Skip to content

Commit a12a104

Browse files
shinoshino
committed
feat(detector/vuls2): SUSE by vuls2
1 parent ce2855c commit a12a104

File tree

4 files changed

+323
-6
lines changed

4 files changed

+323
-6
lines changed

‎detector/detector.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -322,11 +322,12 @@ func Detect(rs []models.ScanResult, dir string) ([]models.ScanResult, error) {
322322
func DetectPkgCves(r *models.ScanResult, ovalCnf config.GovalDictConf, gostCnf config.GostConf, vuls2Conf config.Vuls2Conf, logOpts logging.LogOpts, noProgress bool) error {
323323
if isPkgCvesDetactable(r) {
324324
switch r.Family {
325-
case constant.RedHat, constant.CentOS, constant.Fedora, constant.Alma, constant.Rocky, constant.Oracle, constant.Alpine, constant.Ubuntu:
325+
case constant.RedHat, constant.CentOS, constant.Fedora, constant.Alma, constant.Rocky, constant.Oracle, constant.Alpine, constant.Ubuntu,
326+
constant.OpenSUSE, constant.OpenSUSELeap, constant.SUSEEnterpriseServer, constant.SUSEEnterpriseDesktop:
326327
if err := vuls2.Detect(r, vuls2Conf, noProgress); err != nil {
327328
return xerrors.Errorf("Failed to detect CVE with Vuls2: %w", err)
328329
}
329-
case constant.Amazon, constant.OpenSUSE, constant.OpenSUSELeap, constant.SUSEEnterpriseServer, constant.SUSEEnterpriseDesktop:
330+
case constant.Amazon:
330331
if err := detectPkgsCvesWithOval(ovalCnf, r, logOpts); err != nil {
331332
return xerrors.Errorf("Failed to detect CVE with OVAL: %w", err)
332333
}

‎detector/vuls2/vendor.go‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -462,6 +462,13 @@ func advisoryReference(e ecosystemTypes.Ecosystem, s sourceTypes.SourceID, da mo
462462
Source: "UBUNTU",
463463
RefID: da.AdvisoryID,
464464
}, nil
465+
case ecosystemTypes.EcosystemTypeOpenSUSE, ecosystemTypes.EcosystemTypeOpenSUSELeap, ecosystemTypes.EcosystemTypeOpenSUSELeapMicro, ecosystemTypes.EcosystemTypeOpenSUSETumbleweed,
466+
ecosystemTypes.EcosystemTypeSUSEEnterpriseServer, ecosystemTypes.EcosystemTypeSUSEEnterpriseDesktop, ecosystemTypes.EcosystemTypeSUSEEnterpriseMicro:
467+
return models.Reference{
468+
Link: fmt.Sprintf("https://www.suse.com/security/cve/%s.html", da.AdvisoryID),
469+
Source: "SUSE",
470+
RefID: da.AdvisoryID,
471+
}, nil
465472
default:
466473
return models.Reference{}, xerrors.Errorf("unsupported family: %s", et)
467474
}
@@ -479,6 +486,8 @@ func cveContentSourceLink(ccType models.CveContentType, v vulnerabilityTypes.Vul
479486
return fmt.Sprintf("https://ubuntu.com/security/%s", v.Content.ID)
480487
case models.Nvd:
481488
return fmt.Sprintf("https://nvd.nist.gov/vuln/detail/%s", v.Content.ID)
489+
case models.SUSE:
490+
return fmt.Sprintf("https://www.suse.com/security/cve/%s", v.Content.ID)
482491
default:
483492
return ""
484493
}
@@ -765,7 +774,7 @@ func toVuls0Confidence(e ecosystemTypes.Ecosystem, s sourceTypes.SourceID) model
765774
DetectionMethod: models.DetectionMethod("EPELMatch"),
766775
SortOrder: 1,
767776
}
768-
case ecosystemTypes.EcosystemTypeRedHat, ecosystemTypes.EcosystemTypeFedora, ecosystemTypes.EcosystemTypeAlma, ecosystemTypes.EcosystemTypeRocky, ecosystemTypes.EcosystemTypeOracle, ecosystemTypes.EcosystemTypeAlpine:
777+
case ecosystemTypes.EcosystemTypeRedHat, ecosystemTypes.EcosystemTypeFedora, ecosystemTypes.EcosystemTypeAlma, ecosystemTypes.EcosystemTypeRocky, ecosystemTypes.EcosystemTypeOracle, ecosystemTypes.EcosystemTypeAlpine, ecosystemTypes.EcosystemTypeSUSEEnterpriseServer, ecosystemTypes.EcosystemTypeSUSEEnterpriseDesktop, ecosystemTypes.EcosystemTypeSUSEEnterpriseMicro, ecosystemTypes.EcosystemTypeOpenSUSE, ecosystemTypes.EcosystemTypeOpenSUSELeap, ecosystemTypes.EcosystemTypeOpenSUSELeapMicro, ecosystemTypes.EcosystemTypeOpenSUSETumbleweed:
769778
return models.OvalMatch
770779
case ecosystemTypes.EcosystemTypeUbuntu:
771780
switch s {

