Skip to content

feat: Support Windows PE metadata parsing for Python binaries #5159

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 5 commits into from
Closed

feat: Support Windows PE metadata parsing for Python binaries #5159

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e43d07e
Add PE metadata extraction for Python version in checker
alex-cheng-techman Jun 19, 2025
515dc77
Remove test and backup files from commit
alex-cheng-techman Jun 19, 2025
79e714a
remove openssl.py from PR. see PR #5174
alex-cheng-techman Jun 27, 2025
efaf961
fix: update Python checker and version scanner for PE metadata improv…
alex-cheng-techman Jun 27, 2025
18ad411
fix: set more strict python pattern extracting from pe metadata
alex-cheng-techman Jun 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions cve_bin_tool/checkers/openssl.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ class OpensslChecker(Checker):
CONTAINS_PATTERNS = [r"part of OpenSSL", r"openssl.cnf", r"-DOPENSSL_"]
FILENAME_PATTERNS = [r"libssl.so.", r"libcrypto.so"]
VERSION_PATTERNS = [
# for general format: OpenSSL 1.0.2u¡BOpenSSL 3.0.0¡BOpenSSL 1.1.1k
r"OpenSSL\s+([0-9]+\.[0-9]+\.[0-9]+[a-z]*)",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm pretty sure this will cause false positives (lots of things mention specific versions of openssl in error messages and stuff) so you'll probably need to add whatever string is before or after in the windows binaries to disambiguate.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pinging @ffontaine who's spent a lot of time tightening our signatures: any recommendations?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I confirm that this pattern will raise false positives for example with OpenSSL 1.1.1 or newer which is embedded in most binaries linking with openssl (see commit 0f7a834).

By the way, I'm a bit unconfortable with the current approach.
I see that extract_version_from_pe is constructing a fake line from 3 PE fields: ProductName ProductVersion CompanyName
Then this fake line is passed to binary checkers which are updated to handle this fake line.
This is definitely "hacking" the binary checker logic.

IMHO, making a language parser to extract PE information could be a better approach.
In this PE language parser, specific PE handling could be done such as adding a regex to extract ([0-9]+\.[0-9]+\.[0-9]+) from ProductVersion.
The user could also easily disable this new handling if they are not happy with the results.

An other option would be to just update the python and openssl patterns so that they work with your windows file.

If you can provide the pe windows file that fails to be detected, I could probably help you.


r"OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+\r?\n(?:%s \(Library: %s\)|[a-zA-Z0-9:,_ \.\-\r\n]*OPENSSLDIR|ssl)",
r"(?:%s \(Library: %s\)\r?\n|OPENSSLDIR[a-zA-Z0-9:/ \"\-\r\n]*)OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+",
]
Expand Down
3 changes: 3 additions & 0 deletions cve_bin_tool/checkers/python.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,9 @@ class PythonChecker(Checker):
]
FILENAME_PATTERNS = [r"python"]
VERSION_PATTERNS = [
# to match the data from PE file
r"[Pp]ython ([0-9]+\.[0-9]+\.[0-9]+)",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one may also cause false positives.


r"src\\python[23]\\Python-([23]+\.[0-9]+\.[0-9]+)",
r"python(?:[23]+\.[0-9]+)-([23]+\.[0-9]+\.[0-9]+)",
r"pymalloc_debug\r?\n([23]+\.[0-9]+\.[0-9]+)",
Expand Down
22 changes: 22 additions & 0 deletions cve_bin_tool/version_scanner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,27 @@ def is_linux_kernel(self, filename: str) -> tuple[bool, str | None]:

return False, output

# used to get product name, version, vendor info PE metadata
def extract_version_from_pe(self, filename: str) -> str:
info = ""
try:
import pefile
with pefile.PE(filename) as pe:
#pe = pefile.PE(filename)
for fileinfo in pe.FileInfo:
for entry in fileinfo:
if entry.Key == b'StringFileInfo':
for st in entry.StringTable:
entries = st.entries
product_name = entries.get(b'ProductName', b'').decode(errors='ignore')
product_version = entries.get(b'ProductVersion', b'').decode(errors='ignore')
company_name = entries.get(b'CompanyName', b'').decode(errors='ignore')
info = (f" {product_name} {product_version} {company_name}")
self.logger.debug(f"peFile.PE Metadata:{info}")
except Exception as e:
LOGGER.debug(f"[PE Metadata] Failed to parse PE file {filename}: {e}")
return info

def scan_file(self, filename: str) -> Iterator[ScanInfo]:
"""Scans a file to see if it contains any of the target libraries,
and whether any of those contain CVEs"""
Expand Down Expand Up @@ -261,6 +282,7 @@ def scan_file(self, filename: str) -> Iterator[ScanInfo]:

# parse binary file's strings
lines = parse_strings(filename)
lines += self.extract_version_from_pe(filename)

if self.no_scan:
yield from self.run_checkers(filename, lines)
Expand Down
Loading