diff --git a/mariner/mariner.go b/mariner/mariner.go index cddd3db8..fb2ea795 100644 --- a/mariner/mariner.go +++ b/mariner/mariner.go @@ -17,7 +17,7 @@ import ( ) const ( - repoURL = "https://github.com/microsoft/CBL-MarinerVulnerabilityData/archive/refs/heads/main.tar.gz//CBL-MarinerVulnerabilityData-main" + repoURL = "https://github.com/microsoft/AzureLinuxVulnerabilityData/archive/refs/heads/main.tar.gz//AzureLinuxVulnerabilityData-main" cblDir = "mariner" // CBL-Mariner Vulnerability Data retry = 3 @@ -142,9 +142,7 @@ func (c Config) update(version, path string) error { // write definitions bar := pb.StartNew(len(oval.Definitions.Definition)) for _, def := range oval.Definitions.Definition { - vulnID := def.Metadata.Reference.RefID - - if err := c.saveAdvisoryPerYear(filepath.Join(dirPath, definitionsDir), vulnID, def); err != nil { + if err := c.saveAdvisoryPerYear(filepath.Join(dirPath, definitionsDir), def); err != nil { return xerrors.Errorf("failed to save advisory per year: %w", err) } @@ -154,8 +152,12 @@ func (c Config) update(version, path string) error { return nil } +func (c Config) saveAdvisoryPerYear(dirName string, def Definition) error { + // Use advisory_id for file name to avoid overwriting files when there are 2 definitions for same CVE + // cf. https://github.com/aquasecurity/trivy-db/issues/379 + fileName := fmt.Sprintf("%s.json", AdvisoryID(def)) -func (c Config) saveAdvisoryPerYear(dirName string, vulnID string, def Definition) error { + vulnID := def.Metadata.Reference.RefID if !strings.HasPrefix(vulnID, "CVE") { log.Printf("discovered non-CVE-ID: %s", vulnID) return ErrNonCVEID @@ -168,8 +170,31 @@ func (c Config) saveAdvisoryPerYear(dirName string, vulnID string, def Definitio } yearDir := filepath.Join(dirName, s[1]) - if err := utils.Write(filepath.Join(yearDir, fmt.Sprintf("%s.json", vulnID)), def); err != nil { + if err := utils.Write(filepath.Join(yearDir, fileName), def); err != nil { return xerrors.Errorf("unable to write a JSON file: %w", err) } return nil } + +// AdvisoryID returns advisoryID for Definition. +// If `advisory_id` field does not exist, create this field yourself using the Azure Linux format. +// +// Azure Linux uses `-` format for `advisory_id`. +// cf. https://github.com/aquasecurity/vuln-list-update/pull/271#issuecomment-2111678641 +// e.g. +// - `id="oval:com.microsoft.cbl-mariner:def:27423" version="2000000001"` => `27423-1` +// - `id="oval:com.microsoft.cbl-mariner:def:11073" version="2000000000"` => `11073` +// - `id="oval:com.microsoft.cbl-mariner:def:6343" version="1"` => `6343-1` +// - `id="oval:com.microsoft.cbl-mariner:def:6356" version="0"` => `6356` +func AdvisoryID(def Definition) string { + id := def.Metadata.AdvisoryID + if id == "" { + ss := strings.Split(def.ID, ":") + id = ss[len(ss)-1] + // for `0` versions `-0` suffix is omitted. + if def.Version != "" && def.Version[len(def.Version)-1:] != "0" { + id = fmt.Sprintf("%s-%s", id, def.Version[len(def.Version)-1:]) + } + } + return id +} diff --git a/mariner/mariner_test.go b/mariner/mariner_test.go index 77722531..6b06c178 100644 --- a/mariner/mariner_test.go +++ b/mariner/mariner_test.go @@ -66,3 +66,69 @@ func TestUpdate(t *testing.T) { }) } } + +func TestAdvisoryID(t *testing.T) { + tests := []struct { + name string + def mariner.Definition + want string + }{ + { + name: "advisory_id without version", + def: mariner.Definition{ + Metadata: mariner.Metadata{ + AdvisoryID: "1111", + }, + }, + want: "1111", + }, + { + name: "advisory_id with version", + def: mariner.Definition{ + Metadata: mariner.Metadata{ + AdvisoryID: "1111-2", + }, + }, + want: "1111-2", + }, + { + name: "build advisoryID converting long version to 1", + def: mariner.Definition{ + ID: "oval:com.microsoft.cbl-mariner:def:27423", + Version: "2000000001", + }, + want: "27423-1", + }, + { + name: "build advisoryID converting long version to 0", + def: mariner.Definition{ + ID: "oval:com.microsoft.cbl-mariner:def:27423", + Version: "2000000000", + }, + want: "27423", + }, + { + name: "build advisoryID with short 1 version", + def: mariner.Definition{ + ID: "oval:com.microsoft.cbl-mariner:def:27423", + Version: "1", + }, + want: "27423-1", + }, + { + name: "build