‎detector/vuls2/vuls2.go‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import (
1919
criteriaTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria"
2020
criterionTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion"
2121
vcAffectedRangeTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion/versioncriterion/affected/range"
22+
"github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion/versioncriterion/fixstatus"
2223
vcPackageTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion/versioncriterion/package"
2324
segmentTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/segment"
2425
ecosystemTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/segment/ecosystem"
@@ -494,6 +495,10 @@ func walkCriteria(e ecosystemTypes.Ecosystem, sourceID sourceTypes.SourceID, ca
494495

495496
switch fcn.Criterion.Version.Package.Type {
496497
case vcPackageTypes.PackageTypeBinary, vcPackageTypes.PackageTypeSource:
498+
if !cn.Criterion.Version.Vulnerable {
499+
continue
500+
}
501+
497502
rangeType, fixedIn := func() (vcAffectedRangeTypes.RangeType, string) {
498503
if fcn.Criterion.Version.Affected == nil {
499504
return vcAffectedRangeTypes.RangeTypeUnknown, ""
@@ -513,10 +518,21 @@ func walkCriteria(e ecosystemTypes.Ecosystem, sourceID sourceTypes.SourceID, ca
513518
if fcn.Criterion.Version.FixStatus == nil {
514519
return ""
515520
}
516-
return fixState(e, sourceID, fcn.Criterion.Version.FixStatus.Vendor)
521+
if s := fixState(e, sourceID, fcn.Criterion.Version.FixStatus.Vendor); s != "" {
522+
return s
523+
}
524+
if fcn.Criterion.Version.FixStatus.Class == fixstatus.ClassUnknown {
525+
return "Unknown"
526+
}
527+
return ""
528+
}(),
529+
FixedIn: fixedIn,
530+
NotFixedYet: func() bool {
531+
if cn.Criterion.Version.FixStatus == nil {
532+
return true
533+
}
534+
return cn.Criterion.Version.FixStatus.Class != fixstatus.ClassFixed
517535
}(),
518-
FixedIn: fixedIn,
519-
NotFixedYet: fixedIn == "",
520536
},
521537
})
522538
}

