b/vulnerabilities/tests/test_ubuntu.py @@ -7,10 +7,15 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import json import os import xml.etree.ElementTree as ET +from unittest.mock import patch +from vulnerabilities.importer import AdvisoryData from vulnerabilities.importers.ubuntu import UbuntuImporter +from vulnerabilities.improvers.default import DefaultImprover +from vulnerabilities.improvers.valid_versions import UbuntuOvalImprover from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -27,3 +32,29 @@ def test_ubuntu_importer(): util_tests.check_results_against_json( [advisory.to_dict() for advisory in advsiories], expected_file ) + + +@patch("vulnerabilities.improvers.valid_versions.UbuntuOvalImprover.get_package_versions") +def test_debian_oval_improver(mock_response): + advisory_file = os.path.join(TEST_DATA, f"ubuntu-oval-expected.json") + with open(advisory_file) as exp: + advisories = [AdvisoryData.from_dict(adv) for adv in (json.load(exp))] + mock_response.return_value = [ + "1.1.0", + "1.1.1", + "1.1.2", + "1.1.3", + "1.1.4", + "1.1.5", + "1.1.6", + "1.1.7", + "1.1.8", + ] + improvers = [UbuntuOvalImprover(), DefaultImprover()] + result = [] + for improver in improvers: + for advisory in advisories: + inference = [data.to_dict() for data in improver.get_inferences(advisory)] + result.extend(inference) + expected_file = os.path.join(TEST_DATA, f"ubuntu-oval-improver-expected.json") + util_tests.check_results_against_json(result, expected_file) diff --git a/vulnerabilities/utils.py b/vulnerabilities/utils.py index f4dcafa2d..f9dd150ee 100644 --- a/vulnerabilities/utils.py +++ b/vulnerabilities/utils.py @@ -30,6 +30,7 @@ import urllib3 from packageurl import PackageURL from univers.version_range import RANGE_CLASS_BY_SCHEMES +from univers.version_range import NginxVersionRange from univers.version_range import VersionRange logger = logging.getLogger(__name__) @@ -453,3 +454,51 @@ def get_cwe_id(cwe_string: str) -> int: """ cwe_id = cwe_string.split("-")[1] return int(cwe_id) + + +def clean_nginx_git_tag(tag): + """ + Return a cleaned ``version`` string from an nginx git tag. + + Nginx tags git release as in `release-1.2.3` + This removes the the `release-` prefix. + + For example: + >>> clean_nginx_git_tag("release-1.2.3") == "1.2.3" + True + >>> clean_nginx_git_tag("1.2.3") == "1.2.3" + True + """ + if tag.startswith("release-"): + _, _, tag = tag.partition("release-") + return tag + + +def is_vulnerable_nginx_version(version, affected_version_range, fixed_versions): + """ + Return True if the ``version`` Version for nginx is vulnerable according to + the nginx approach. + + A ``version`` is vulnerable as explained by @mdounin + in https://marc.info/?l=nginx&m=164070162912710&w=2 : + + "Note that it is generally trivial to find out if a version is + vulnerable or not from the information about a vulnerability, + without any knowledge about nginx branches. That is: + + - Check if the version is in "Vulnerable" range. If it's not, the + version is not vulnerable. + + - If it is, check if the branch is explicitly listed in the "Not + vulnerable". If it's not, the version is vulnerable. If it + is, check the minor number: if it's greater or equal to the + version listed as not vulnerable, the version is not vulnerable, + else the version is vulnerable." + + """ + if version in NginxVersionRange.from_string(affected_version_range.to_string()): + for fixed_version in fixed_versions: + if version.value.minor == fixed_version.value.minor and version >= fixed_version: + return False + return True + return False