advisoryID with short 0 version", + def: mariner.Definition{ + ID: "oval:com.microsoft.cbl-mariner:def:27423", + Version: "0", + }, + want: "27423", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := mariner.AdvisoryID(tt.def) + require.Equal(t, tt.want, got) + }) + } +} diff --git a/mariner/testdata/golden/mariner/1.0/definitions/2008/CVE-2008-3914.json b/mariner/testdata/golden/mariner/1.0/definitions/2008/3173.json similarity index 100% rename from mariner/testdata/golden/mariner/1.0/definitions/2008/CVE-2008-3914.json rename to mariner/testdata/golden/mariner/1.0/definitions/2008/3173.json diff --git a/mariner/testdata/golden/mariner/1.0/definitions/2018/CVE-2018-25012.json b/mariner/testdata/golden/mariner/1.0/definitions/2018/4209.json similarity index 100% rename from mariner/testdata/golden/mariner/1.0/definitions/2018/CVE-2018-25012.json rename to mariner/testdata/golden/mariner/1.0/definitions/2018/4209.json diff --git a/mariner/testdata/golden/mariner/1.0/definitions/2021/CVE-2021-35942.json b/mariner/testdata/golden/mariner/1.0/definitions/2021/4820.json similarity index 100% rename from mariner/testdata/golden/mariner/1.0/definitions/2021/CVE-2021-35942.json rename to mariner/testdata/golden/mariner/1.0/definitions/2021/4820.json diff --git a/mariner/testdata/golden/mariner/2.0/definitions/2014/CVE-2014-8139.json b/mariner/testdata/golden/mariner/2.0/definitions/2014/6933.json similarity index 99% rename from mariner/testdata/golden/mariner/2.0/definitions/2014/CVE-2014-8139.json rename to mariner/testdata/golden/mariner/2.0/definitions/2014/6933.json index fa9a0671..b2521364 100644 --- a/mariner/testdata/golden/mariner/2.0/definitions/2014/CVE-2014-8139.json +++ b/mariner/testdata/golden/mariner/2.0/definitions/2014/6933.json @@ -25,4 +25,4 @@ "TestRef": "oval:com.microsoft.cbl-mariner:tst:1643374850000269" } } -} \ No newline at end of file +} diff --git a/mariner/testdata/golden/mariner/2.0/definitions/2021/CVE-2021-39924.json b/mariner/testdata/golden/mariner/2.0/definitions/2021/7412.json similarity index 100% rename from mariner/testdata/golden/mariner/2.0/definitions/2021/CVE-2021-39924.json rename to mariner/testdata/golden/mariner/2.0/definitions/2021/7412.json diff --git a/mariner/testdata/golden/mariner/2.0/definitions/2022/CVE-2022-21309.json b/mariner/testdata/golden/mariner/2.0/definitions/2022/7700.json similarity index 100% rename from mariner/testdata/golden/mariner/2.0/definitions/2022/CVE-2022-21309.json rename to mariner/testdata/golden/mariner/2.0/definitions/2022/7700.json diff --git a/mariner/testdata/golden/mariner/2.0/definitions/2023/31872-1.json b/mariner/testdata/golden/mariner/2.0/definitions/2023/31872-1.json new file mode 100644 index 00000000..6fb3156e --- /dev/null +++ b/mariner/testdata/golden/mariner/2.0/definitions/2023/31872-1.json @@ -0,0 +1,28 @@ +{ + "Class": "vulnerability", + "ID": "oval:com.microsoft.cbl-mariner:def:31872", + "Version": "1", + "Metadata": { + "Title": "CVE-2023-5678 affecting package edk2 for versions less than 20230301gitf80f052277c8-38", + "Affected": { + "Family": "unix", + "Platform": "CBL-Mariner" + }, + "Reference": { + "RefID": "CVE-2023-5678", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-5678", + "Source": "CVE" + }, + "Patchable": "true", + "AdvisoryID": "31872-1", + "Severity": "Medium", + "Description": "CVE-2023-5678 affecting package edk2 for versions less than 20230301gitf80f052277c8-38. A patched version of the package is available." + }, + "Criteria": { + "Operator": "AND", + "Criterion": { + "Comment": "Package edk2 is earlier than 20230301gitf80f052277c8-38, affected by CVE-2023-5678", + "TestRef": "oval:com.microsoft.cbl-mariner:tst:31872000" + } + } +} \ No newline at end of file diff --git a/mariner/testdata/golden/mariner/2.0/definitions/2023/31880-1.json b/mariner/testdata/golden/mariner/2.0/definitions/2023/31880-1.json new file mode 100644 index 00000000..ed4b4fe8 --- /dev/null +++ b/mariner/testdata/golden/mariner/2.0/definitions/2023/31880-1.json @@ -0,0 +1,28 @@ +{ + "Class": "vulnerability", + "ID": "oval:com.microsoft.cbl-mariner:def:31880", + "Version": "1", + "Metadata": { + "Title": "CVE-2023-5678 affecting package openssl for versions less