diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml new file mode 100644 index 00000000..ac6621f1 --- /dev/null +++ b/.github/dependabot.yaml @@ -0,0 +1,11 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + - package-ecosystem: "" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "weekly" diff --git a/.github/workflows/b-binary-build-and-e2e-tests.yaml b/.github/workflows/b-binary-build-and-e2e-tests.yaml index 82d9c254..5b15b093 100644 --- a/.github/workflows/b-binary-build-and-e2e-tests.yaml +++ b/.github/workflows/b-binary-build-and-e2e-tests.yaml @@ -292,6 +292,7 @@ jobs: uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # ratchet:actions/checkout@v3 with: repository: armosec/system-tests + ref: remove-urls path: . - uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # ratchet:actions/setup-python@v4 diff --git a/cmd/config/config.go b/cmd/config/config.go index 5f276ec7..49840248 100644 --- a/cmd/config/config.go +++ b/cmd/config/config.go @@ -23,14 +23,8 @@ var ( # Set account id %[1]s config set accountID - # Set client id - %[1]s config set clientID - - # Set access key - %[1]s config set secretKey - - # Set cloudAPIURL - %[1]s config set cloudAPIURL + # Set cloud report URL + %[1]s config set cloudReportURL `, cautils.ExecName()) ) diff --git a/cmd/config/set.go b/cmd/config/set.go index 83d6e805..9662e943 100644 --- a/cmd/config/set.go +++ b/cmd/config/set.go @@ -34,12 +34,8 @@ func getSetCmd(ks meta.IKubescape) *cobra.Command { var supportConfigSet = map[string]func(*metav1.SetConfig, string){ "accountID": func(s *metav1.SetConfig, account string) { s.Account = account }, - "clientID": func(s *metav1.SetConfig, clientID string) { s.ClientID = clientID }, - "secretKey": func(s *metav1.SetConfig, secretKey string) { s.SecretKey = secretKey }, "cloudAPIURL": func(s *metav1.SetConfig, cloudAPIURL string) { s.CloudAPIURL = cloudAPIURL }, - "cloudAuthURL": func(s *metav1.SetConfig, cloudAuthURL string) { s.CloudAuthURL = cloudAuthURL }, "cloudReportURL": func(s *metav1.SetConfig, cloudReportURL string) { s.CloudReportURL = cloudReportURL }, - "cloudUIURL": func(s *metav1.SetConfig, cloudUIURL string) { s.CloudUIURL = cloudUIURL }, } func stringKeysToSlice(m map[string]func(*metav1.SetConfig, string)) []string { diff --git a/cmd/delete/delete.go b/cmd/delete/delete.go deleted file mode 100644 index d3af0746..00000000 --- a/cmd/delete/delete.go +++ /dev/null @@ -1,37 +0,0 @@ -package delete - -import ( - "fmt" - - "github.com/kubescape/kubescape/v2/core/cautils" - "github.com/kubescape/kubescape/v2/core/meta" - v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" - "github.com/spf13/cobra" -) - -var deleteExceptionsExamples = fmt.Sprintf(` - # Delete single exception - %[1]s delete exceptions "exception name" - - # Delete multiple exceptions - %[1]s delete exceptions "first exception;second exception;third exception" -`, cautils.ExecName()) - -func GetDeleteCmd(ks meta.IKubescape) *cobra.Command { - var deleteInfo v1.Delete - - var deleteCmd = &cobra.Command{ - Use: "delete ", - Short: "Delete configurations in Kubescape SaaS version", - Long: ``, - Run: func(cmd *cobra.Command, args []string) { - }, - } - deleteCmd.PersistentFlags().StringVarP(&deleteInfo.Credentials.Account, "account", "", "", "Kubescape SaaS account ID. Default will load account ID from cache") - deleteCmd.PersistentFlags().StringVarP(&deleteInfo.Credentials.ClientID, "client-id", "", "", "Kubescape SaaS client ID. Default will load client ID from cache, read more - https://hub.armosec.io/docs/authentication") - deleteCmd.PersistentFlags().StringVarP(&deleteInfo.Credentials.SecretKey, "secret-key", "", "", "Kubescape SaaS secret key. Default will load secret key from cache, read more - https://hub.armosec.io/docs/authentication") - - deleteCmd.AddCommand(getExceptionsCmd(ks, &deleteInfo)) - - return deleteCmd -} diff --git a/cmd/delete/exceptions.go b/cmd/delete/exceptions.go deleted file mode 100644 index f4fe0477..00000000 --- a/cmd/delete/exceptions.go +++ /dev/null @@ -1,47 +0,0 @@ -package delete - -import ( - "fmt" - "strings" - - logger "github.com/kubescape/go-logger" - "github.com/kubescape/kubescape/v2/core/cautils" - "github.com/kubescape/kubescape/v2/core/meta" - v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" - "github.com/spf13/cobra" -) - -func getExceptionsCmd(ks meta.IKubescape, deleteInfo *v1.Delete) *cobra.Command { - return &cobra.Command{ - Use: "exceptions ", - Short: fmt.Sprintf("Delete exceptions from Kubescape SaaS version. Run '%[1]s list exceptions' for all exceptions names", cautils.ExecName()), - Example: deleteExceptionsExamples, - Args: func(cmd *cobra.Command, args []string) error { - if len(args) != 1 { - return fmt.Errorf("missing exceptions names") - } - return nil - }, - Run: func(cmd *cobra.Command, args []string) { - - if err := flagValidationDelete(deleteInfo); err != nil { - logger.L().Fatal(err.Error()) - } - - exceptionsNames := strings.Split(args[0], ";") - if len(exceptionsNames) == 0 { - logger.L().Fatal("missing exceptions names") - } - if err := ks.DeleteExceptions(&v1.DeleteExceptions{Credentials: deleteInfo.Credentials, Exceptions: exceptionsNames}); err != nil { - logger.L().Fatal(err.Error()) - } - }, - } -} - -// Check if the flag entered are valid -func flagValidationDelete(deleteInfo *v1.Delete) error { - - // Validate the user's credentials - return deleteInfo.Credentials.Validate() -} diff --git a/cmd/download/download.go b/cmd/download/download.go index 23490cd6..4ff92d1f 100644 --- a/cmd/download/download.go +++ b/cmd/download/download.go @@ -83,9 +83,9 @@ func GetDownloadCmd(ks meta.IKubescape) *cobra.Command { }, } - downloadCmd.PersistentFlags().StringVarP(&downloadInfo.Credentials.Account, "account", "", "", "Kubescape SaaS account ID. Default will load account ID from cache") - downloadCmd.PersistentFlags().StringVarP(&downloadInfo.Credentials.ClientID, "client-id", "", "", "Kubescape SaaS client ID. Default will load client ID from cache, read more - https://hub.armosec.io/docs/authentication") - downloadCmd.PersistentFlags().StringVarP(&downloadInfo.Credentials.SecretKey, "secret-key", "", "", "Kubescape SaaS secret key. Default will load secret key from cache, read more - https://hub.armosec.io/docs/authentication") + downloadCmd.PersistentFlags().StringVarP(&downloadInfo.AccountID, "account", "", "", "Kubescape SaaS account ID. Default will load account ID from cache") + downloadCmd.PersistentFlags().MarkDeprecated("client-id", "Client ID is no longer supported. Feel free to contact the Kubescape maintainers for more information.") + downloadCmd.PersistentFlags().MarkDeprecated("secret-key", "Secret Key is no longer supported. Feel free to contact the Kubescape maintainers for more information.") downloadCmd.Flags().StringVarP(&downloadInfo.Path, "output", "o", "", "Output file. If not specified, will save in `~/.kubescape/.json`") return downloadCmd @@ -95,5 +95,5 @@ func GetDownloadCmd(ks meta.IKubescape) *cobra.Command { func flagValidationDownload(downloadInfo *v1.DownloadInfo) error { // Validate the user's credentials - return downloadInfo.Credentials.Validate() + return cautils.ValidateAccountID(downloadInfo.AccountID) } diff --git a/cmd/fix/fix.go b/cmd/fix/fix.go index 0c91dbac..32a84227 100644 --- a/cmd/fix/fix.go +++ b/cmd/fix/fix.go @@ -27,7 +27,7 @@ func GetFixCmd(ks meta.IKubescape) *cobra.Command { fixCmd := &cobra.Command{ Use: "fix ", - Short: "Fix misconfiguration in files", + Short: "Propose a fix for the misconfiguration found when scanning Kubernetes manifest files", Long: ``, Example: fixCmdExamples, RunE: func(cmd *cobra.Command, args []string) error { diff --git a/cmd/list/list.go b/cmd/list/list.go index 6941255e..961f2193 100644 --- a/cmd/list/list.go +++ b/cmd/list/list.go @@ -63,7 +63,7 @@ func GetListCmd(ks meta.IKubescape) *cobra.Command { return nil }, } - listCmd.PersistentFlags().StringVarP(&listPolicies.Credentials.Account, "account", "", "", "Kubescape SaaS account ID. Default will load account ID from cache") + listCmd.PersistentFlags().StringVarP(&listPolicies.AccountID, "account", "", "", "Kubescape SaaS account ID. Default will load account ID from cache") listCmd.PersistentFlags().StringVar(&listPolicies.Format, "format", "pretty-print", "output format. supported: 'pretty-print'/'json'") listCmd.PersistentFlags().MarkDeprecated("id", "Control ID's are included in list outputs") @@ -74,5 +74,5 @@ func GetListCmd(ks meta.IKubescape) *cobra.Command { func flagValidationList(listPolicies *v1.ListPolicies) error { // Validate the user's credentials - return listPolicies.Credentials.Validate() + return cautils.ValidateAccountID(listPolicies.AccountID) } diff --git a/cmd/patch/patch.go b/cmd/patch/patch.go index 91242d49..58b4e20f 100644 --- a/cmd/patch/patch.go +++ b/cmd/patch/patch.go @@ -68,13 +68,20 @@ func validateImagePatchInfo(patchInfo *metav1.PatchInfo) error { if err != nil { return nil } - patchInfo.Image = patchInfoImage + // Parse the image full name to get image name and tag - named, err := ref.ParseNamed(patchInfo.Image) + named, err := ref.ParseNamed(patchInfoImage) if err != nil { return err } + // If no tag or digest is provided, default to 'latest' + if ref.IsNameOnly(named) { + logger.L().Warning("Image name has no tag or digest, using latest as tag") + named = ref.TagNameOnly(named) + } + patchInfo.Image = named.String() + // If no patched image tag is provided, default to '-patched' if patchInfo.PatchedImageTag == "" { @@ -96,7 +103,7 @@ func validateImagePatchInfo(patchInfo *metav1.PatchInfo) error { // Extract the "image" name from the canonical Image URL // If it's an official docker image, we store just the "image-name". Else if a docker repo then we store as "repo/image". Else complete URL - ref, _ := reference.ParseNormalizedNamed(patchInfoImage) + ref, _ := reference.ParseNormalizedNamed(patchInfo.Image) imageName := named.Name() if strings.Contains(imageName, "docker.io/library/") { imageName = reference.Path(ref) diff --git a/cmd/root.go b/cmd/root.go index 80db97b8..1668542c 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -8,13 +8,11 @@ import ( "github.com/kubescape/go-logger/helpers" "github.com/kubescape/kubescape/v2/cmd/completion" "github.com/kubescape/kubescape/v2/cmd/config" - "github.com/kubescape/kubescape/v2/cmd/delete" "github.com/kubescape/kubescape/v2/cmd/download" "github.com/kubescape/kubescape/v2/cmd/fix" "github.com/kubescape/kubescape/v2/cmd/list" "github.com/kubescape/kubescape/v2/cmd/patch" "github.com/kubescape/kubescape/v2/cmd/scan" - "github.com/kubescape/kubescape/v2/cmd/submit" "github.com/kubescape/kubescape/v2/cmd/update" "github.com/kubescape/kubescape/v2/cmd/version" "github.com/kubescape/kubescape/v2/core/cautils" @@ -28,11 +26,11 @@ import ( var rootInfo cautils.RootInfo var ksExamples = fmt.Sprintf(` - # Scan command + # Scan a Kubernetes cluster or YAML files for image vulnerabilities and misconfigurations %[1]s scan - # List supported frameworks - %[1]s list frameworks + # List supported controls + %[1]s list controls # Download artifacts (air-gapped environment support) %[1]s download artifacts @@ -64,9 +62,10 @@ func getRootCmd(ks meta.IKubescape) *cobra.Command { rootCmd.SetUsageTemplate(newUsageTemplate) } - rootCmd.PersistentFlags().StringVar(&rootInfo.KSCloudBEURLsDep, "environment", "", envFlagUsage) - rootCmd.PersistentFlags().StringVar(&rootInfo.KSCloudBEURLs, "env", "", envFlagUsage) - rootCmd.PersistentFlags().MarkDeprecated("environment", "use 'env' instead") + rootCmd.PersistentFlags().StringVar(&rootInfo.DiscoveryServerURL, "server", "api.armosec.io", "Backend discovery server URL") // TODO: remove default value + + rootCmd.PersistentFlags().MarkDeprecated("environment", "'environment' is no longer supported, Use 'server' instead. Feel free to contact the Kubescape maintainers for more information.") + rootCmd.PersistentFlags().MarkDeprecated("env", "'env' is no longer supported, Use 'server' instead. Feel free to contact the Kubescape maintainers for more information.") rootCmd.PersistentFlags().MarkHidden("environment") rootCmd.PersistentFlags().MarkHidden("env") @@ -75,17 +74,15 @@ func getRootCmd(ks meta.IKubescape) *cobra.Command { rootCmd.PersistentFlags().StringVarP(&rootInfo.Logger, "logger", "l", helpers.InfoLevel.String(), fmt.Sprintf("Logger level. Supported: %s [$KS_LOGGER]", strings.Join(helpers.SupportedLevels(), "/"))) rootCmd.PersistentFlags().StringVar(&rootInfo.CacheDir, "cache-dir", getter.DefaultLocalStore, "Cache directory [$KS_CACHE_DIR]") - rootCmd.PersistentFlags().BoolVarP(&rootInfo.DisableColor, "disable-color", "", false, "Disable Color output for logging") - rootCmd.PersistentFlags().BoolVarP(&rootInfo.EnableColor, "enable-color", "", false, "Force enable Color output for logging") + rootCmd.PersistentFlags().BoolVarP(&rootInfo.DisableColor, "disable-color", "", false, "Disable color output for logging") + rootCmd.PersistentFlags().BoolVarP(&rootInfo.EnableColor, "enable-color", "", false, "Force enable color output for logging") cobra.OnInitialize(initLogger, initLoggerLevel, initEnvironment, initCacheDir) // Supported commands rootCmd.AddCommand(scan.GetScanCommand(ks)) rootCmd.AddCommand(download.GetDownloadCmd(ks)) - rootCmd.AddCommand(delete.GetDeleteCmd(ks)) rootCmd.AddCommand(list.GetListCmd(ks)) - rootCmd.AddCommand(submit.GetSubmitCmd(ks)) rootCmd.AddCommand(completion.GetCompletionCmd()) rootCmd.AddCommand(version.GetVersionCmd()) rootCmd.AddCommand(config.GetConfigCmd(ks)) @@ -93,6 +90,16 @@ func getRootCmd(ks meta.IKubescape) *cobra.Command { rootCmd.AddCommand(fix.GetFixCmd(ks)) rootCmd.AddCommand(patch.GetPatchCmd(ks)) + // deprecated commands + rootCmd.AddCommand(&cobra.Command{ + Use: "submit", + Deprecated: "This command is deprecated. Contact Kubescape maintainers for more information.", + }) + rootCmd.AddCommand(&cobra.Command{ + Use: "delete", + Deprecated: "This command is deprecated. Contact Kubescape maintainers for more information.", + }) + return rootCmd } diff --git a/cmd/rootutils.go b/cmd/rootutils.go index a7109fa6..8fe0fc35 100644 --- a/cmd/rootutils.go +++ b/cmd/rootutils.go @@ -5,15 +5,19 @@ import ( "os" "strings" + v1 "github.com/kubescape/backend/pkg/client/v1" + "github.com/kubescape/backend/pkg/servicediscovery" + sdClientV1 "github.com/kubescape/backend/pkg/servicediscovery/v1" logger "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/go-logger/iconlogger" + "github.com/kubescape/go-logger/zaplogger" + "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/cautils/getter" "github.com/mattn/go-isatty" ) -const envFlagUsage = "Send report results to specific URL. Format:,,.