‎detector/vuls2/vuls2_test.go‎

Lines changed: 291 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6202,6 +6202,297 @@ func Test_postConvert(t *testing.T) {
62026202
},
62036203
},
62046204
},
6205+
{
6206+
name: "suse (prefer unfixed to fixed)",
6207+
args: args{
6208+
scanned: scanTypes.ScanResult{
6209+
Kernel: scanTypes.Kernel{
6210+
Release: "5.3.18-59.37-default",
6211+
},
6212+
OSPackages: []scanTypes.OSPackage{
6213+
{
6214+
Name: "binutils",
6215+
Version: "2.37",
6216+
Release: "7.26.1",
6217+
Arch: "x86_64",
6218+
},
6219+
{
6220+
Name: "sles-release",
6221+
Version: "15.3",
6222+
Release: "55.4.1",
6223+
Arch: "x86_64",
6224+
},
6225+
},
6226+
},
6227+
detected: detectTypes.DetectResult{
6228+
Detected: []detectTypes.VulnerabilityData{
6229+
{
6230+
ID: "CVE-2022-4285",
6231+
Advisories: []dbTypes.VulnerabilityDataAdvisory{
6232+
{
6233+
ID: "SUSE-CU-2023:3179-1",
6234+
Contents: map[sourceTypes.SourceID]map[dataTypes.RootID][]advisoryTypes.Advisory{
6235+
sourceTypes.SUSEOVAL: {
6236+
dataTypes.RootID("CVE-2022-4285"): {
6237+
{
6238+
Content: advisoryContentTypes.Content{
6239+
ID: "SUSE-CU-2023:3179-1",
6240+
},
6241+
Segments: []segmentTypes.Segment{
6242+
{
6243+
Ecosystem: ecosystemTypes.Ecosystem("suse.linux.enterprise.server:15"),
6244+
},
6245+
},
6246+
},
6247+
},
6248+
},
6249+
},
6250+
},
6251+
},
6252+
Vulnerabilities: []dbTypes.VulnerabilityDataVulnerability{
6253+
{
6254+
ID: "CVE-2022-4285",
6255+
Contents: map[sourceTypes.SourceID]map[dataTypes.RootID][]vulnerabilityTypes.Vulnerability{
6256+
sourceTypes.SUSEOVAL: {
6257+
dataTypes.RootID("CVE-2022-4285"): {
6258+
{
6259+
Content: vulnerabilityContentTypes.Content{
6260+
ID: "CVE-2022-4285",
6261+
Severity: []severityTypes.Severity{
6262+
{
6263+
Type: severityTypes.SeverityTypeCVSSv31,
6264+
Source: "SUSE",
6265+
CVSSv31: toPtr(cvssV31Types.CVSSv31{
6266+
Vector: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
6267+
BaseScore: 5.5,
6268+
BaseSeverity: "MEDIUM",
6269+
TemporalScore: 5.5,
6270+
TemporalSeverity: "MEDIUM",
6271+
EnvironmentalScore: 5.5,
6272+
EnvironmentalSeverity: "MEDIUM",
6273+
}),
6274+
},
6275+
},
6276+
},
6277+
Segments: []segmentTypes.Segment{
6278+
{
6279+
Ecosystem: ecosystemTypes.Ecosystem("suse.linux.enterprise.server:15"),
6280+
},
6281+
},
6282+
},
6283+
},
6284+
},
6285+
},
6286+
},
6287+
},
6288+
Detections: []detectTypes.VulnerabilityDataDetection{
6289+
{
6290+
Ecosystem: ecosystemTypes.Ecosystem("suse.linux.enterprise.server:15"),
6291+
Contents: map[sourceTypes.SourceID][]conditionTypes.FilteredCondition{
6292+
sourceTypes.SUSEOVAL: {
6293+
{
6294+
Criteria: criteriaTypes.FilteredCriteria{
6295+
Operator: criteriaTypes.CriteriaOperatorTypeOR,
6296+
Criterias: []criteriaTypes.FilteredCriteria{
6297+
{
6298+
Operator: criteriaTypes.CriteriaOperatorTypeAND,
6299+
Criterias: []criteriaTypes.FilteredCriteria{
6300+
{
6301+
Operator: criteriaTypes.CriteriaOperatorTypeOR,
6302+
Criterions: []criterionTypes.FilteredCriterion{
6303+
{
6304+
Criterion: criterionTypes.Criterion{
6305+
Type: criterionTypes.CriterionTypeVersion,
6306+
Version: toPtr(versioncriterionTypes.Criterion{
6307+
Vulnerable: false,
6308+
Package: vcPackageTypes.Package{
6309+
Type: vcPackageTypes.PackageTypeBinary,
6310+
Binary: &vcBinaryPackageTypes.Package{
6311+
Name: "sles-release",
6312+
},
6313+
},
6314+
Affected: &vcAffectedTypes.Affected{
6315+
Type: vcAffectedRangeTypes.RangeTypeRPMVersionOnly,
6316+
Range: []vcAffectedRangeTypes.Range{
6317+
{
6318+
Equal: "15.3",
6319+
},
6320+
},
6321+
},
6322+
}),
6323+
},
6324+
Accepts: criterionTypes.AcceptQueries{
6325+
Version: []int{1},
6326+
},
6327+
},
6328+
},
6329+
},
6330+
{
6331+
Operator: criteriaTypes.CriteriaOperatorTypeOR,
6332+
Criterions: []criterionTypes.FilteredCriterion{
6333+
{
6334+
Criterion: criterionTypes.Criterion{
6335+
Type: criterionTypes.CriterionTypeVersion,
6336+
Version: toPtr(versioncriterionTypes.Criterion{
6337+
Vulnerable: true,
6338+
FixStatus: toPtr(vcFixStatusTypes.FixStatus{
6339+
Class: vcFixStatusTypes.ClassFixed,
6340+
}),
6341+
Package: vcPackageTypes.Package{
6342+
Type: vcPackageTypes.PackageTypeBinary,
