feat: add k8s vulns

[chen-keinan]

Description

Feat: add k8s vulns

Related #4029
Related aquasecurity/trivy#5020
Depend on: aquasecurity/vuln-list-update#239

[knqyf263]

I have some feedback on vuln-list-k8s.

1. CVSS
   https://github.com/aquasecurity/vuln-list-k8s/blob/fedb568387ba3d6258bde457201ba4b1a2b14139/k8s/cves/CVE-2023-2878.json#L22-L24

This should be as below:

	"cvssv3": {
		"vector"* "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
		"score": 6.5
	}

The score is calculated based on the vector. They should be put together. Also, CVSS v4 is coming soon.

2. Component name
   It looks like k8s.io is not only the prefix.

https://github.com/aquasecurity/vuln-list-k8s/blob/fedb568387ba3d6258bde457201ba4b1a2b14139/k8s/cves/CVE-2023-2878.json#L5C1-L6C1

https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/fa9befecb289b9e1a9848a39a18b104278a394bd/go.mod#L1

3. Affected version
   The following affected version is wrong.

https://github.com/aquasecurity/vuln-list-k8s/blob/fedb568387ba3d6258bde457201ba4b1a2b14139/k8s/cves/CVE-2023-2878.json#L7-L11

The advisory says - secrets-store-csi-driver < 1.3.3, but another advisory says v1.27.0 - v1.27.1, which means 1.27.0 <= k8s <= 1.27.1. The k8s advisory format is not standardized, unfortunately. We must be aware of < or <=.

OSV defines them differently.

			"events": [ {
				"introduced": string,
				"fixed": string,
				"last_affected": string,
				"limit": string
			} ],

fixed is <, and last_affected is <=. It might be a good idea to adopt the same structure.

[JonZeolla]

I think #338 attempts to add support for last_affected

[chen-keinan]

@knqyf263 all comments has been addressed, please have another look.

[knqyf263]

Looks like we need to improve advisories more. I picked up some examples, but I saw many advisories with problems.

No patched version.
https://github.com/aquasecurity/vuln-list-k8s/blob/main/k8s/cves/CVE-2018-1002102.json

The version range seems wrong.
https://github.com/aquasecurity/vuln-list-k8s/blob/7a48561f95d894417cd493f6c7366d9de206efec/k8s/cves/CVE-2017-1002102.json#L8-L67
https://github.com/aquasecurity/vuln-list-k8s/blob/7a48561f95d894417cd493f6c7366d9de206efec/k8s/cves/CVE-2018-1002105.json#L8-L156

No last affected or fixed
https://github.com/aquasecurity/vuln-list-k8s/blob/main/k8s/cves/CVE-2019-11244.json
https://github.com/aquasecurity/vuln-list-k8s/blob/main/k8s/cves/CVE-2023-2728.json#L11-L15

Wrong introduced
https://github.com/aquasecurity/vuln-list-k8s/blob/main/k8s/cves/CVE-2020-10749.json

[chen-keinan]

@knqyf263 I have fixed the collector and validated all CVEs content.
please review again

[knqyf263]

@chen-keinan It seems to be challenging to correctly parse the official CVE feed. How did you improve that?

[chen-keinan]

@chen-keinan It seems to be challenging to correctly parse the official CVE feed. How did you improve that?

What I did was to pick to vulnerable versions and cve data from a more structure (JSON) external vuln source (as appear in k8s db) [https://cveawg.mitre.org/api/cve/<CVE-ID>] but since real component ID do not appear on external source I had to take the component name from k8s source vulndb.

so in high level its a combination of both

[knqyf263]

Can I review the script first? Where is it maintained? The vulnerability data is essential.

[chen-keinan]

Can I review the script first? Where is it maintained? The vulnerability data is essential.

@knqyf263 sure , the collector start at this point

[knqyf263]

Thanks. I'll take a look after completing all the tasks for v0.45.0.

[chen-keinan]

@knqyf263 comments has been addressed

[knqyf263]

I had this branch on my local computer, but force-push broke it. Any benefits on force-push?

Actually, I also used to force-push when rebasing the main branch so that a merge commit won't be created, but I stopped doing that after talking with Simar because we currently use "squash and merge". The merge commit doesn't matter. It is more important to keep the commit history in PR, but please let me know if you have a specific reason.

[chen-keinan]

@DmitriyLewen thanks for the comment test data has been fixed

[DmitriyLewen]

Thanks!
Approved.

[knqyf263]

We'll review the k8s advisories and merge this PR.
https://github.com/aquasecurity/vuln-list-k8s/pulls

[knqyf263]

@chen-keinan What if we skip storing k8s.io/kubectl and k8s.io/client-go? They are not detected in Trivy k8s scanning, right? We will not use these buckets even if we store those vulnerabilities. Or am I missing something? Is KBOM able to detect k8s.io/kubectl?

FYI: k8s.io/client-go is a go dependency, so the vulnerabilities in pkg:golang/k8s.io/client-go are covered by GHSA.

[chen-keinan]

@chen-keinan What if we skip storing k8s.io/kubectl and k8s.io/client-go? They are not detected in Trivy k8s scanning, right? We will not use these buckets even if we store those vulnerabilities. Or am I missing something? Is KBOM able to detect k8s.io/kubectl?

FYI: k8s.io/client-go is a go dependency, so the vulnerabilities in pkg:golang/k8s.io/client-go are covered by GHSA.

I prefer to keep kubectl as I'm still looking at simple ways to find it. regarding client-go we can exclude it

[chen-keinan]

@chen-keinan What if we skip storing k8s.io/kubectl and k8s.io/client-go? They are not detected in Trivy k8s scanning, right? We will not use these buckets even if we store those vulnerabilities. Or am I missing something? Is KBOM able to detect k8s.io/kubectl?
FYI: k8s.io/client-go is a go dependency, so the vulnerabilities in pkg:golang/k8s.io/client-go are covered by GHSA.

I prefer to keep kubectl as I'm still looking at simple ways to find it.

I also think that we can fallback client-go to k8s.io/kubernetes where its not clear, wdyt ? otherwise lets exclude client-go

[knqyf263]

I prefer to keep kubectl as I'm still looking at simple ways to find it.

Do you mean you have an idea to find kubectl in trivy k8s?

[knqyf263]

I also think that we can fallback client-go to k8s.io/kubernetes where its not clear, wdyt ? otherwise lets exclude client-go

I did that in vuln-list-k8s. If the advisory says client-go is affected, it means the library client-go is affected, and doesn't affect other components.

[chen-keinan]

I prefer to keep kubectl as I'm still looking at simple ways to find it.

Do you mean you have an idea to find kubectl in trivy k8s?

I have an idea , but I do not like it , thinking on better way still. anyway I would like to keep the kubectl cves for now

[knqyf263]

I have an idea , but I do not like it , thinking on better way still. anyway I would like to keep the kubectl cves for now

Got it.

[knqyf263]

Oh, my local branch is broken again. @chen-keinan Did you force-push again for some reason?