than 1.1.1k-28", + "Affected": { + "Family": "unix", + "Platform": "CBL-Mariner" + }, + "Reference": { + "RefID": "CVE-2023-5678", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-5678", + "Source": "CVE" + }, + "Patchable": "true", + "AdvisoryID": "31880-1", + "Severity": "Medium", + "Description": "CVE-2023-5678 affecting package openssl for versions less than 1.1.1k-28. A patched version of the package is available." + }, + "Criteria": { + "Operator": "AND", + "Criterion": { + "Comment": "Package openssl is earlier than 1.1.1k-28, affected by CVE-2023-5678", + "TestRef": "oval:com.microsoft.cbl-mariner:tst:31880000" + } + } +} \ No newline at end of file diff --git a/mariner/testdata/golden/mariner/2.0/objects/objects.json b/mariner/testdata/golden/mariner/2.0/objects/objects.json index e9ee4081..7badc29d 100644 --- a/mariner/testdata/golden/mariner/2.0/objects/objects.json +++ b/mariner/testdata/golden/mariner/2.0/objects/objects.json @@ -14,6 +14,16 @@ "ID": "oval:com.microsoft.cbl-mariner:obj:1643374850000669", "Version": "1643374850", "Name": "mysql" + }, + { + "ID": "oval:com.microsoft.cbl-mariner:obj:31880001", + "Version": "0", + "Name": "openssl" + }, + { + "ID": "oval:com.microsoft.cbl-mariner:obj:31872001", + "Version": "0", + "Name": "edk2" } ] } \ No newline at end of file diff --git a/mariner/testdata/golden/mariner/2.0/states/states.json b/mariner/testdata/golden/mariner/2.0/states/states.json index ebd7afa6..07c84360 100644 --- a/mariner/testdata/golden/mariner/2.0/states/states.json +++ b/mariner/testdata/golden/mariner/2.0/states/states.json @@ -26,6 +26,24 @@ "Datatype": "evr_string", "Operation": "less than or equal" } + }, + { + "ID": "oval:com.microsoft.cbl-mariner:ste:31880002", + "Version": "0", + "Evr": { + "Text": "0:1.1.1k-28.cm2", + "Datatype": "evr_string", + "Operation": "less than" + } + }, + { + "ID": "oval:com.microsoft.cbl-mariner:ste:31872002", + "Version": "0", + "Evr": { + "Text": "0:20230301gitf80f052277c8-38.cm2", + "Datatype": "evr_string", + "Operation": "less than" + } } ] } \ No newline at end of file diff --git a/mariner/testdata/golden/mariner/2.0/tests/tests.json b/mariner/testdata/golden/mariner/2.0/tests/tests.json index 2028ecbd..f3bc5b9e 100644 --- a/mariner/testdata/golden/mariner/2.0/tests/tests.json +++ b/mariner/testdata/golden/mariner/2.0/tests/tests.json @@ -35,6 +35,30 @@ "State": { "StateRef": "oval:com.microsoft.cbl-mariner:ste:1643374850000670" } + }, + { + "Check": "at least one", + "Comment": "Package openssl is earlier than 1.1.1k-28, affected by CVE-2023-5678", + "ID": "oval:com.microsoft.cbl-mariner:tst:31880000", + "Version": "0", + "Object": { + "ObjectRef": "oval:com.microsoft.cbl-mariner:obj:31880001" + }, + "State": { + "StateRef": "oval:com.microsoft.cbl-mariner:ste:31880002" + } + }, + { + "Check": "at least one", + "Comment": "Package edk2 is earlier than 20230301gitf80f052277c8-38, affected by CVE-2023-5678", + "ID": "oval:com.microsoft.cbl-mariner:tst:31872000", + "Version": "0", + "Object": { + "ObjectRef": "oval:com.microsoft.cbl-mariner:obj:31872001" + }, + "State": { + "StateRef": "oval:com.microsoft.cbl-mariner:ste:31872002" + } } ] } \ No newline at end of file diff --git a/mariner/testdata/happy/cbl-mariner-2.0-preview-oval.xml b/mariner/testdata/happy/cbl-mariner-2.0-preview-oval.xml index 5b2bfd0a..ad02a703 100644 --- a/mariner/testdata/happy/cbl-mariner-2.0-preview-oval.xml +++ b/mariner/testdata/happy/cbl-mariner-2.0-preview-oval.xml @@ -55,6 +55,38 @@ + + + CVE-2023-5678 affecting package openssl for versions less than 1.1.1k-28 + + CBL-Mariner + + + true + 31880-1 + Medium + CVE-2023-5678 affecting package openssl for versions less than 1.1.1k-28. A patched version of the package is available. + + + + + + + + CVE-2023-5678 affecting package edk2 for versions less than 20230301gitf80f052277c8-38 + + CBL-Mariner + + + true + 31872-1 + Medium + CVE-2023-5678 affecting package edk2 for versions less than 20230301gitf80f052277c8-38. A patched version of the package is available. + + + + + @@ -69,6 +101,14 @@ + + + + + + + + @@ -80,6 +120,12 @@ mysql + + openssl + + + edk2 + @@ -91,5 +137,11 @@ 0:8.0.24-1.cm1 + + 0:1.1.1k-28.cm2 + + + 0:20230301gitf80f052277c8-38.cm2 +