6343+
Binary: &vcBinaryPackageTypes.Package{
6344+
Name: "binutils",
6345+
Architectures: []string{
6346+
"aarch64",
6347+
"ppc64le",
6348+
"s390x",
6349+
"x86_64",
6350+
},
6351+
},
6352+
},
6353+
Affected: &vcAffectedTypes.Affected{
6354+
Type: vcAffectedRangeTypes.RangeTypeRPM,
6355+
Range: []vcAffectedRangeTypes.Range{
6356+
{
6357+
LessThan: "0:2.41-150100.7.46.1",
6358+
},
6359+
},
6360+
Fixed: []string{"0:2.41-150100.7.46.1"},
6361+
},
6362+
}),
6363+
},
6364+
Accepts: criterionTypes.AcceptQueries{
6365+
Version: []int{0},
6366+
},
6367+
},
6368+
},
6369+
},
6370+
},
6371+
},
6372+
{
6373+
Operator: criteriaTypes.CriteriaOperatorTypeAND,
6374+
Criterias: []criteriaTypes.FilteredCriteria{
6375+
{
6376+
Operator: criteriaTypes.CriteriaOperatorTypeOR,
6377+
Criterions: []criterionTypes.FilteredCriterion{
6378+
{
6379+
Criterion: criterionTypes.Criterion{
6380+
Type: criterionTypes.CriterionTypeVersion,
6381+
Version: toPtr(versioncriterionTypes.Criterion{
6382+
Vulnerable: false,
6383+
Package: vcPackageTypes.Package{
6384+
Type: vcPackageTypes.PackageTypeBinary,
6385+
Binary: &vcBinaryPackageTypes.Package{
6386+
Name: "sles-release",
6387+
},
6388+
},
6389+
Affected: &vcAffectedTypes.Affected{
6390+
Type: vcAffectedRangeTypes.RangeTypeRPMVersionOnly,
6391+
Range: []vcAffectedRangeTypes.Range{
6392+
{
6393+
Equal: "15.3",
6394+
},
6395+
},
6396+
},
6397+
}),
6398+
},
6399+
Accepts: criterionTypes.AcceptQueries{
6400+
Version: []int{1},
6401+
},
6402+
},
6403+
},
6404+
},
6405+
{
6406+
Operator: criteriaTypes.CriteriaOperatorTypeOR,
6407+
Criterions: []criterionTypes.FilteredCriterion{
6408+
{
6409+
Criterion: criterionTypes.Criterion{
6410+
Type: criterionTypes.CriterionTypeVersion,
6411+
Version: toPtr(versioncriterionTypes.Criterion{
6412+
Vulnerable: true,
6413+
FixStatus: toPtr(vcFixStatusTypes.FixStatus{
6414+
Class: vcFixStatusTypes.ClassUnfixed,
6415+
}),
6416+
Package: vcPackageTypes.Package{
6417+
Type: vcPackageTypes.PackageTypeBinary,
6418+
Binary: &vcBinaryPackageTypes.Package{
6419+
Name: "binutils",
6420+
Architectures: []string{
6421+
"aarch64",
6422+
"ppc64le",
6423+
"s390x",
6424+
"x86_64",
6425+
},
6426+
},
6427+
},
6428+
Affected: &vcAffectedTypes.Affected{
6429+
Type: vcAffectedRangeTypes.RangeTypeRPM,
6430+
},
6431+
}),
6432+
},
6433+
Accepts: criterionTypes.AcceptQueries{
6434+
Version: []int{0},
6435+
},
6436+
},
6437+
},
6438+
},
6439+
},
6440+
},
6441+
},
6442+
},
6443+
},
6444+
},
6445+
},
6446+
},
6447+
},
6448+
},
6449+
},
6450+
},
6451+
},
6452+
want: models.VulnInfos{
6453+
"CVE-2022-4285": {
6454+
CveID: "CVE-2022-4285",
6455+
Confidences: models.Confidences{models.OvalMatch},
6456+
AffectedPackages: models.PackageFixStatuses{
6457+
{
6458+
Name: "binutils",
6459+
NotFixedYet: true,
6460+
},
6461+
},
6462+
DistroAdvisories: models.DistroAdvisories{
6463+
{
6464+
AdvisoryID: "SUSE-CU-2023:3179-1",
6465+
Issued: time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC),
6466+
Updated: time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC),
6467+
},
6468+
},
6469+
CveContents: models.CveContents{
6470+
models.SUSE: []models.CveContent{
6471+
{
6472+
Type: models.SUSE,
6473+
CveID: "CVE-2022-4285",
6474+
Cvss3Score: 5.5,
6475+
Cvss3Vector: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
6476+
Cvss3Severity: "MEDIUM",
6477+
SourceLink: "https://www.suse.com/security/cve/CVE-2022-4285",
6478+
References: models.References{
6479+
{
6480+
Link: "https://www.suse.com/security/cve/SUSE-CU-2023:3179-1.html",
6481+
Source: "SUSE",
6482+
RefID: "SUSE-CU-2023:3179-1",
6483+
},
6484+
},
6485+
Published: time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC),
6486+
LastModified: time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC),
6487+
Optional: map[string]string{
6488+
"vuls2-sources": "[{\"root_id\":\"CVE-2022-4285\",\"source_id\":\"suse-oval\",\"segment\":{\"ecosystem\":\"suse.linux.enterprise.server:15\"}}]",
6489+
},
6490+
},
6491+
},
6492+
},
6493+
},
6494+
},
6495+
},
62056496
}
62066497
for _, tt := range tests {
62076498
t.Run(tt.name, func(t *testing.T) {

0 commit comments

Comments
 (0)