Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test cases for High impact vulnerabilities #23586

Merged
merged 6 commits into from
Jun 1, 2024

Conversation

MiguelazoDS
Copy link
Member

@MiguelazoDS MiguelazoDS commented May 23, 2024

Related issue
#23548

Description

This PR adds efficacy tests for high-impact vulnerabilities.

XZ backdoor CVE-2024-3094

Note

There was no easy way to install this vulnerable package. For test id 015, input3 the vulnerability is detected but it should come with that specific vendor since it is the one present in the CPE for NVD feed. This is a made-up package.

Heartbleed Openssl vulnerability CVE-2014-0160

Note

There was no easy way to install this vulnerable package. For test ID 016, input3, and input4 the vulnerability is detected but it should come with that specific vendor since it is the one present in the CPE for NVD feed. This is a made-up package.

Logs/Alerts example

image

@MiguelazoDS MiguelazoDS self-assigned this May 23, 2024
@MiguelazoDS MiguelazoDS linked an issue May 23, 2024 that may be closed by this pull request
9 tasks
@MiguelazoDS MiguelazoDS force-pushed the enhancement/23548-high-impact-vulnerabilities branch from 9719b3b to 7a5eda2 Compare May 23, 2024 18:32
@MiguelazoDS MiguelazoDS marked this pull request as ready for review May 24, 2024 18:21
sebasfalcone
sebasfalcone previously approved these changes May 27, 2024
Copy link
Member

@sebasfalcone sebasfalcone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@MiguelazoDS lets ask @elwali10 how he managed to detect the XZ vulnerability

Copy link
Member

@sebasfalcone sebasfalcone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MiguelazoDS
Please add a readme for each folder with

  • Test overview
  • Tested packages
  • Tested OSs
  • Etc

@MiguelazoDS MiguelazoDS force-pushed the enhancement/23548-high-impact-vulnerabilities branch 3 times, most recently from ca19884 to f1c57d9 Compare May 28, 2024 19:38
@MiguelazoDS MiguelazoDS changed the base branch from 4.8.0 to 4.9.0 May 28, 2024 19:39
@MiguelazoDS MiguelazoDS force-pushed the enhancement/23548-high-impact-vulnerabilities branch from f1c57d9 to 0dcb3d3 Compare May 28, 2024 19:41
sebasfalcone
sebasfalcone previously approved these changes May 28, 2024
@Dwordcito Dwordcito merged commit 9c59693 into 4.9.0 Jun 1, 2024
27 of 43 checks passed
@Dwordcito Dwordcito deleted the enhancement/23548-high-impact-vulnerabilities branch June 1, 2024 02:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Vulnerability Scanner - Analyze high impact vulnerabilities
3 participants