\n\t\tExample:report.armo.cloud,api.armo.cloud,portal.armo.cloud" - func initLogger() { logger.DisableColor(rootInfo.DisableColor) logger.EnableColor(rootInfo.EnableColor) @@ -23,9 +27,9 @@ func initLogger() { rootInfo.LoggerName = l } else { if isatty.IsTerminal(os.Stdout.Fd()) { - rootInfo.LoggerName = "pretty" + rootInfo.LoggerName = iconlogger.LoggerName } else { - rootInfo.LoggerName = "zap" + rootInfo.LoggerName = zaplogger.LoggerName } } } @@ -56,40 +60,50 @@ func initCacheDir() { logger.L().Debug("cache dir updated", helpers.String("path", getter.DefaultLocalStore)) } func initEnvironment() { - if rootInfo.KSCloudBEURLs == "" { - rootInfo.KSCloudBEURLs = rootInfo.KSCloudBEURLsDep + if rootInfo.DiscoveryServerURL == "" { + return } - urlSlices := strings.Split(rootInfo.KSCloudBEURLs, ",") - if len(urlSlices) != 1 && len(urlSlices) < 3 { - logger.L().Fatal("expected at least 3 URLs (report, api, frontend, auth)") - } - switch len(urlSlices) { - case 1: - switch urlSlices[0] { - case "dev", "development": - getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIDev()) - case "stage", "staging": - getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIStaging()) - case "": - getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIProd()) - default: - logger.L().Fatal("--environment flag usage: " + envFlagUsage) - } - case 2: - logger.L().Fatal("--environment flag usage: " + envFlagUsage) - case 3, 4: - var ksAuthURL string - ksEventReceiverURL := urlSlices[0] // mandatory - ksBackendURL := urlSlices[1] // mandatory - ksFrontendURL := urlSlices[2] // mandatory - if len(urlSlices) >= 4 { - ksAuthURL = urlSlices[3] - } - getter.SetKSCloudAPIConnector(getter.NewKSCloudAPICustomized( - ksBackendURL, ksAuthURL, - getter.WithReportURL(ksEventReceiverURL), - getter.WithFrontendURL(ksFrontendURL), - )) + logger.L().Debug("fetching URLs from service discovery server", helpers.String("server", rootInfo.DiscoveryServerURL)) + + client, err := sdClientV1.NewServiceDiscoveryClientV1(rootInfo.DiscoveryServerURL) + if err != nil { + logger.L().Fatal("failed to create service discovery client", helpers.Error(err), helpers.String("server", rootInfo.DiscoveryServerURL)) + return } + + services, err := servicediscovery.GetServices( + client, + ) + + if err != nil { + logger.L().Fatal("failed to to get services from server", helpers.Error(err), helpers.String("server", rootInfo.DiscoveryServerURL)) + return + } + + logger.L().Debug("configuring service discovery URLs", helpers.String("cloudAPIURL", services.GetApiServerUrl()), helpers.String("cloudReportURL", services.GetReportReceiverHttpUrl())) + + tenant := cautils.GetTenantConfig("", "", "", nil) + if services.GetApiServerUrl() != "" { + tenant.GetConfigObj().CloudAPIURL = services.GetApiServerUrl() + } + if services.GetReportReceiverHttpUrl() != "" { + tenant.GetConfigObj().CloudReportURL = services.GetReportReceiverHttpUrl() + } + + if err = tenant.UpdateCachedConfig(); err != nil { + logger.L().Error("failed to update cached config", helpers.Error(err)) + } + + ksCloud, err := v1.NewKSCloudAPI( + services.GetApiServerUrl(), + services.GetReportReceiverHttpUrl(), + "", + ) + if err != nil { + logger.L().Fatal("failed to create KS Cloud client", helpers.Error(err)) + return + } + + getter.SetKSCloudAPIConnector(ksCloud) } diff --git a/cmd/scan/control.go b/cmd/scan/control.go index d7ddef79..dacf7bfe 100644 --- a/cmd/scan/control.go +++ b/cmd/scan/control.go @@ -91,6 +91,7 @@ func getControlCmd(ks meta.IKubescape, scanInfo *cautils.ScanInfo) *cobra.Comman } scanInfo.FrameworkScan = false + scanInfo.SetScanType(cautils.ScanTypeControl) if err := validateControlScanInfo(scanInfo); err != nil { return err diff --git a/cmd/scan/framework.go b/cmd/scan/framework.go index 1438f206..780c5634 100644 --- a/cmd/scan/framework.go +++ b/cmd/scan/framework.go @@ -226,5 +226,5 @@ func validateFrameworkScanInfo(scanInfo *cautils.ScanInfo) error { } // Validate the user's credentials - return scanInfo.Credentials.Validate() + return cautils.ValidateAccountID(scanInfo.AccountID) } diff --git a/cmd/scan/image.go b/cmd/scan/image.go index 502018a4..6d84bac0 100644 --- a/cmd/scan/image.go +++ b/cmd/scan/image.go @@ -5,7 +5,6 @@ import ( "fmt" logger "github.com/kubescape/go-logger" - "github.com/kubescape/go-logger/iconlogger" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/core" "github.com/kubescape/kubescape/v2/core/meta" @@ -23,7 +22,7 @@ type imageScanInfo struct { // TODO(vladklokun): document image scanning on the Kubescape Docs Hub? var ( imageExample = fmt.Sprintf(` - This command is still in BETA. Feel free to contact the kubescape maintainers for more information. + This command is still in BETA. Feel free to contact the Kubescape maintainers for more information. Scan an image for vulnerabilities. @@ -55,8 +54,6 @@ func getImageCmd(ks meta.IKubescape, scanInfo *cautils.ScanInfo, imgScanInfo *im ctx := context.Background() - logger.InitLogger(iconlogger.LoggerName) - dbCfg, _ := imagescan.NewDefaultDBConfig() svc := imagescan.NewScanService(dbCfg) @@ -77,9 +74,9 @@ func getImageCmd(ks meta.IKubescape, scanInfo *cautils.ScanInfo, imgScanInfo *im scanInfo.SetScanType(cautils.ScanTypeImage) - outputPrinters := core.GetOutputPrinters(scanInfo, ctx) + outputPrinters := core.GetOutputPrinters(scanInfo, ctx, "") - uiPrinter := core.GetUIPrinter(ctx, scanInfo) + uiPrinter := core.GetUIPrinter(ctx, scanInfo, "") resultsHandler := resultshandling.NewResultsHandler(nil, outputPrinters, uiPrinter) diff --git a/cmd/scan/scan.go b/cmd/scan/scan.go index acb74c31..2f30cca1 100644 --- a/cmd/scan/scan.go +++ b/cmd/scan/scan.go @@ -17,14 +17,14 @@ import ( var scanCmdExamples = fmt.Sprintf(` Scan command is for scanning an existing cluster or kubernetes manifest files based on pre-defined frameworks - # Scan current cluster with all frameworks + # Scan current cluster %[1]s scan - # Scan kubernetes YAML manifest files + # Scan kubernetes manifest files %[1]s scan . # Scan and save the results in the JSON format - %[1]s scan --format json --output results.json --format-version=v2 + %[1]s scan --format json --output results.json # Display all resources %[1]s scan --verbose @@ -39,7 +39,7 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command { // scanCmd represents the scan command scanCmd := &cobra.Command{ Use: "scan", - Short: "Scan the current running cluster or yaml files", + Short: "Scan a Kubernetes cluster or YAML files for image vulnerabilities and misconfigurations", Long: `The action you want to perform`, Example: scanCmdExamples, Args: func(cmd *cobra.Command, args []string) error { @@ -72,8 +72,7 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command { }, } - scanCmd.PersistentFlags().StringVarP(&scanInfo.Credentials.Account, "account", "", "", "Kubescape SaaS account ID. Default will load account ID from cache") - scanCmd.PersistentFlags().BoolVar(&scanInfo.CreateAccount, "create-account", false, "Create a Kubescape SaaS account ID account ID is not found in cache. After creating the account, the account ID will be saved in cache. In addition, the scanning results will be uploaded to the Kubescape SaaS") + scanCmd.PersistentFlags().StringVarP(&scanInfo.AccountID, "account", "", "", "Kubescape SaaS account ID. Default will load account ID from cache") scanCmd.PersistentFlags().StringVarP(&scanInfo.KubeContext, "kube-context", "", "", "Kube context. Default will use the current-context") scanCmd.PersistentFlags().StringVar(&scanInfo.ControlsInputs, "controls-config", "", "Path to an controls-config obj. If not set will download controls-config from ARMO management portal") scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from ARMO management portal") @@ -103,10 +102,9 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command { scanCmd.PersistentFlags().MarkDeprecated("silent", "use '--logger' flag instead. Flag will be removed at 1.May.2022") scanCmd.PersistentFlags().MarkDeprecated("fail-threshold", "use '--compliance-threshold' flag instead. Flag will be removed at 1.Dec.2023") - scanCmd.PersistentFlags().StringVarP(&scanInfo.Credentials.ClientID, "client-id", "", "", "Kubescape SaaS client ID. Default will load client ID from cache, read more - https://hub.armosec.io/docs/authentication") - scanCmd.PersistentFlags().StringVarP(&scanInfo.Credentials.SecretKey, "secret-key", "", "", "Kubescape SaaS secret key. Default will load secret key from cache, read more - https://hub.armosec.io/docs/authentication") - scanCmd.PersistentFlags().MarkDeprecated("client-id", "login to Kubescape SaaS will be unsupported, please contact the Kubescape maintainers for more information") - scanCmd.PersistentFlags().MarkDeprecated("secret-key", "login to Kubescape SaaS will be unsupported, please contact the Kubescape maintainers for more information") + scanCmd.PersistentFlags().MarkDeprecated("client-id", "Client ID is no longer supported. Feel free to contact the Kubescape maintainers for more information.") + scanCmd.PersistentFlags().MarkDeprecated("create-account", "Create account is no longer supported. In case of a missing Account ID and a configured backend server, a new account id will be generated automatically by Kubescape. Feel free to contact the Kubescape maintainers for more information.") + scanCmd.PersistentFlags().MarkDeprecated("secret-key", "Secret Key is no longer supported. Feel free to contact the Kubescape maintainers for more information.") // hidden flags scanCmd.PersistentFlags().MarkHidden("omit-raw-resources") diff --git a/cmd/scan/workload.go b/cmd/scan/workload.go index f589c353..6cbbdc52 100644 --- a/cmd/scan/workload.go +++ b/cmd/scan/workload.go @@ -17,7 +17,7 @@ import ( var ( workloadExample = fmt.Sprintf(` - This command is still in BETA. Feel free to contact the kubescape maintainers for more information. + This command is still in BETA. Feel free to contact the Kubescape maintainers for more information. Scan a workload for misconfigurations and image vulnerabilities. diff --git a/cmd/submit/exceptions.go b/cmd/submit/exceptions.go deleted file mode 100644 index 9e020abd..00000000 --- a/cmd/submit/exceptions.go +++ /dev/null @@ -1,35 +0,0 @@ -package submit - -import ( - "context" - "fmt" - - logger "github.com/kubescape/go-logger" - "github.com/kubescape/kubescape/v2/core/meta" - metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" - - "github.com/spf13/cobra" -) - -func getExceptionsCmd(ks meta.IKubescape, submitInfo *metav1.Submit) *cobra.Command { - return &cobra.Command{ - Use: "exceptions ", - Short: "Submit exceptions to the Kubescape SaaS version", - Args: func(cmd *cobra.Command, args []string) error { - if len(args) != 1 { - return fmt.Errorf("missing full path to exceptions file") - } - return nil - }, - Run: func(cmd *cobra.Command, args []string) { - - if err := flagValidationSubmit(submitInfo); err != nil { - logger.L().Fatal(err.Error()) - } - - if err := ks.SubmitExceptions(context.TODO(), &submitInfo.Credentials, args[0]); err != nil { - logger.L().Fatal(err.Error()) - } - }, - } -} diff --git a/cmd/submit/rbac.go b/cmd/submit/rbac.go deleted file mode 100644 index 89c935ee..00000000 --- a/cmd/submit/rbac.go +++ /dev/null @@ -1,98 +0,0 @@ -package submit - -import ( - "context" - "fmt" - - "github.com/google/uuid" - logger "github.com/kubescape/go-logger" - "github.com/kubescape/go-logger/helpers" - "github.com/kubescape/k8s-interface/k8sinterface" - "github.com/kubescape/kubescape/v2/core/cautils" - "github.com/kubescape/kubescape/v2/core/cautils/getter" - "github.com/kubescape/kubescape/v2/core/meta" - "github.com/kubescape/kubescape/v2/core/meta/cliinterfaces" - v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" - reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2" - - "github.com/kubescape/rbac-utils/rbacscanner" - "github.com/spf13/cobra" -) - -var ( - rbacExamples = fmt.Sprintf(` - # Submit cluster's Role-Based Access Control(RBAC) - %[1]s submit rbac - - # Submit cluster's Role-Based Access Control(RBAC) with account ID - %[1]s submit rbac --account - `, cautils.ExecName()) -) - -// getRBACCmd represents the RBAC command -func getRBACCmd(ks meta.IKubescape, submitInfo *v1.Submit) *cobra.Command { - return &cobra.Command{ - Use: "rbac", - Deprecated: "This command is deprecated and will not be supported after 1/Jan/2023. Please use the 'scan' command instead.", - Example: rbacExamples, - Short: "Submit cluster's Role-Based Access Control(RBAC)", - Long: ``, - RunE: func(_ *cobra.Command, args []string) error { - - if err := flagValidationSubmit(submitInfo); err != nil { - return err - } - - k8s := k8sinterface.NewKubernetesApi() - - // get config - clusterConfig := getTenantConfig(&submitInfo.Credentials, "", "", k8s) - if err := clusterConfig.SetTenant(); err != nil { - logger.L().Error("failed setting account ID", helpers.Error(err)) - } - - if clusterConfig.GetAccountID() == "" { - return fmt.Errorf("account ID is not set, run '%[1]s submit rbac --account '", cautils.ExecName()) - } - - // list RBAC - rbacObjects := cautils.NewRBACObjects(rbacscanner.NewRbacScannerFromK8sAPI(k8s, clusterConfig.GetAccountID(), clusterConfig.GetContextName())) - - // submit resources - r := reporterv2.NewReportEventReceiver(clusterConfig.GetConfigObj(), uuid.NewString(), reporterv2.SubmitContextRBAC) - - submitInterfaces := cliinterfaces.SubmitInterfaces{ - ClusterConfig: clusterConfig, - SubmitObjects: rbacObjects, - Reporter: r, - } - - if err := ks.Submit(context.TODO(), submitInterfaces); err != nil { - logger.L().Fatal(err.Error()) - } - return nil - }, - } - -} - -// getKubernetesApi -func getKubernetesApi() *k8sinterface.KubernetesApi { - if !k8sinterface.IsConnectedToCluster() { - return nil - } - return k8sinterface.NewKubernetesApi() -} -func getTenantConfig(credentials *cautils.Credentials, clusterName string, customClusterName string, k8s *k8sinterface.KubernetesApi) cautils.ITenantConfig { - if !k8sinterface.IsConnectedToCluster() || k8s == nil { - return cautils.NewLocalConfig(getter.GetKSCloudAPIConnector(), credentials, clusterName, customClusterName) - } - return cautils.NewClusterConfig(k8s, getter.GetKSCloudAPIConnector(), credentials, clusterName, customClusterName) -} - -// Check if the flag entered are valid -func flagValidationSubmit(submitInfo *v1.Submit) error { - - // Validate the user's credentials - return submitInfo.Credentials.Validate() -} diff --git a/cmd/submit/results.go b/cmd/submit/results.go deleted file mode 100644 index 311e9dfb..00000000 --- a/cmd/submit/results.go +++ /dev/null @@ -1,106 +0,0 @@ -package submit - -import ( - "context" - "encoding/json" - "fmt" - "os" - - "github.com/google/uuid" - "github.com/kubescape/kubescape/v2/core/cautils" - reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" - - logger "github.com/kubescape/go-logger" - "github.com/kubescape/go-logger/helpers" - "github.com/kubescape/k8s-interface/workloadinterface" - "github.com/kubescape/kubescape/v2/core/meta" - "github.com/kubescape/kubescape/v2/core/meta/cliinterfaces" - v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" - reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2" - - "github.com/spf13/cobra" -) - -var formatVersion string - -type ResultsObject struct { - filePath string - customerGUID string - clusterName string -} - -func NewResultsObject(customerGUID, clusterName, filePath string) *ResultsObject { - return &ResultsObject{ - filePath: filePath, - customerGUID: customerGUID, - clusterName: clusterName, - } -} - -func (resultsObject *ResultsObject) SetResourcesReport() (*reporthandlingv2.PostureReport, error) { - // load framework results from json file - report, err := loadResultsFromFile(resultsObject.filePath) - if err != nil { - return nil, err - } - return report, nil -} - -func (resultsObject *ResultsObject) ListAllResources() (map[string]workloadinterface.IMetadata, error) { - return map[string]workloadinterface.IMetadata{}, nil -} - -func getResultsCmd(ks meta.IKubescape, submitInfo *v1.Submit) *cobra.Command { - var resultsCmd = &cobra.Command{ - Use: fmt.Sprintf("results \nExample:\n$ %[1]s submit results path/to/results.json --format-version v2", cautils.ExecName()), - Short: "Submit a pre scanned results file. The file must be in json format", - Long: ``, - RunE: func(cmd *cobra.Command, args []string) error { - - if err := flagValidationSubmit(submitInfo); err != nil { - return err - } - - if len(args) == 0 { - return fmt.Errorf("missing results file") - } - - k8s := getKubernetesApi() - - // get config - clusterConfig := getTenantConfig(&submitInfo.Credentials, "", "", k8s) - if err := clusterConfig.SetTenant(); err != nil { - logger.L().Error("failed setting account ID", helpers.Error(err)) - } - - resultsObjects := NewResultsObject(clusterConfig.GetAccountID(), clusterConfig.GetContextName(), args[0]) - - r := reporterv2.NewReportEventReceiver(clusterConfig.GetConfigObj(), uuid.NewString(), reporterv2.SubmitContextScan) - - submitInterfaces := cliinterfaces.SubmitInterfaces{ - ClusterConfig: clusterConfig, - SubmitObjects: resultsObjects, - Reporter: r, - } - - if err := ks.Submit(context.TODO(), submitInterfaces); err != nil { - logger.L().Fatal(err.Error()) - } - return nil - }, - } - resultsCmd.PersistentFlags().StringVar(&formatVersion, "format-version", "v2", "Output object can be different between versions, this is for maintaining backward and forward compatibility. Supported:'v1'/'v2'") - - return resultsCmd -} -func loadResultsFromFile(filePath string) (*reporthandlingv2.PostureReport, error) { - report := &reporthandlingv2.PostureReport{} - f, err := os.ReadFile(filePath) - if err != nil { - return nil, err - } - if err = json.Unmarshal(f, report); err != nil { - return report, fmt.Errorf("failed to unmarshal results file: %s, make sure you run kubescape with '--format=json --format-version=v2'", err.Error()) - } - return report, nil -} diff --git a/cmd/submit/submit.go b/cmd/submit/submit.go deleted file mode 100644 index 59d048b8..00000000 --- a/cmd/submit/submit.go +++ /dev/null @@ -1,40 +0,0 @@ -package submit - -import ( - "fmt" - - "github.com/kubescape/kubescape/v2/core/cautils" - "github.com/kubescape/kubescape/v2/core/meta" - metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" - "github.com/spf13/cobra" -) - -var submitCmdExamples = fmt.Sprintf(` -# Submit Kubescape scan results file -%[1]s submit results - -# Submit exceptions file to Kubescape SaaS -%[1]s submit exceptions -`, cautils.ExecName()) - -func GetSubmitCmd(ks meta.IKubescape) *cobra.Command { - var submitInfo metav1.Submit - - submitCmd := &cobra.Command{ - Use: "submit ", - Short: "Submit an object to the Kubescape SaaS version", - Long: ``, - Example: submitCmdExamples, - Run: func(cmd *cobra.Command, args []string) { - }, - } - submitCmd.PersistentFlags().StringVarP(&submitInfo.Credentials.Account, "account", "", "", "Kubescape SaaS account ID. Default will load account ID from cache") - submitCmd.PersistentFlags().StringVarP(&submitInfo.Credentials.ClientID, "client-id", "", "", "Kubescape SaaS client ID. Default will load client ID from cache, read more - https://hub.armosec.io/docs/authentication") - submitCmd.PersistentFlags().StringVarP(&submitInfo.Credentials.SecretKey, "secret-key", "", "", "Kubescape SaaS secret key. Default will load secret key from cache, read more - https://hub.armosec.io/docs/authentication") - - submitCmd.AddCommand(getExceptionsCmd(ks, &submitInfo)) - submitCmd.AddCommand(getResultsCmd(ks, &submitInfo)) - submitCmd.AddCommand(getRBACCmd(ks, &submitInfo)) - - return submitCmd -} diff --git a/cmd/update/update.go b/cmd/update/update.go index fe373a0d..48b61737 100644 --- a/cmd/update/update.go +++ b/cmd/update/update.go @@ -8,6 +8,7 @@ import ( "fmt" logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/spf13/cobra" ) @@ -24,16 +25,16 @@ var updateCmdExamples = fmt.Sprintf(` func GetUpdateCmd() *cobra.Command { updateCmd := &cobra.Command{ Use: "update", - Short: "Update your version", + Short: "Update to latest release version", Long: ``, Example: updateCmdExamples, RunE: func(_ *cobra.Command, args []string) error { //Checking the user's version of kubescape to the latest release if cautils.BuildNumber == cautils.LatestReleaseVersion { //your version == latest version - logger.L().Info(("You are in the latest version")) + logger.L().Info(("Nothing to update, you are running the latest version"), helpers.String("Version", cautils.BuildNumber)) } else { - fmt.Printf("please refer to our installation docs in the following link: %s", installationLink) + fmt.Printf("Please refer to our installation docs in the following link: %s", installationLink) } return nil }, diff --git a/cmd/version/version.go b/cmd/version/version.go index 311888e3..dd4259a6 100644 --- a/cmd/version/version.go +++ b/cmd/version/version.go @@ -5,6 +5,7 @@ import ( "fmt" "os" + "github.com/kubescape/go-logger" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/spf13/cobra" ) @@ -19,10 +20,10 @@ func GetVersionCmd() *cobra.Command { v := cautils.NewIVersionCheckHandler(ctx) v.CheckLatestVersion(ctx, cautils.NewVersionCheckRequest(cautils.BuildNumber, "", "", "version")) fmt.Fprintf(os.Stdout, - "Your current version is: %s [git enabled in build: %t]\n", + "Your current version is: %s\n", cautils.BuildNumber, - isGitEnabled(), ) + logger.L().Debug(fmt.Sprintf("git enabled in build: %t", isGitEnabled())) return nil }, } diff --git a/core/cautils/customerloader.go b/core/cautils/customerloader.go index 170d062d..2660bf9b 100644 --- a/core/cautils/customerloader.go +++ b/core/cautils/customerloader.go @@ -3,13 +3,16 @@ package cautils import ( "context" "encoding/json" - "fmt" "os" + "path/filepath" "regexp" - "strings" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "github.com/google/uuid" + v1 "github.com/kubescape/backend/pkg/client/v1" + "github.com/kubescape/backend/pkg/servicediscovery" + servicediscoveryv1 "github.com/kubescape/backend/pkg/servicediscovery/v1" logger "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" "github.com/kubescape/k8s-interface/k8sinterface" @@ -18,9 +21,18 @@ import ( ) const ( - configFileName string = "config" - kubescapeNamespace string = "kubescape" - kubescapeConfigMapName string = "kubescape-config" + configFileName string = "config" + kubescapeNamespace string = "kubescape" + kubescapeConfigMapName string = "kubescape-config" + kubescapeCloudConfigMapName string = "ks-cloud-config" + + // env vars + defaultConfigMapNameEnvVar string = "KS_DEFAULT_CONFIGMAP_NAME" + defaultCloudConfigMapNameEnvVar string = "KS_DEFAULT_CLOUD_CONFIGMAP_NAME" + defaultConfigMapNamespaceEnvVar string = "KS_DEFAULT_CONFIGMAP_NAMESPACE" + accountIdEnvVar string = "KS_ACCOUNT_ID" + cloudApiUrlEnvVar string = "KS_CLOUD_API_URL" + cloudReportUrlEnvVar string = "KS_CLOUD_REPORT_URL" ) func ConfigFileFullPath() string { return getter.GetDefaultPath(configFileName + ".json") } @@ -30,16 +42,10 @@ func ConfigFileFullPath() string { return getter.GetDefaultPath(configFileName + // ====================================================================================== type ConfigObj struct { - AccountID string `json:"accountID,omitempty"` - ClientID string `json:"clientID,omitempty"` - SecretKey string `json:"secretKey,omitempty"` - Token string `json:"invitationParam,omitempty"` - CustomerAdminEMail string `json:"adminMail,omitempty"` - ClusterName string `json:"clusterName,omitempty"` - CloudReportURL string `json:"cloudReportURL,omitempty"` - CloudAPIURL string `json:"cloudAPIURL,omitempty"` - CloudUIURL string `json:"cloudUIURL,omitempty"` - CloudAuthURL string `json:"cloudAuthURL,omitempty"` + AccountID string `json:"accountID,omitempty"` + ClusterName string `json:"clusterName,omitempty"` + CloudReportURL string `json:"cloudReportURL,omitempty"` + CloudAPIURL string `json:"cloudAPIURL,omitempty"` } // Config - convert ConfigObj to config file @@ -47,17 +53,11 @@ func (co *ConfigObj) Config() []byte { // remove cluster name before saving to file clusterName := co.ClusterName - customerAdminEMail := co.CustomerAdminEMail - token := co.Token co.ClusterName = "" - co.Token = "" - co.CustomerAdminEMail = "" b, err := json.MarshalIndent(co, "", " ") co.ClusterName = clusterName - co.CustomerAdminEMail = customerAdminEMail - co.Token = token if err == nil { return b @@ -73,24 +73,12 @@ func (co *ConfigObj) updateEmptyFields(inCO *ConfigObj) error { if inCO.CloudAPIURL != "" { co.CloudAPIURL = inCO.CloudAPIURL } - if inCO.CloudAuthURL != "" { - co.CloudAuthURL = inCO.CloudAuthURL - } if inCO.CloudReportURL != "" { co.CloudReportURL = inCO.CloudReportURL } - if inCO.CloudUIURL != "" { - co.CloudUIURL = inCO.CloudUIURL - } if inCO.ClusterName != "" { co.ClusterName = inCO.ClusterName } - if inCO.CustomerAdminEMail != "" { - co.CustomerAdminEMail = inCO.CustomerAdminEMail - } - if inCO.Token != "" { - co.Token = inCO.Token - } return nil } @@ -99,27 +87,17 @@ func (co *ConfigObj) updateEmptyFields(inCO *ConfigObj) error { // =============================== interface ============================================ // ====================================================================================== type ITenantConfig interface { - // set - SetTenant() error UpdateCachedConfig() error DeleteCachedConfig(ctx context.Context) error + GenerateAccountID() (string, error) + DeleteAccountID() error // getters GetContextName() string GetAccountID() string - GetTenantEmail() string - GetToken() string - GetClientID() string - GetSecretKey() string GetConfigObj() *ConfigObj GetCloudReportURL() string GetCloudAPIURL() string - GetCloudUIURL() string - GetCloudAuthURL() string - // GetBackendAPI() getter.IBackend - // GenerateURL() - - IsConfigFound() bool } // ====================================================================================== @@ -130,23 +108,19 @@ type ITenantConfig interface { var _ ITenantConfig = &LocalConfig{} type LocalConfig struct { - backendAPI getter.IBackend - configObj *ConfigObj + configObj *ConfigObj } -func NewLocalConfig( - backendAPI getter.IBackend, credentials *Credentials, clusterName string, customClusterName string) *LocalConfig { - +func NewLocalConfig(accountID, clusterName string, customClusterName string) *LocalConfig { lc := &LocalConfig{ - backendAPI: backendAPI, - configObj: &ConfigObj{}, + configObj: &ConfigObj{}, } // get from configMap if existsConfigFile() { // get from file loadConfigFromFile(lc.configObj) } - updateCredentials(lc.configObj, credentials) + updateAccountID(lc.configObj, accountID) updateCloudURLs(lc.configObj) // If a custom cluster name is provided then set that name, else use the cluster's original name @@ -156,59 +130,31 @@ func NewLocalConfig( lc.configObj.ClusterName = AdoptClusterName(clusterName) // override config clusterName } - lc.backendAPI.SetAccountID(lc.configObj.AccountID) - lc.backendAPI.SetClientID(lc.configObj.ClientID) - lc.backendAPI.SetSecretKey(lc.configObj.SecretKey) - if lc.configObj.CloudAPIURL != "" { - lc.backendAPI.SetCloudAPIURL(lc.configObj.CloudAPIURL) - } else { - lc.configObj.CloudAPIURL = lc.backendAPI.GetCloudAPIURL() - } - if lc.configObj.CloudAuthURL != "" { - lc.backendAPI.SetCloudAuthURL(lc.configObj.CloudAuthURL) - } else { - lc.configObj.CloudAuthURL = lc.backendAPI.GetCloudAuthURL() - } - if lc.configObj.CloudReportURL != "" { - lc.backendAPI.SetCloudReportURL(lc.configObj.CloudReportURL) - } else { - lc.configObj.CloudReportURL = lc.backendAPI.GetCloudReportURL() - } - if lc.configObj.CloudUIURL != "" { - lc.backendAPI.SetCloudUIURL(lc.configObj.CloudUIURL) - } else { - lc.configObj.CloudUIURL = lc.backendAPI.GetCloudUIURL() - } - logger.L().Debug("Kubescape Cloud URLs", helpers.String("api", lc.backendAPI.GetCloudAPIURL()), helpers.String("auth", lc.backendAPI.GetCloudAuthURL()), helpers.String("report", lc.backendAPI.GetCloudReportURL()), helpers.String("UI", lc.backendAPI.GetCloudUIURL())) - - initializeCloudAPI(lc) + updatedKsCloud := initializeCloudAPI(lc) + logger.L().Debug("Kubescape Cloud URLs", helpers.String("api", updatedKsCloud.GetCloudAPIURL()), helpers.String("report", updatedKsCloud.GetCloudReportURL())) return lc } func (lc *LocalConfig) GetConfigObj() *ConfigObj { return lc.configObj } -func (lc *LocalConfig) GetTenantEmail() string { return lc.configObj.CustomerAdminEMail } func (lc *LocalConfig) GetAccountID() string { return lc.configObj.AccountID } -func (lc *LocalConfig) GetClientID() string { return lc.configObj.ClientID } -func (lc *LocalConfig) GetSecretKey() string { return lc.configObj.SecretKey } func (lc *LocalConfig) GetContextName() string { return lc.configObj.ClusterName } -func (lc *LocalConfig) GetToken() string { return lc.configObj.Token } func (lc *LocalConfig) GetCloudReportURL() string { return lc.configObj.CloudReportURL } func (lc *LocalConfig) GetCloudAPIURL() string { return lc.configObj.CloudAPIURL } -func (lc *LocalConfig) GetCloudUIURL() string { return lc.configObj.CloudUIURL } -func (lc *LocalConfig) GetCloudAuthURL() string { return lc.configObj.CloudAuthURL } -func (lc *LocalConfig) IsConfigFound() bool { return existsConfigFile() } -func (lc *LocalConfig) SetTenant() error { - - // Kubescape Cloud tenant GUID - if err := getTenantConfigFromBE(lc.backendAPI, lc.configObj); err != nil { - return err - } - lc.UpdateCachedConfig() - return nil +func (lc *LocalConfig) GenerateAccountID() (string, error) { + lc.configObj.AccountID = uuid.NewString() + err := lc.UpdateCachedConfig() + return lc.configObj.AccountID, err } + +func (lc *LocalConfig) DeleteAccountID() error { + lc.configObj.AccountID = "" + return lc.UpdateCachedConfig() +} + func (lc *LocalConfig) UpdateCachedConfig() error { + logger.L().Debug("updating cached config", helpers.Interface("configObj", lc.configObj)) return updateConfigFile(lc.configObj) } @@ -219,26 +165,6 @@ func (lc *LocalConfig) DeleteCachedConfig(ctx context.Context) error { return nil } -func getTenantConfigFromBE(backendAPI getter.IBackend, configObj *ConfigObj) error { - - // get from Kubescape Cloud API - tenantResponse, err := backendAPI.GetTenant() - if err == nil && tenantResponse != nil { - if tenantResponse.AdminMail != "" { // registered tenant - configObj.CustomerAdminEMail = tenantResponse.AdminMail - } else { // new tenant - configObj.Token = tenantResponse.Token - configObj.AccountID = tenantResponse.TenantID - } - } else { - if err != nil && !strings.Contains(err.Error(), "already exists") { - return err - } - } - - return nil -} - // ====================================================================================== // ========================== Cluster Config ============================================ // ====================================================================================== @@ -251,8 +177,6 @@ KS_DEFAULT_CONFIGMAP_NAME // name of configmap, if not set default is 'kubescap KS_DEFAULT_CONFIGMAP_NAMESPACE // configmap namespace, if not set default is 'default' KS_ACCOUNT_ID -KS_CLIENT_ID -KS_SECRET_KEY TODO - support: KS_CACHE // path to cached files @@ -260,21 +184,20 @@ KS_CACHE // path to cached files var _ ITenantConfig = &ClusterConfig{} type ClusterConfig struct { - backendAPI getter.IBackend - k8s *k8sinterface.KubernetesApi - configObj *ConfigObj - configMapName string - configMapNamespace string + k8s *k8sinterface.KubernetesApi + configObj *ConfigObj + configMapNamespace string + ksConfigMapName string + ksCloudConfigMapName string } -func NewClusterConfig(k8s *k8sinterface.KubernetesApi, backendAPI getter.IBackend, credentials *Credentials, clusterName string, customClusterName string) *ClusterConfig { - // var configObj *ConfigObj +func NewClusterConfig(k8s *k8sinterface.KubernetesApi, accountID, clusterName string, customClusterName string) *ClusterConfig { c := &ClusterConfig{ - k8s: k8s, - backendAPI: backendAPI, - configObj: &ConfigObj{}, - configMapName: getConfigMapName(), - configMapNamespace: GetConfigMapNamespace(), + k8s: k8s, + configObj: &ConfigObj{}, + ksConfigMapName: getKubescapeConfigMapName(), + ksCloudConfigMapName: getKubescapeCloudConfigMapName(), + configMapNamespace: GetConfigMapNamespace(), } // first, load from file @@ -283,11 +206,16 @@ func NewClusterConfig(k8s *k8sinterface.KubernetesApi, backendAPI getter.IBacken } // second, load from configMap - if c.existsConfigMap() { - c.updateConfigEmptyFieldsFromConfigMap() + if c.existsConfigMap(c.ksConfigMapName) { + c.updateConfigEmptyFieldsFromKubescapeConfigMap() } - updateCredentials(c.configObj, credentials) + // third, load urls from cloudConfigMap + if c.existsConfigMap(c.ksCloudConfigMapName) { + c.updateConfigEmptyFieldsFromKubescapeCloudConfigMap() + } + + updateAccountID(c.configObj, accountID) updateCloudURLs(c.configObj) // If a custom cluster name is provided then set that name, else use the cluster's original name @@ -302,80 +230,23 @@ func NewClusterConfig(k8s *k8sinterface.KubernetesApi, backendAPI getter.IBacken } else { // override the cluster name if it has unwanted characters c.configObj.ClusterName = AdoptClusterName(c.configObj.ClusterName) } - - c.backendAPI.SetAccountID(c.configObj.AccountID) - c.backendAPI.SetClientID(c.configObj.ClientID) - c.backendAPI.SetSecretKey(c.configObj.SecretKey) - if c.configObj.CloudAPIURL != "" { - c.backendAPI.SetCloudAPIURL(c.configObj.CloudAPIURL) - } else { - c.configObj.CloudAPIURL = c.backendAPI.GetCloudAPIURL() - } - if c.configObj.CloudAuthURL != "" { - c.backendAPI.SetCloudAuthURL(c.configObj.CloudAuthURL) - } else { - c.configObj.CloudAuthURL = c.backendAPI.GetCloudAuthURL() - } - if c.configObj.CloudReportURL != "" { - c.backendAPI.SetCloudReportURL(c.configObj.CloudReportURL) - } else { - c.configObj.CloudReportURL = c.backendAPI.GetCloudReportURL() - } - if c.configObj.CloudUIURL != "" { - c.backendAPI.SetCloudUIURL(c.configObj.CloudUIURL) - } else { - c.configObj.CloudUIURL = c.backendAPI.GetCloudUIURL() - } - logger.L().Debug("Kubescape Cloud URLs", helpers.String("api", c.backendAPI.GetCloudAPIURL()), helpers.String("auth", c.backendAPI.GetCloudAuthURL()), helpers.String("report", c.backendAPI.GetCloudReportURL()), helpers.String("UI", c.backendAPI.GetCloudUIURL())) - - initializeCloudAPI(c) - + updatedKsCloud := initializeCloudAPI(c) + logger.L().Debug("Kubescape Cloud URLs", helpers.String("api", updatedKsCloud.GetCloudAPIURL()), helpers.String("report", updatedKsCloud.GetCloudReportURL())) return c } func (c *ClusterConfig) GetConfigObj() *ConfigObj { return c.configObj } func (c *ClusterConfig) GetDefaultNS() string { return c.configMapNamespace } func (c *ClusterConfig) GetAccountID() string { return c.configObj.AccountID } -func (c *ClusterConfig) GetClientID() string { return c.configObj.ClientID } -func (c *ClusterConfig) GetSecretKey() string { return c.configObj.SecretKey } -func (c *ClusterConfig) GetTenantEmail() string { return c.configObj.CustomerAdminEMail } -func (c *ClusterConfig) GetToken() string { return c.configObj.Token } func (c *ClusterConfig) GetCloudReportURL() string { return c.configObj.CloudReportURL } func (c *ClusterConfig) GetCloudAPIURL() string { return c.configObj.CloudAPIURL } -func (c *ClusterConfig) GetCloudUIURL() string { return c.configObj.CloudUIURL } -func (c *ClusterConfig) GetCloudAuthURL() string { return c.configObj.CloudAuthURL } - -func (c *ClusterConfig) IsConfigFound() bool { return existsConfigFile() || c.existsConfigMap() } - -func (c *ClusterConfig) SetTenant() error { - - // ARMO tenant GUID - if err := getTenantConfigFromBE(c.backendAPI, c.configObj); err != nil { - return err - } - c.UpdateCachedConfig() - return nil - -} func (c *ClusterConfig) UpdateCachedConfig() error { - // update/create config - if c.existsConfigMap() { - if err := c.updateConfigMap(); err != nil { - return err - } - } else { - if err := c.createConfigMap(); err != nil { - return err - } - } + logger.L().Debug("updating cached config", helpers.Interface("configObj", c.configObj)) return updateConfigFile(c.configObj) } func (c *ClusterConfig) DeleteCachedConfig(ctx context.Context) error { - if err := c.deleteConfigMap(); err != nil { - logger.L().Ctx(ctx).Warning(err.Error()) - } if err := DeleteConfigFile(); err != nil { logger.L().Ctx(ctx).Warning(err.Error()) } @@ -393,28 +264,44 @@ func (c *ClusterConfig) ToMapString() map[string]interface{} { return m } -func (c *ClusterConfig) updateConfigEmptyFieldsFromConfigMap() error { - configMap, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Get(context.Background(), c.configMapName, metav1.GetOptions{}) +func (c *ClusterConfig) updateConfigEmptyFieldsFromKubescapeConfigMap() error { + configMap, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Get(context.Background(), c.ksConfigMapName, metav1.GetOptions{}) if err != nil { return err } tempCO := ConfigObj{} if jsonConf, ok := configMap.Data["config.json"]; ok { - json.Unmarshal([]byte(jsonConf), &tempCO) + if err = json.Unmarshal([]byte(jsonConf), &tempCO); err != nil { + return err + } return c.configObj.updateEmptyFields(&tempCO) } return err - } -func (c *ClusterConfig) loadConfigFromConfigMap() error { - configMap, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Get(context.Background(), c.configMapName, metav1.GetOptions{}) +func (c *ClusterConfig) updateConfigEmptyFieldsFromKubescapeCloudConfigMap() error { + configMap, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Get(context.Background(), c.ksCloudConfigMapName, metav1.GetOptions{}) if err != nil { return err } - return loadConfigFromData(c.configObj, configMap.Data) + if jsonConf, ok := configMap.Data["services"]; ok { + services, err := servicediscovery.GetServices( + servicediscoveryv1.NewServiceDiscoveryStreamV1([]byte(jsonConf)), + ) + if err != nil { + return err + } + + if services.GetApiServerUrl() != "" { + c.configObj.CloudAPIURL = services.GetApiServerUrl() + } + if services.GetReportReceiverHttpUrl() != "" { + c.configObj.CloudReportURL = services.GetReportReceiverHttpUrl() + } + } + return nil } func loadConfigFromData(co *ConfigObj, data map[string]string) error { @@ -428,107 +315,36 @@ func loadConfigFromData(co *ConfigObj, data map[string]string) error { return e } -func (c *ClusterConfig) existsConfigMap() bool { - _, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Get(context.Background(), c.configMapName, metav1.GetOptions{}) - // TODO - check if has customerGUID + +func (c *ClusterConfig) existsConfigMap(name string) bool { + _, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Get(context.Background(), name, metav1.GetOptions{}) return err == nil } -func (c *ClusterConfig) GetValueByKeyFromConfigMap(key string) (string, error) { - - configMap, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Get(context.Background(), c.configMapName, metav1.GetOptions{}) - - if err != nil { - return "", err - } - if val, ok := configMap.Data[key]; ok { - return val, nil - } else { - return "", fmt.Errorf("value does not exist") - } -} - -func GetValueFromConfigJson(key string) (string, error) { - data, err := os.ReadFile(ConfigFileFullPath()) - if err != nil { - return "", err - } - var obj map[string]interface{} - if err := json.Unmarshal(data, &obj); err != nil { - return "", err - } - if val, ok := obj[key]; ok { - return fmt.Sprint(val), nil - } else { - return "", fmt.Errorf("value does not exist") - } - -} - -func (c *ClusterConfig) SetKeyValueInConfigmap(key string, value string) error { - - configMap, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Get(context.Background(), c.configMapName, metav1.GetOptions{}) - if err != nil { - configMap = &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: c.configMapName, - }, - } - } - - if len(configMap.Data) == 0 { - configMap.Data = make(map[string]string) - } - - configMap.Data[key] = value - - if err != nil { - _, err = c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Create(context.Background(), configMap, metav1.CreateOptions{}) - } else { - _, err = c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Update(context.Background(), configMap, metav1.UpdateOptions{}) - } - - return err -} - func existsConfigFile() bool { _, err := os.ReadFile(ConfigFileFullPath()) return err == nil } -func (c *ClusterConfig) createConfigMap() error { - if c.k8s == nil { - return nil - } - configMap := &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: c.configMapName, - }, - } - c.updateConfigData(configMap) - - _, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Create(context.Background(), configMap, metav1.CreateOptions{}) - return err -} - -func (c *ClusterConfig) updateConfigMap() error { - if c.k8s == nil { - return nil - } - configMap, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Get(context.Background(), c.configMapName, metav1.GetOptions{}) - - if err != nil { +func updateConfigFile(configObj *ConfigObj) error { + fullPath := ConfigFileFullPath() + dir := filepath.Dir(fullPath) + if err := os.MkdirAll(dir, 0755); err != nil { return err } - c.updateConfigData(configMap) - - _, err = c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.configMapNamespace).Update(context.Background(), configMap, metav1.UpdateOptions{}) - return err + return os.WriteFile(fullPath, configObj.Config(), 0664) //nolint:gosec } -func updateConfigFile(configObj *ConfigObj) error { - return os.WriteFile(ConfigFileFullPath(), configObj.Config(), 0664) //nolint:gosec +func (c *ClusterConfig) GenerateAccountID() (string, error) { + c.configObj.AccountID = uuid.NewString() + err := c.UpdateCachedConfig() + return c.configObj.AccountID, err +} + +func (c *ClusterConfig) DeleteAccountID() error { + c.configObj.AccountID = "" + return c.UpdateCachedConfig() } func (c *ClusterConfig) updateConfigData(configMap *corev1.ConfigMap) { @@ -561,28 +377,6 @@ func readConfig(dat []byte, configObj *ConfigObj) error { return nil } -// Check if the customer is submitted -func (clusterConfig *ClusterConfig) IsSubmitted() bool { - return clusterConfig.existsConfigMap() || existsConfigFile() -} - -// Check if the customer is registered -func (clusterConfig *ClusterConfig) IsRegistered() bool { - - // get from armoBE - tenantResponse, err := clusterConfig.backendAPI.GetTenant() - if err == nil && tenantResponse != nil { - if tenantResponse.AdminMail != "" { // this customer already belongs to some user - return true - } - } - return false -} - -func (clusterConfig *ClusterConfig) deleteConfigMap() error { - return clusterConfig.k8s.KubernetesClient.CoreV1().ConfigMaps(clusterConfig.configMapNamespace).Delete(context.Background(), clusterConfig.configMapName, metav1.DeleteOptions{}) -} - func DeleteConfigFile() error { return os.Remove(ConfigFileFullPath()) } @@ -595,67 +389,49 @@ func AdoptClusterName(clusterName string) string { return re.ReplaceAllString(clusterName, "-") } -func getConfigMapName() string { - if n := os.Getenv("KS_DEFAULT_CONFIGMAP_NAME"); n != "" { +func getKubescapeConfigMapName() string { + if n := os.Getenv(defaultConfigMapNameEnvVar); n != "" { return n } return kubescapeConfigMapName } +func getKubescapeCloudConfigMapName() string { + if n := os.Getenv(defaultCloudConfigMapNameEnvVar); n != "" { + return n + } + + return kubescapeCloudConfigMapName +} + // GetConfigMapNamespace returns the namespace of the cluster config, which is the same for all in-cluster components func GetConfigMapNamespace() string { - if n := os.Getenv("KS_DEFAULT_CONFIGMAP_NAMESPACE"); n != "" { + if n := os.Getenv(defaultConfigMapNamespaceEnvVar); n != "" { return n } return kubescapeNamespace } -func getAccountFromEnv(credentials *Credentials) { - // load from env - if accountID := os.Getenv("KS_ACCOUNT_ID"); credentials.Account == "" && accountID != "" { - credentials.Account = accountID - } - if clientID := os.Getenv("KS_CLIENT_ID"); credentials.ClientID == "" && clientID != "" { - credentials.ClientID = clientID - } - if secretKey := os.Getenv("KS_SECRET_KEY"); credentials.SecretKey == "" && secretKey != "" { - credentials.SecretKey = secretKey - } -} - -func updateCredentials(configObj *ConfigObj, credentials *Credentials) { - - if credentials == nil { - credentials = &Credentials{} - } - getAccountFromEnv(credentials) - - if credentials.Account != "" { - configObj.AccountID = credentials.Account // override config Account - } - if credentials.ClientID != "" { - configObj.ClientID = credentials.ClientID // override config ClientID - } - if credentials.SecretKey != "" { - configObj.SecretKey = credentials.SecretKey // override config SecretKey +func updateAccountID(configObj *ConfigObj, accountID string) { + if accountID != "" { + configObj.AccountID = accountID } + if envAccountID := os.Getenv(accountIdEnvVar); envAccountID != "" { + configObj.AccountID = envAccountID + } } func getCloudURLsFromEnv(cloudURLs *CloudURLs) { // load from env - if cloudAPIURL := os.Getenv("KS_CLOUD_API_URL"); cloudAPIURL != "" { + if cloudAPIURL := os.Getenv(cloudApiUrlEnvVar); cloudAPIURL != "" { + logger.L().Debug("cloud API URL updated from env var", helpers.Interface(cloudApiUrlEnvVar, cloudAPIURL)) cloudURLs.CloudAPIURL = cloudAPIURL } - if cloudAuthURL := os.Getenv("KS_CLOUD_AUTH_URL"); cloudAuthURL != "" { - cloudURLs.CloudAuthURL = cloudAuthURL - } - if cloudReportURL := os.Getenv("KS_CLOUD_REPORT_URL"); cloudReportURL != "" { + if cloudReportURL := os.Getenv(cloudReportUrlEnvVar); cloudReportURL != "" { + logger.L().Debug("cloud Report URL updated from env var", helpers.Interface(cloudReportUrlEnvVar, cloudReportURL)) cloudURLs.CloudReportURL = cloudReportURL } - if cloudUIURL := os.Getenv("KS_CLOUD_UI_URL"); cloudUIURL != "" { - cloudURLs.CloudUIURL = cloudUIURL - } } func updateCloudURLs(configObj *ConfigObj) { @@ -666,26 +442,25 @@ func updateCloudURLs(configObj *ConfigObj) { if cloudURLs.CloudAPIURL != "" { configObj.CloudAPIURL = cloudURLs.CloudAPIURL // override config CloudAPIURL } - if cloudURLs.CloudAuthURL != "" { - configObj.CloudAuthURL = cloudURLs.CloudAuthURL // override config CloudAuthURL - } if cloudURLs.CloudReportURL != "" { configObj.CloudReportURL = cloudURLs.CloudReportURL // override config CloudReportURL } - if cloudURLs.CloudUIURL != "" { - configObj.CloudUIURL = cloudURLs.CloudUIURL // override config CloudUIURL + +} + +func initializeCloudAPI(c ITenantConfig) *v1.KSCloudAPI { + logger.L().Debug("initializing KS Cloud API from config", helpers.String("accountID", c.GetAccountID()), helpers.String("cloudAPIURL", c.GetCloudAPIURL()), helpers.String("cloudReportURL", c.GetCloudReportURL())) + cloud, err := v1.NewKSCloudAPI(c.GetCloudAPIURL(), c.GetCloudReportURL(), c.GetAccountID()) + if err != nil { + logger.L().Fatal("failed to create KS Cloud client", helpers.Error(err)) } - -} - -func initializeCloudAPI(c ITenantConfig) { - cloud := getter.GetKSCloudAPIConnector() - cloud.SetAccountID(c.GetAccountID()) - cloud.SetClientID(c.GetClientID()) - cloud.SetSecretKey(c.GetSecretKey()) - cloud.SetCloudAuthURL(c.GetCloudAuthURL()) - cloud.SetCloudReportURL(c.GetCloudReportURL()) - cloud.SetCloudUIURL(c.GetCloudUIURL()) - cloud.SetCloudAPIURL(c.GetCloudAPIURL()) getter.SetKSCloudAPIConnector(cloud) + return getter.GetKSCloudAPIConnector() +} + +func GetTenantConfig(accountID, clusterName, customClusterName string, k8s *k8sinterface.KubernetesApi) ITenantConfig { + if !k8sinterface.IsConnectedToCluster() || k8s == nil { + return NewLocalConfig(accountID, clusterName, customClusterName) + } + return NewClusterConfig(k8s, accountID, clusterName, customClusterName) } diff --git a/core/cautils/customerloader_test.go b/core/cautils/customerloader_test.go index df2c5a2b..30952acf 100644 --- a/core/cautils/customerloader_test.go +++ b/core/cautils/customerloader_test.go @@ -12,29 +12,21 @@ import ( func mockConfigObj() *ConfigObj { return &ConfigObj{ - AccountID: "aaa", - ClientID: "bbb", - SecretKey: "ccc", - ClusterName: "ddd", - CustomerAdminEMail: "ab@cd", - Token: "eee", - CloudReportURL: "report.armo.cloud", - CloudAPIURL: "api.armosec.io", - CloudUIURL: "cloud.armosec.io", - CloudAuthURL: "auth.armosec.io", + AccountID: "aaa", + ClusterName: "ddd", + CloudReportURL: "report.domain.com", + CloudAPIURL: "api.domain.com", } } func mockLocalConfig() *LocalConfig { return &LocalConfig{ - backendAPI: nil, - configObj: mockConfigObj(), + configObj: mockConfigObj(), } } func mockClusterConfig() *ClusterConfig { return &ClusterConfig{ - backendAPI: nil, - configObj: mockConfigObj(), + configObj: mockConfigObj(), } } func TestConfig(t *testing.T) { @@ -43,15 +35,9 @@ func TestConfig(t *testing.T) { assert.NoError(t, json.Unmarshal(co.Config(), &cop)) assert.Equal(t, co.AccountID, cop.AccountID) - assert.Equal(t, co.ClientID, cop.ClientID) - assert.Equal(t, co.SecretKey, cop.SecretKey) assert.Equal(t, co.CloudReportURL, cop.CloudReportURL) assert.Equal(t, co.CloudAPIURL, cop.CloudAPIURL) - assert.Equal(t, co.CloudUIURL, cop.CloudUIURL) - assert.Equal(t, co.CloudAuthURL, cop.CloudAuthURL) - assert.Equal(t, "", cop.ClusterName) // Not copied to bytes - assert.Equal(t, "", cop.CustomerAdminEMail) // Not copied to bytes - assert.Equal(t, "", cop.Token) // Not copied to bytes + assert.Equal(t, "", cop.ClusterName) // Not copied to bytes } @@ -65,27 +51,15 @@ func TestITenantConfig(t *testing.T) { // test LocalConfig methods assert.Equal(t, co.AccountID, lc.GetAccountID()) - assert.Equal(t, co.ClientID, lc.GetClientID()) - assert.Equal(t, co.SecretKey, lc.GetSecretKey()) assert.Equal(t, co.ClusterName, lc.GetContextName()) - assert.Equal(t, co.CustomerAdminEMail, lc.GetTenantEmail()) - assert.Equal(t, co.Token, lc.GetToken()) assert.Equal(t, co.CloudReportURL, lc.GetCloudReportURL()) assert.Equal(t, co.CloudAPIURL, lc.GetCloudAPIURL()) - assert.Equal(t, co.CloudUIURL, lc.GetCloudUIURL()) - assert.Equal(t, co.CloudAuthURL, lc.GetCloudAuthURL()) // test ClusterConfig methods assert.Equal(t, co.AccountID, c.GetAccountID()) - assert.Equal(t, co.ClientID, c.GetClientID()) - assert.Equal(t, co.SecretKey, c.GetSecretKey()) assert.Equal(t, co.ClusterName, c.GetContextName()) - assert.Equal(t, co.CustomerAdminEMail, c.GetTenantEmail()) - assert.Equal(t, co.Token, c.GetToken()) assert.Equal(t, co.CloudReportURL, c.GetCloudReportURL()) assert.Equal(t, co.CloudAPIURL, c.GetCloudAPIURL()) - assert.Equal(t, co.CloudUIURL, c.GetCloudUIURL()) - assert.Equal(t, co.CloudAuthURL, c.GetCloudAuthURL()) } func TestUpdateConfigData(t *testing.T) { @@ -96,12 +70,8 @@ func TestUpdateConfigData(t *testing.T) { c.updateConfigData(configMap) assert.Equal(t, c.GetAccountID(), configMap.Data["accountID"]) - assert.Equal(t, c.GetClientID(), configMap.Data["clientID"]) - assert.Equal(t, c.GetSecretKey(), configMap.Data["secretKey"]) assert.Equal(t, c.GetCloudReportURL(), configMap.Data["cloudReportURL"]) assert.Equal(t, c.GetCloudAPIURL(), configMap.Data["cloudAPIURL"]) - assert.Equal(t, c.GetCloudUIURL(), configMap.Data["cloudUIURL"]) - assert.Equal(t, c.GetCloudAuthURL(), configMap.Data["cloudAuthURL"]) } func TestReadConfig(t *testing.T) { @@ -114,15 +84,9 @@ func TestReadConfig(t *testing.T) { readConfig(b, co) assert.Equal(t, com.AccountID, co.AccountID) - assert.Equal(t, com.ClientID, co.ClientID) - assert.Equal(t, com.SecretKey, co.SecretKey) assert.Equal(t, com.ClusterName, co.ClusterName) - assert.Equal(t, com.CustomerAdminEMail, co.CustomerAdminEMail) - assert.Equal(t, com.Token, co.Token) assert.Equal(t, com.CloudReportURL, co.CloudReportURL) assert.Equal(t, com.CloudAPIURL, co.CloudAPIURL) - assert.Equal(t, com.CloudUIURL, co.CloudUIURL) - assert.Equal(t, com.CloudAuthURL, co.CloudAuthURL) } func TestLoadConfigFromData(t *testing.T) { @@ -141,15 +105,9 @@ func TestLoadConfigFromData(t *testing.T) { loadConfigFromData(c.configObj, configMap.Data) assert.Equal(t, c.GetAccountID(), co.AccountID) - assert.Equal(t, c.GetClientID(), co.ClientID) - assert.Equal(t, c.GetSecretKey(), co.SecretKey) assert.Equal(t, c.GetContextName(), co.ClusterName) - assert.Equal(t, c.GetTenantEmail(), co.CustomerAdminEMail) - assert.Equal(t, c.GetToken(), co.Token) assert.Equal(t, c.GetCloudReportURL(), co.CloudReportURL) assert.Equal(t, c.GetCloudAPIURL(), co.CloudAPIURL) - assert.Equal(t, c.GetCloudUIURL(), co.CloudUIURL) - assert.Equal(t, c.GetCloudAuthURL(), co.CloudAuthURL) } // use case: all data is in config.json @@ -167,12 +125,8 @@ func TestLoadConfigFromData(t *testing.T) { loadConfigFromData(c.configObj, configMap.Data) assert.Equal(t, c.GetAccountID(), co.AccountID) - assert.Equal(t, c.GetClientID(), co.ClientID) - assert.Equal(t, c.GetSecretKey(), co.SecretKey) assert.Equal(t, c.GetCloudReportURL(), co.CloudReportURL) assert.Equal(t, c.GetCloudAPIURL(), co.CloudAPIURL) - assert.Equal(t, c.GetCloudUIURL(), co.CloudUIURL) - assert.Equal(t, c.GetCloudAuthURL(), co.CloudAuthURL) } // use case: some data is in config.json @@ -183,21 +137,15 @@ func TestLoadConfigFromData(t *testing.T) { } // add to map - configMap.Data["clientID"] = c.configObj.ClientID - configMap.Data["secretKey"] = c.configObj.SecretKey configMap.Data["cloudReportURL"] = c.configObj.CloudReportURL // delete the content - c.configObj.ClientID = "" - c.configObj.SecretKey = "" c.configObj.CloudReportURL = "" configMap.Data["config.json"] = string(c.GetConfigObj().Config()) loadConfigFromData(c.configObj, configMap.Data) assert.NotEmpty(t, c.GetAccountID()) - assert.NotEmpty(t, c.GetClientID()) - assert.NotEmpty(t, c.GetSecretKey()) assert.NotEmpty(t, c.GetCloudReportURL()) } @@ -212,19 +160,11 @@ func TestLoadConfigFromData(t *testing.T) { // add to map configMap.Data["accountID"] = mockConfigObj().AccountID - configMap.Data["clientID"] = c.configObj.ClientID - configMap.Data["secretKey"] = c.configObj.SecretKey - - // delete the content - c.configObj.ClientID = "" - c.configObj.SecretKey = "" configMap.Data["config.json"] = string(c.GetConfigObj().Config()) loadConfigFromData(c.configObj, configMap.Data) assert.Equal(t, mockConfigObj().AccountID, c.GetAccountID()) - assert.NotEmpty(t, c.GetClientID()) - assert.NotEmpty(t, c.GetSecretKey()) } } @@ -289,13 +229,9 @@ func Test_initializeCloudAPI(t *testing.T) { t.Run(tt.name, func(t *testing.T) { initializeCloudAPI(tt.args.c) cloud := getter.GetKSCloudAPIConnector() - assert.Equal(t, tt.args.c.GetCloudAPIURL(), cloud.GetCloudAPIURL()) - assert.Equal(t, tt.args.c.GetCloudAuthURL(), cloud.GetCloudAuthURL()) - assert.Equal(t, tt.args.c.GetCloudUIURL(), cloud.GetCloudUIURL()) - assert.Equal(t, tt.args.c.GetCloudReportURL(), cloud.GetCloudReportURL()) + assert.Equal(t, "https://api.domain.com", cloud.GetCloudAPIURL()) + assert.Equal(t, "https://report.domain.com", cloud.GetCloudReportURL()) assert.Equal(t, tt.args.c.GetAccountID(), cloud.GetAccountID()) - assert.Equal(t, tt.args.c.GetClientID(), cloud.GetClientID()) - assert.Equal(t, tt.args.c.GetSecretKey(), cloud.GetSecretKey()) }) } } @@ -354,90 +290,58 @@ func TestUpdateEmptyFields(t *testing.T) { }{ { outCo: &ConfigObj{ - AccountID: "", - Token: "", - CustomerAdminEMail: "", - ClusterName: "", - CloudReportURL: "", - CloudAPIURL: "", - CloudUIURL: "", - CloudAuthURL: "", + AccountID: "", + ClusterName: "", + CloudReportURL: "", + CloudAPIURL: "", }, inCo: &ConfigObj{ - AccountID: shouldUpdate, - Token: shouldUpdate, - CustomerAdminEMail: shouldUpdate, - ClusterName: shouldUpdate, - CloudReportURL: shouldUpdate, - CloudAPIURL: shouldUpdate, - CloudUIURL: shouldUpdate, - CloudAuthURL: shouldUpdate, + AccountID: shouldUpdate, + ClusterName: shouldUpdate, + CloudReportURL: shouldUpdate, + CloudAPIURL: shouldUpdate, }, }, { outCo: &ConfigObj{ - AccountID: anyString, - Token: anyString, - CustomerAdminEMail: "", - ClusterName: "", - CloudReportURL: "", - CloudAPIURL: "", - CloudUIURL: "", - CloudAuthURL: "", + AccountID: anyString, + ClusterName: "", + CloudReportURL: "", + CloudAPIURL: "", }, inCo: &ConfigObj{ - AccountID: shouldNotUpdate, - Token: shouldNotUpdate, - CustomerAdminEMail: shouldUpdate, - ClusterName: shouldUpdate, - CloudReportURL: shouldUpdate, - CloudAPIURL: shouldUpdate, - CloudUIURL: shouldUpdate, - CloudAuthURL: shouldUpdate, + AccountID: shouldNotUpdate, + ClusterName: shouldUpdate, + CloudReportURL: shouldUpdate, + CloudAPIURL: shouldUpdate, }, }, { outCo: &ConfigObj{ - AccountID: "", - Token: "", - CustomerAdminEMail: anyString, - ClusterName: anyString, - CloudReportURL: anyString, - CloudAPIURL: anyString, - CloudUIURL: anyString, - CloudAuthURL: anyString, + AccountID: "", + ClusterName: anyString, + CloudReportURL: anyString, + CloudAPIURL: anyString, }, inCo: &ConfigObj{ - AccountID: shouldUpdate, - Token: shouldUpdate, - CustomerAdminEMail: shouldNotUpdate, - ClusterName: shouldNotUpdate, - CloudReportURL: shouldNotUpdate, - CloudAPIURL: shouldNotUpdate, - CloudUIURL: shouldNotUpdate, - CloudAuthURL: shouldNotUpdate, + AccountID: shouldUpdate, + ClusterName: shouldNotUpdate, + CloudReportURL: shouldNotUpdate, + CloudAPIURL: shouldNotUpdate, }, }, { outCo: &ConfigObj{ - AccountID: anyString, - Token: anyString, - CustomerAdminEMail: "", - ClusterName: anyString, - CloudReportURL: "", - CloudAPIURL: anyString, - CloudUIURL: "", - CloudAuthURL: anyString, + AccountID: anyString, + ClusterName: anyString, + CloudReportURL: "", + CloudAPIURL: anyString, }, inCo: &ConfigObj{ - AccountID: shouldNotUpdate, - Token: shouldNotUpdate, - CustomerAdminEMail: shouldUpdate, - ClusterName: shouldNotUpdate, - CloudReportURL: shouldUpdate, - CloudAPIURL: shouldNotUpdate, - CloudUIURL: shouldUpdate, - CloudAuthURL: shouldNotUpdate, + AccountID: shouldNotUpdate, + ClusterName: shouldNotUpdate, + CloudReportURL: shouldUpdate, + CloudAPIURL: shouldNotUpdate, }, }, } @@ -447,11 +351,7 @@ func TestUpdateEmptyFields(t *testing.T) { tests[i].outCo.updateEmptyFields(tests[i].inCo) checkIsUpdateCorrectly(t, beforeChangesOutCO.AccountID, tests[i].outCo.AccountID) checkIsUpdateCorrectly(t, beforeChangesOutCO.CloudAPIURL, tests[i].outCo.CloudAPIURL) - checkIsUpdateCorrectly(t, beforeChangesOutCO.CloudAuthURL, tests[i].outCo.CloudAuthURL) checkIsUpdateCorrectly(t, beforeChangesOutCO.CloudReportURL, tests[i].outCo.CloudReportURL) - checkIsUpdateCorrectly(t, beforeChangesOutCO.CloudUIURL, tests[i].outCo.CloudUIURL) checkIsUpdateCorrectly(t, beforeChangesOutCO.ClusterName, tests[i].outCo.ClusterName) - checkIsUpdateCorrectly(t, beforeChangesOutCO.CustomerAdminEMail, tests[i].outCo.CustomerAdminEMail) - checkIsUpdateCorrectly(t, beforeChangesOutCO.Token, tests[i].outCo.Token) } } diff --git a/core/cautils/datastructures.go b/core/cautils/datastructures.go index cd2f6030..9fc00a62 100644 --- a/core/cautils/datastructures.go +++ b/core/cautils/datastructures.go @@ -33,6 +33,7 @@ const ( ScanTypeImage ScanTypes = "image" ScanTypeWorkload ScanTypes = "workload" ScanTypeFramework ScanTypes = "framework" + ScanTypeControl ScanTypes = "control" ) type OPASessionObj struct { @@ -56,6 +57,7 @@ type OPASessionObj struct { Exceptions []armotypes.PostureExceptionPolicy // list of exceptions to apply on scan results OmitRawResources bool // omit raw resources from output SingleResourceScan workloadinterface.IWorkload // single resource scan + TopWorkloadsByScore []reporthandling.IResource } func NewOPASessionObj(ctx context.Context, frameworks []reporthandling.Framework, k8sResources K8SResources, scanInfo *ScanInfo) *OPASessionObj { @@ -109,7 +111,7 @@ func (sessionObj *OPASessionObj) SetTopWorkloads() { Source: &source, } - sessionObj.Report.SummaryDetails.TopWorkloadsByScore = append(sessionObj.Report.SummaryDetails.TopWorkloadsByScore, wlObj) + sessionObj.TopWorkloadsByScore = append(sessionObj.TopWorkloadsByScore, wlObj) count++ } } diff --git a/core/cautils/datastructuresmethods.go b/core/cautils/datastructuresmethods.go index 61dda263..82b563e0 100644 --- a/core/cautils/datastructuresmethods.go +++ b/core/cautils/datastructuresmethods.go @@ -5,7 +5,6 @@ import ( "github.com/armosec/utils-go/boolutils" cloudsupport "github.com/kubescape/k8s-interface/cloudsupport/v1" - "github.com/kubescape/k8s-interface/k8sinterface" "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/apis" ) @@ -89,58 +88,50 @@ func isRuleKubescapeVersionCompatible(attributes map[string]interface{}, version return true } -func getCloudType(scanInfo *ScanInfo) (bool, reporthandling.ScanningScopeType) { +func getCloudProvider(scanInfo *ScanInfo) reporthandling.ScanningScopeType { if cloudsupport.IsAKS() { - return true, reporthandling.ScopeCloudAKS + return reporthandling.ScopeCloudAKS } - if cloudsupport.IsEKS(k8sinterface.GetConfig()) { - return true, reporthandling.ScopeCloudEKS + if cloudsupport.IsEKS() { + return reporthandling.ScopeCloudEKS } - if cloudsupport.IsGKE(k8sinterface.GetConfig()) { - return true, reporthandling.ScopeCloudGKE + if cloudsupport.IsGKE() { + return reporthandling.ScopeCloudGKE } - return false, "" + return "" } func GetScanningScope(scanInfo *ScanInfo) reporthandling.ScanningScopeType { - var result reporthandling.ScanningScopeType switch scanInfo.GetScanningContext() { case ContextCluster: - isCloud, cloudType := getCloudType(scanInfo) - if isCloud { - result = cloudType - } else { - result = reporthandling.ScopeCluster + if cloudProvider := getCloudProvider(scanInfo); cloudProvider != "" { + return cloudProvider } + return reporthandling.ScopeCluster default: - result = reporthandling.ScopeFile + return reporthandling.ScopeFile } - - return result } func isScanningScopeMatchToControlScope(scanScope reporthandling.ScanningScopeType, controlScope reporthandling.ScanningScopeType) bool { - result := false switch controlScope { case reporthandling.ScopeFile: - result = (reporthandling.ScopeFile == scanScope) + return reporthandling.ScopeFile == scanScope case reporthandling.ScopeCluster: - result = (reporthandling.ScopeCluster == scanScope) || (reporthandling.ScopeCloud == scanScope) || (reporthandling.ScopeCloudAKS == scanScope) || (reporthandling.ScopeCloudEKS == scanScope) || (reporthandling.ScopeCloudGKE == scanScope) + return reporthandling.ScopeCluster == scanScope || reporthandling.ScopeCloud == scanScope || reporthandling.ScopeCloudAKS == scanScope || reporthandling.ScopeCloudEKS == scanScope || reporthandling.ScopeCloudGKE == scanScope case reporthandling.ScopeCloud: - result = (reporthandling.ScopeCloud == scanScope) || (reporthandling.ScopeCloudAKS == scanScope) || (reporthandling.ScopeCloudEKS == scanScope) || (reporthandling.ScopeCloudGKE == scanScope) + return reporthandling.ScopeCloud == scanScope || reporthandling.ScopeCloudAKS == scanScope || reporthandling.ScopeCloudEKS == scanScope || reporthandling.ScopeCloudGKE == scanScope case reporthandling.ScopeCloudAKS: - result = (reporthandling.ScopeCloudAKS == scanScope) + return reporthandling.ScopeCloudAKS == scanScope case reporthandling.ScopeCloudEKS: - result = (reporthandling.ScopeCloudEKS == scanScope) + return reporthandling.ScopeCloudEKS == scanScope case reporthandling.ScopeCloudGKE: - result = (reporthandling.ScopeCloudGKE == scanScope) + return reporthandling.ScopeCloudGKE == scanScope default: - result = true + return true } - - return result } func isControlFitToScanScope(control reporthandling.Control, scanScopeMatches reporthandling.ScanningScopeType) bool { diff --git a/core/cautils/datastructuresmethods_test.go b/core/cautils/datastructuresmethods_test.go index a19107d8..11126bc5 100644 --- a/core/cautils/datastructuresmethods_test.go +++ b/core/cautils/datastructuresmethods_test.go @@ -4,8 +4,8 @@ import ( "fmt" "testing" + "github.com/armosec/armoapi-go/armotypes" "github.com/kubescape/opa-utils/reporthandling" - "github.com/stretchr/testify/assert" ) @@ -79,7 +79,6 @@ func TestIsControlFitToScanScope(t *testing.T) { scanInfo: &ScanInfo{}, Control: reporthandling.Control{ ScanningScope: &reporthandling.ScanningScope{ - Matches: []reporthandling.ScanningScopeType{ reporthandling.ScopeCloudEKS, }, @@ -99,6 +98,237 @@ func TestIsControlFitToScanScope(t *testing.T) { expected_res: false, }} for i := range tests { - assert.Equal(t, isControlFitToScanScope(tests[i].Control, GetScanningScope(tests[i].scanInfo)), tests[i].expected_res, fmt.Sprintf("tests_true index %d", i)) + assert.Equal(t, tests[i].expected_res, isControlFitToScanScope(tests[i].Control, GetScanningScope(tests[i].scanInfo)), fmt.Sprintf("tests_true index %d", i)) + } +} + +func TestIsScanningScopeMatchToControlScope(t *testing.T) { + tests := []struct { + scanScope reporthandling.ScanningScopeType + controlScope reporthandling.ScanningScopeType + expected bool + }{ + { + scanScope: reporthandling.ScopeFile, + controlScope: reporthandling.ScopeFile, + expected: true, + }, + { + scanScope: ScopeCluster, + controlScope: ScopeCluster, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloud, + controlScope: reporthandling.ScopeCloud, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloudAKS, + controlScope: reporthandling.ScopeCloudAKS, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloudEKS, + controlScope: reporthandling.ScopeCloudEKS, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloudGKE, + controlScope: reporthandling.ScopeCloudGKE, + expected: true, + }, + { + scanScope: ScopeCluster, + controlScope: reporthandling.ScopeCloud, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloud, + controlScope: ScopeCluster, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloudAKS, + controlScope: ScopeCluster, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloudEKS, + controlScope: ScopeCluster, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloudGKE, + controlScope: ScopeCluster, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloud, + controlScope: reporthandling.ScopeCloudAKS, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloudAKS, + controlScope: reporthandling.ScopeCloud, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloudEKS, + controlScope: reporthandling.ScopeCloud, + expected: true, + }, + { + scanScope: reporthandling.ScopeCloudGKE, + controlScope: reporthandling.ScopeCloud, + expected: true, + }, + { + scanScope: ScopeCluster, + controlScope: reporthandling.ScopeCloudAKS, + expected: false, + }, + { + scanScope: ScopeCluster, + controlScope: reporthandling.ScopeCloudEKS, + expected: false, + }, + { + scanScope: ScopeCluster, + controlScope: reporthandling.ScopeCloudGKE, + expected: false, + }, + { + scanScope: reporthandling.ScopeFile, + controlScope: ScopeCluster, + expected: false, + }, + { + scanScope: reporthandling.ScopeFile, + controlScope: reporthandling.ScopeCloud, + expected: false, + }, + { + scanScope: reporthandling.ScopeFile, + controlScope: reporthandling.ScopeCloudAKS, + expected: false, + }, + { + scanScope: reporthandling.ScopeFile, + controlScope: reporthandling.ScopeCloudEKS, + expected: false, + }, + { + scanScope: reporthandling.ScopeFile, + controlScope: reporthandling.ScopeCloudGKE, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloud, + controlScope: reporthandling.ScopeCloudEKS, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloud, + controlScope: reporthandling.ScopeCloudGKE, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloudAKS, + controlScope: reporthandling.ScopeCloudEKS, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloudAKS, + controlScope: reporthandling.ScopeCloudGKE, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloudEKS, + controlScope: reporthandling.ScopeCloudAKS, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloudEKS, + controlScope: reporthandling.ScopeCloudGKE, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloudGKE, + controlScope: reporthandling.ScopeCloudAKS, + expected: false, + }, + { + scanScope: reporthandling.ScopeCloudGKE, + controlScope: reporthandling.ScopeCloudEKS, + expected: false, + }, + } + + for _, test := range tests { + result := isScanningScopeMatchToControlScope(test.scanScope, test.controlScope) + assert.Equal(t, test.expected, result, fmt.Sprintf("scanScope: %v, controlScope: %v", test.scanScope, test.controlScope)) + } +} + +func TestIsFrameworkFitToScanScope(t *testing.T) { + tests := []struct { + name string + framework reporthandling.Framework + scanScopeMatch reporthandling.ScanningScopeType + want bool + }{ + { + name: "Framework with nil ScanningScope should return true", + framework: reporthandling.Framework{ + PortalBase: armotypes.PortalBase{ + Name: "test-framework", + }, + }, + scanScopeMatch: reporthandling.ScopeFile, + want: true, + }, + { + name: "Framework with empty ScanningScope.Matches should return true", + framework: reporthandling.Framework{ + PortalBase: armotypes.PortalBase{ + Name: "test-framework", + }, ScanningScope: &reporthandling.ScanningScope{}, + }, + scanScopeMatch: reporthandling.ScopeFile, + want: true, + }, + { + name: "Framework with matching ScanningScope.Matches should return true", + framework: reporthandling.Framework{ + PortalBase: armotypes.PortalBase{ + Name: "test-framework", + }, ScanningScope: &reporthandling.ScanningScope{ + Matches: []reporthandling.ScanningScopeType{reporthandling.ScopeFile}, + }, + }, + scanScopeMatch: reporthandling.ScopeFile, + want: true, + }, + { + name: "Framework with non-matching ScanningScope.Matches should return false", + framework: reporthandling.Framework{ + PortalBase: armotypes.PortalBase{ + Name: "test-framework", + }, ScanningScope: &reporthandling.ScanningScope{ + Matches: []reporthandling.ScanningScopeType{reporthandling.ScopeCluster}, + }, + }, + scanScopeMatch: reporthandling.ScopeFile, + want: false, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if got := isFrameworkFitToScanScope(tt.framework, tt.scanScopeMatch); got != tt.want { + t.Errorf("isFrameworkFitToScanScope() = %v, want %v", got, tt.want) + } + }) } } diff --git a/core/cautils/environments.go b/core/cautils/environments.go deleted file mode 100644 index 29c74652..00000000 --- a/core/cautils/environments.go +++ /dev/null @@ -1,7 +0,0 @@ -package cautils - -// Kubescape Cloud environment vars -var ( - CustomerGUID = "" - ClusterName = "" -) diff --git a/core/cautils/getter/datastructures.go b/core/cautils/getter/datastructures.go index 2ebf5d1c..cc7b8293 100644 --- a/core/cautils/getter/datastructures.go +++ b/core/cautils/getter/datastructures.go @@ -1,61 +1,4 @@ package getter -import ( - "github.com/armosec/armoapi-go/armotypes" - "github.com/kubescape/opa-utils/reporthandling" - "github.com/kubescape/opa-utils/reporthandling/attacktrack/v1alpha1" - reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" -) - // NativeFrameworks identifies all pre-built, native frameworks. var NativeFrameworks = []string{"allcontrols", "nsa", "mitre"} - -type ( - // TenantResponse holds the credentials for a tenant. - TenantResponse struct { - TenantID string `json:"tenantId"` - Token string `json:"token"` - Expires string `json:"expires"` - AdminMail string `json:"adminMail,omitempty"` - } - - // AttackTrack is an alias to the API type definition for attack tracks. - AttackTrack = v1alpha1.AttackTrack - - // Framework is an alias to the API type definition for a framework. - Framework = reporthandling.Framework - - // Control is an alias to the API type definition for a control. - Control = reporthandling.Control - - // PostureExceptionPolicy is an alias to the API type definition for posture exception policy. - PostureExceptionPolicy = armotypes.PostureExceptionPolicy - - // CustomerConfig is an alias to the API type definition for a customer configuration. - CustomerConfig = armotypes.CustomerConfig - - // PostureReport is an alias to the API type definition for a posture report. - PostureReport = reporthandlingv2.PostureReport -) - -type ( - // internal data descriptors - - // feLoginData describes the input to a login challenge. - feLoginData struct { - Secret string `json:"secret"` - ClientId string `json:"clientId"` - } - - // feLoginResponse describes the response to a login challenge. - feLoginResponse struct { - Token string `json:"accessToken"` - RefreshToken string `json:"refreshToken"` - Expires string `json:"expires"` - ExpiresIn int32 `json:"expiresIn"` - } - - ksCloudSelectCustomer struct { - SelectedCustomerGuid string `json:"selectedCustomer"` - } -) diff --git a/core/cautils/getter/downloadreleasedpolicy.go b/core/cautils/getter/downloadreleasedpolicy.go index 9f85b054..5564f819 100644 --- a/core/cautils/getter/downloadreleasedpolicy.go +++ b/core/cautils/getter/downloadreleasedpolicy.go @@ -5,6 +5,7 @@ import ( "strings" "github.com/armosec/armoapi-go/armotypes" + "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/attacktrack/v1alpha1" diff --git a/core/cautils/getter/downloadreleasedpolicy_test.go b/core/cautils/getter/downloadreleasedpolicy_test.go index e2d17d32..b23dcf5c 100644 --- a/core/cautils/getter/downloadreleasedpolicy_test.go +++ b/core/cautils/getter/downloadreleasedpolicy_test.go @@ -9,11 +9,19 @@ import ( "strings" "testing" - "github.com/kubescape/kubescape/v2/internal/testutils" jsoniter "github.com/json-iterator/go" + "github.com/kubescape/kubescape/v2/internal/testutils" "github.com/stretchr/testify/require" ) +func min(a, b int64) int64 { + if a < b { + return a + } + + return b +} + func TestReleasedPolicy(t *testing.T) { t.Parallel() diff --git a/core/cautils/getter/gcpcloudapi.go b/core/cautils/getter/gcpcloudapi.go deleted file mode 100644 index 7073e336..00000000 --- a/core/cautils/getter/gcpcloudapi.go +++ /dev/null @@ -1,42 +0,0 @@ -package getter - -import ( - "context" - "os" - - containeranalysis "cloud.google.com/go/containeranalysis/apiv1" -) - -type GCPCloudAPI struct { - credentialsPath string - context context.Context - client *containeranalysis.Client - projectID string - credentialsCheck bool -} - -func GetGlobalGCPCloudAPIConnector() *GCPCloudAPI { - - if os.Getenv("KS_GCP_CREDENTIALS_PATH") == "" || os.Getenv("KS_GCP_PROJECT_ID") == "" { - return &GCPCloudAPI{ - credentialsCheck: false, - } - } else { - return &GCPCloudAPI{ - context: context.Background(), - credentialsPath: os.Getenv("KS_GCP_CREDENTIALS_PATH"), - projectID: os.Getenv("KS_GCP_PROJECT_ID"), - credentialsCheck: true, - } - } -} - -func (api *GCPCloudAPI) SetClient(client *containeranalysis.Client) { - api.client = client -} - -func (api *GCPCloudAPI) GetCredentialsPath() string { return api.credentialsPath } -func (api *GCPCloudAPI) GetClient() *containeranalysis.Client { return api.client } -func (api *GCPCloudAPI) GetProjectID() string { return api.projectID } -func (api *GCPCloudAPI) GetCredentialsCheck() bool { return api.credentialsCheck } -func (api *GCPCloudAPI) GetContext() context.Context { return api.context } diff --git a/core/cautils/getter/getpoliciesutils_test.go b/core/cautils/getter/getpoliciesutils_test.go index d219b666..3f56bd70 100644 --- a/core/cautils/getter/getpoliciesutils_test.go +++ b/core/cautils/getter/getpoliciesutils_test.go @@ -6,6 +6,7 @@ import ( "path/filepath" "testing" + beClient "github.com/kubescape/backend/pkg/client/v1" "github.com/stretchr/testify/require" ) @@ -72,7 +73,7 @@ func TestHttpMethods(t *testing.T) { client := http.DefaultClient hdrs := map[string]string{"key": "value"} - srv := mockAPIServer(t) + srv := beClient.MockAPIServer(t) t.Cleanup(srv.Close) t.Run("HttpGetter should GET", func(t *testing.T) { diff --git a/core/cautils/getter/interfaces.go b/core/cautils/getter/interfaces.go index 1e6aa9f9..eca67cbc 100644 --- a/core/cautils/getter/interfaces.go +++ b/core/cautils/getter/interfaces.go @@ -31,25 +31,4 @@ type ( IAttackTracksGetter interface { GetAttackTracks() ([]v1alpha1.AttackTrack, error) } - - // IBackend knows how to configure a KS Cloud client - IBackend interface { - GetAccountID() string - GetClientID() string - GetSecretKey() string - GetCloudReportURL() string - GetCloudAPIURL() string - GetCloudUIURL() string - GetCloudAuthURL() string - - SetAccountID(accountID string) - SetClientID(clientID string) - SetSecretKey(secretKey string) - SetCloudReportURL(cloudReportURL string) - SetCloudAPIURL(cloudAPIURL string) - SetCloudUIURL(cloudUIURL string) - SetCloudAuthURL(cloudAuthURL string) - - GetTenant() (*TenantResponse, error) - } ) diff --git a/core/cautils/getter/kscloudapi.go b/core/cautils/getter/kscloudapi.go index 9c09bffa..78c18d32 100644 --- a/core/cautils/getter/kscloudapi.go +++ b/core/cautils/getter/kscloudapi.go @@ -1,833 +1,49 @@ package getter import ( - "bytes" - "errors" - "fmt" - "io" - "net/http" - "strings" -) - -const ( - // Kubescape API endpoints - - // production - ksCloudERURL = "report.armo.cloud" // API reports URL - ksCloudBEURL = "api.armosec.io" // API backend URL - ksCloudFEURL = "cloud.armosec.io" // API frontend (UI) URIL - ksCloudAUTHURL = "auth.armosec.io" // API login URL - - // staging - ksCloudStageERURL = "report-ks.eustage2.cyberarmorsoft.com" - ksCloudStageBEURL = "api-stage.armosec.io" - ksCloudStageFEURL = "armoui-stage.armosec.io" - ksCloudStageAUTHURL = "eggauth-stage.armosec.io" - - // dev - ksCloudDevERURL = "report.eudev3.cyberarmorsoft.com" - ksCloudDevBEURL = "api-dev.armosec.io" - ksCloudDevFEURL = "cloud-dev.armosec.io" - ksCloudDevAUTHURL = "eggauth-dev.armosec.io" - - // Kubescape API routes - pathAttackTracks = "/api/v1/attackTracks" - pathFrameworks = "/api/v1/armoFrameworks" - pathExceptions = "/api/v1/armoPostureExceptions" - pathTenant = "/api/v1/tenants/createTenant" - pathExceptionPolicy = "/api/v1/postureExceptionPolicy" - pathCustomerConfig = "/api/v1/armoCustomerConfiguration" - pathLogin = "/identity/resources/auth/v1/api-token" - pathToken = "/api/v1/openid_customers" //nolint:gosec - - // reports upload route - pathReport = "/k8s/v2/postureReport" - - // Kubescape UI routes - pathUIScan = "/compliance/%s" - pathUIRBAC = "/rbac-visualizer" - pathUIRepository = "/repository-scanning/%s" - pathUIDashboard = "/dashboard/" - pathUISign = "/account/sign-up" -) - -const ( - // default dummy GUID when not defined - fallbackGUID = "11111111-1111-1111-1111-111111111111" - - // URL query parameters - queryParamGUID = "customerGUID" - queryParamScope = "scope" - queryParamFrameworkName = "frameworkName" - queryParamPolicyName = "policyName" - queryParamClusterName = "clusterName" - queryParamContextName = "contextName" - - queryParamUTMSource = "utm_source" - queryParamUTMMedium = "utm_medium" - // queryParamUTMCampaign = "utm_campaign" - queryParamReport = "reportGUID" - queryParamInvitationToken = "invitationToken" - - authenticationCookie = "auth" -) - -var ( - // Errors returned by the API - - ErrLoginMissingAccountID = errors.New("failed to login, missing accountID") - ErrLoginMissingClientID = errors.New("failed to login, missing clientID") - ErrLoginMissingSecretKey = errors.New("failed to login, missing secretKey") - ErrAPINotPublic = errors.New("control api is not public") + v1 "github.com/kubescape/backend/pkg/client/v1" + "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" ) var ( // globalKSCloudAPIConnector is a static global instance of the KS Cloud client, // to be initialized with SetKSCloudAPIConnector. - globalKSCloudAPIConnector *KSCloudAPI + globalKSCloudAPIConnector *v1.KSCloudAPI - _ IPolicyGetter = &KSCloudAPI{} - _ IExceptionsGetter = &KSCloudAPI{} - _ IAttackTracksGetter = &KSCloudAPI{} - _ IControlsInputsGetter = &KSCloudAPI{} + _ IPolicyGetter = &v1.KSCloudAPI{} + _ IExceptionsGetter = &v1.KSCloudAPI{} + _ IAttackTracksGetter = &v1.KSCloudAPI{} + _ IControlsInputsGetter = &v1.KSCloudAPI{} ) -// KSCloudAPI allows to access the API of the Kubescape Cloud offering. -type KSCloudAPI struct { - authCookie *http.Cookie - *ksCloudOptions - authhost string - cloudAPIURL string - secretKey string - accountID string - cloudAuthURL string - invitationToken string - reporthost string - scheme string - host string - authscheme string - clientID string - uischeme string - uihost string - reportscheme string - feToken feLoginResponse - loggedIn bool -} - // SetKSCloudAPIConnector registers a global instance of the KS Cloud client. // // NOTE: cannot be used concurrently. -func SetKSCloudAPIConnector(ksCloudAPI *KSCloudAPI) { +func SetKSCloudAPIConnector(ksCloudAPI *v1.KSCloudAPI) { + if ksCloudAPI != nil { + logger.L().Debug("setting global KS Cloud API connector", + helpers.String("accountID", ksCloudAPI.GetAccountID()), + helpers.String("cloudAPIURL", ksCloudAPI.GetCloudAPIURL()), + helpers.String("cloudReportURL", ksCloudAPI.GetCloudReportURL())) + } else { + logger.L().Debug("setting global KS Cloud API connector (nil)") + } globalKSCloudAPIConnector = ksCloudAPI } // GetKSCloudAPIConnector returns a shallow clone of the KS Cloud client registered for this package. // // NOTE: cannot be used concurrently with SetKSCloudAPIConnector. -func GetKSCloudAPIConnector() *KSCloudAPI { +func GetKSCloudAPIConnector() *v1.KSCloudAPI { if globalKSCloudAPIConnector == nil { - SetKSCloudAPIConnector(NewKSCloudAPIProd()) + SetKSCloudAPIConnector(v1.NewEmptyKSCloudAPI()) } // we return a shallow clone that may be freely modified by the caller. client := *globalKSCloudAPIConnector - options := *globalKSCloudAPIConnector.ksCloudOptions - client.ksCloudOptions = &options + options := *globalKSCloudAPIConnector.KsCloudOptions + client.KsCloudOptions = &options return &client } - -// NewKSCloudAPIDev returns a KS Cloud client pointing to a development environment. -func NewKSCloudAPIDev(opts ...KSCloudOption) *KSCloudAPI { - devOpts := []KSCloudOption{ - WithFrontendURL(ksCloudDevFEURL), - WithReportURL(ksCloudDevERURL), - } - devOpts = append(devOpts, opts...) - - apiObj := newKSCloudAPI( - ksCloudDevBEURL, - ksCloudDevAUTHURL, - devOpts..., - ) - - return apiObj -} - -// NewKSCloudAPIDProd returns a KS Cloud client pointing to a production environment. -func NewKSCloudAPIProd(opts ...KSCloudOption) *KSCloudAPI { - prodOpts := []KSCloudOption{ - WithFrontendURL(ksCloudFEURL), - WithReportURL(ksCloudERURL), - } - prodOpts = append(prodOpts, opts...) - - return newKSCloudAPI( - ksCloudBEURL, - ksCloudAUTHURL, - prodOpts..., - ) -} - -// NewKSCloudAPIStaging returns a KS Cloud client pointing to a testing environment. -func NewKSCloudAPIStaging(opts ...KSCloudOption) *KSCloudAPI { - stagingOpts := []KSCloudOption{ - WithFrontendURL(ksCloudStageFEURL), - WithReportURL(ksCloudStageERURL), - } - stagingOpts = append(stagingOpts, opts...) - - return newKSCloudAPI( - ksCloudStageBEURL, - ksCloudStageAUTHURL, - stagingOpts..., - ) -} - -// NewKSCloudAPICustomed returns a KS Cloud client with configurable API and authentication endpoints. -func NewKSCloudAPICustomized(ksCloudAPIURL, ksCloudAuthURL string, opts ...KSCloudOption) *KSCloudAPI { - return newKSCloudAPI( - ksCloudAPIURL, - ksCloudAuthURL, - opts..., - ) -} - -func newKSCloudAPI(apiURL, authURL string, opts ...KSCloudOption) *KSCloudAPI { - api := &KSCloudAPI{ - cloudAPIURL: apiURL, - cloudAuthURL: authURL, - ksCloudOptions: ksCloudOptionsWithDefaults(opts), - } - - api.SetCloudAPIURL(apiURL) - api.SetCloudAuthURL(authURL) - api.SetCloudUIURL(api.cloudUIURL) - api.SetCloudReportURL(api.cloudReportURL) - - return api -} - -// Get retrieves an API resource. -// -// The response is serialized as a string. -// -// The caller may specify extra headers. -// -// By default, all authentication headers are added. -func (api *KSCloudAPI) Get(fullURL string, headers map[string]string) (string, error) { - rdr, size, err := api.get(fullURL, withExtraHeaders(headers)) - if err != nil { - return "", err - } - defer rdr.Close() - - return readString(rdr, size) -} - -// Post creates an API resource. -// -// The response is serialized as a string. -// -// The caller may specify extra headers. -// -// By default, the body content type is set to JSON and all authentication headers are added. -func (api *KSCloudAPI) Post(fullURL string, headers map[string]string, body []byte) (string, error) { - rdr, size, err := api.post(fullURL, body, withContentJSON(true), withExtraHeaders(headers)) - if err != nil { - return "", err - } - defer rdr.Close() - - return readString(rdr, size) -} - -// Delete an API resource. -// -// The response is serialized as a string. -// -// The caller may specify extra headers. -// -// By default, all authentication headers are added. -func (api *KSCloudAPI) Delete(fullURL string, headers map[string]string) (string, error) { - rdr, size, err := api.delete(fullURL, withExtraHeaders(headers)) - if err != nil { - return "", err - } - defer rdr.Close() - - return readString(rdr, size) -} - -// GetAccountID returns the customer account's GUID. -func (api *KSCloudAPI) GetAccountID() string { return api.accountID } - -// IsLoggedIn indicates if the client has sucessfully authenticated. -func (api *KSCloudAPI) IsLoggedIn() bool { return api.loggedIn } - -func (api *KSCloudAPI) GetClientID() string { return api.clientID } -func (api *KSCloudAPI) GetSecretKey() string { return api.secretKey } -func (api *KSCloudAPI) GetCloudReportURL() string { return api.cloudReportURL } -func (api *KSCloudAPI) GetCloudAPIURL() string { return api.cloudAPIURL } -func (api *KSCloudAPI) GetCloudUIURL() string { return api.cloudUIURL } -func (api *KSCloudAPI) GetCloudAuthURL() string { return api.cloudAuthURL } -func (api *KSCloudAPI) GetInvitationToken() string { return api.invitationToken } - -func (api *KSCloudAPI) SetAccountID(accountID string) { api.accountID = accountID } -func (api *KSCloudAPI) SetClientID(clientID string) { api.clientID = clientID } -func (api *KSCloudAPI) SetSecretKey(secretKey string) { api.secretKey = secretKey } -func (api *KSCloudAPI) SetInvitationToken(token string) { api.invitationToken = token } - -func (api *KSCloudAPI) SetCloudAPIURL(cloudAPIURL string) { - api.cloudAPIURL = cloudAPIURL - api.scheme, api.host = parseHost(cloudAPIURL) -} - -func (api *KSCloudAPI) SetCloudUIURL(cloudUIURL string) { - api.cloudUIURL = cloudUIURL - api.uischeme, api.uihost = parseHost(cloudUIURL) -} - -func (api *KSCloudAPI) SetCloudAuthURL(cloudAuthURL string) { - api.cloudAuthURL = cloudAuthURL - api.authscheme, api.authhost = parseHost(cloudAuthURL) -} - -func (api *KSCloudAPI) SetCloudReportURL(cloudReportURL string) { - api.cloudReportURL = cloudReportURL - api.reportscheme, api.reporthost = parseHost(cloudReportURL) -} - -func (api *KSCloudAPI) GetAttackTracks() ([]AttackTrack, error) { - rdr, _, err := api.get(api.getAttackTracksURL()) - if err != nil { - return nil, err - } - defer rdr.Close() - - attackTracks, err := decode[[]AttackTrack](rdr) - if err != nil { - return nil, err - } - - return attackTracks, nil -} - -func (api *KSCloudAPI) getAttackTracksURL() string { - return api.buildAPIURL( - pathAttackTracks, - api.paramsWithGUID()..., - ) -} - -// GetFramework retrieves a framework by name. -func (api *KSCloudAPI) GetFramework(frameworkName string) (*Framework, error) { - rdr, _, err := api.get(api.getFrameworkURL(frameworkName)) - if err != nil { - return nil, err - } - defer rdr.Close() - - framework, err := decode[Framework](rdr) - if err != nil { - return nil, err - } - - return &framework, err -} - -func (api *KSCloudAPI) getFrameworkURL(frameworkName string) string { - if isNativeFramework(frameworkName) { - // Native framework name is normalized as upper case, but for a custom framework the name remains unaltered - frameworkName = strings.ToUpper(frameworkName) - } - - return api.buildAPIURL( - pathFrameworks, - append( - api.paramsWithGUID(), - queryParamFrameworkName, frameworkName, - )..., - ) -} - -// GetFrameworks returns all registered frameworks. -func (api *KSCloudAPI) GetFrameworks() ([]Framework, error) { - rdr, _, err := api.get(api.getListFrameworkURL()) - if err != nil { - return nil, err - } - defer rdr.Close() - - frameworks, err := decode[[]Framework](rdr) - if err != nil { - return nil, err - } - - return frameworks, err -} - -func (api *KSCloudAPI) getListFrameworkURL() string { - return api.buildAPIURL( - pathFrameworks, - api.paramsWithGUID()..., - ) -} - -// ListCustomFrameworks lists the names of all non-native frameworks that have been registered for this account. -func (api *KSCloudAPI) ListCustomFrameworks() ([]string, error) { - frameworks, err := api.GetFrameworks() - if err != nil { - return nil, err - } - - frameworkList := make([]string, 0, len(frameworks)) - for _, framework := range frameworks { - if isNativeFramework(framework.Name) { - continue - } - - frameworkList = append(frameworkList, framework.Name) - } - - return frameworkList, nil -} - -// ListFrameworks list the names of all registered frameworks. -func (api *KSCloudAPI) ListFrameworks() ([]string, error) { - frameworks, err := api.GetFrameworks() - if err != nil { - return nil, err - } - - frameworkList := make([]string, 0, len(frameworks)) - for _, framework := range frameworks { - name := framework.Name - if isNativeFramework(framework.Name) { - name = strings.ToLower(framework.Name) - } - - frameworkList = append(frameworkList, name) - } - - return frameworkList, nil -} - -// GetExceptions returns exception policies. -func (api *KSCloudAPI) GetExceptions(clusterName string) ([]PostureExceptionPolicy, error) { - rdr, _, err := api.get(api.getExceptionsURL(clusterName)) - if err != nil { - return nil, err - } - defer rdr.Close() - - exceptions, err := decode[[]PostureExceptionPolicy](rdr) - if err != nil { - return nil, err - } - - return exceptions, nil -} - -func (api *KSCloudAPI) getExceptionsURL(clusterName string) string { - return api.buildAPIURL( - pathExceptions, - api.paramsWithGUID()..., - ) - // queryParamClusterName, clusterName, // TODO - fix customer name support in Armo BE -} - -// GetTenant retrieves the credentials for the calling tenant. -// -// The tenant ID overides any already provided account ID. -func (api *KSCloudAPI) GetTenant() (*TenantResponse, error) { - rdr, _, err := api.get(api.getTenantURL()) - if err != nil { - return nil, err - } - defer rdr.Close() - - tenant, err := decode[TenantResponse](rdr) - if err != nil { - return nil, err - } - - if tenant.TenantID != "" { - api.accountID = tenant.TenantID - } - - return &tenant, nil -} - -func (api *KSCloudAPI) getTenantURL() string { - var params []string - if api.accountID != "" { - params = []string{ - queryParamGUID, api.accountID, // NOTE: no fallback in this case - } - } - - return api.buildAPIURL( - pathTenant, - params..., - ) -} - -// GetAccountConfig yields the account configuration. -func (api *KSCloudAPI) GetAccountConfig(clusterName string) (*CustomerConfig, error) { - if api.accountID == "" { - return &CustomerConfig{}, nil - } - - rdr, _, err := api.get(api.getAccountConfig(clusterName)) - if err != nil { - return nil, err - } - defer rdr.Close() - - accountConfig, err := decode[CustomerConfig](rdr) - if err != nil { - // retry with default scope - rdr, _, err = api.get(api.getAccountConfigDefault(clusterName)) - if err != nil { - return nil, err - } - defer rdr.Close() - - accountConfig, err = decode[CustomerConfig](rdr) - if err != nil { - return nil, err - } - } - - return &accountConfig, nil -} - -func (api *KSCloudAPI) getAccountConfig(clusterName string) string { - params := api.paramsWithGUID() - - if clusterName != "" { // TODO - fix customer name support in Armo BE - params = append(params, queryParamClusterName, clusterName) - } - - return api.buildAPIURL( - pathCustomerConfig, - params..., - ) -} - -func (api *KSCloudAPI) getAccountConfigDefault(clusterName string) string { - params := append( - api.paramsWithGUID(), - queryParamScope, "customer", - ) - - if clusterName != "" { // TODO - fix customer name support in Armo BE - params = append(params, queryParamClusterName, clusterName) - } - - return api.buildAPIURL( - pathCustomerConfig, - params..., - ) -} - -// GetControlsInputs returns the controls inputs configured in the account configuration. -func (api *KSCloudAPI) GetControlsInputs(clusterName string) (map[string][]string, error) { - accountConfig, err := api.GetAccountConfig(clusterName) - if err != nil { - return nil, err - } - - return accountConfig.Settings.PostureControlInputs, nil -} - -// GetControl is currently not exposed as a public API endpoint. -func (api *KSCloudAPI) GetControl(ID string) (*Control, error) { - return nil, ErrAPINotPublic -} - -// ListControls is currently not exposed as a public API endpoint. -func (api *KSCloudAPI) ListControls() ([]string, error) { - return nil, ErrAPINotPublic -} - -// PostExceptions registers a list of exceptions. -func (api *KSCloudAPI) PostExceptions(exceptions []PostureExceptionPolicy) error { - target := api.exceptionsURL("") - - for i := range exceptions { - jazon, err := json.Marshal(exceptions[i]) - if err != nil { - return err - } - - _, _, err = api.post(target, jazon, withContentJSON(true)) - if err != nil { - return err - } - } - - return nil -} - -// Delete exception removes a registered exception rule. -func (api *KSCloudAPI) DeleteException(exceptionName string) error { - _, _, err := api.delete(api.exceptionsURL(exceptionName)) - - return err -} - -func (api *KSCloudAPI) exceptionsURL(exceptionsPolicyName string) string { - params := api.paramsWithGUID() - if exceptionsPolicyName != "" { // for delete - params = append(params, queryParamPolicyName, exceptionsPolicyName) - } - - return api.buildAPIURL( - pathExceptionPolicy, - params..., - ) -} - -// SubmitReport uploads a posture report. -func (api *KSCloudAPI) SubmitReport(report *PostureReport) error { - jazon, err := json.Marshal(report) - if err != nil { - return err - } - - _, _, err = api.post(api.postReportURL(report.ClusterName, report.ReportID), jazon, withContentJSON(true), withToken(api.invitationToken)) - - return err -} - -func (api *KSCloudAPI) postReportURL(cluster, reportID string) string { - return api.buildReportURL(pathReport, - append( - api.paramsWithGUID(), - queryParamContextName, cluster, - queryParamClusterName, cluster, // deprecated - queryParamReport, reportID, - )..., - ) -} - -// ViewReportURL yields the frontend URL to view a posture report (e.g. from a repository scan). -func (api *KSCloudAPI) ViewReportURL(reportID string) string { - return api.buildUIURL( - fmt.Sprintf(pathUIRepository, reportID), - ) -} - -// ViewDashboardURL yields the frontend URL for the dashboard. -func (api *KSCloudAPI) ViewDashboardURL() string { - return api.buildUIURL( - pathUIDashboard, - ) -} - -// ViewRBACURL yields the frontend URL to visualize RBAC. -func (api *KSCloudAPI) ViewRBACURL() string { - return api.buildUIURL( - pathUIRBAC, - ) -} - -// ViewRBACURL yields the frontend URL to check the compliance of a scanned cluster. -func (api *KSCloudAPI) ViewScanURL(cluster string) string { - return api.buildUIURL( - fmt.Sprintf(pathUIScan, cluster), - ) -} - -// ViewSignURL yields the frontend login page. -func (api *KSCloudAPI) ViewSignURL() string { - params := api.paramsWithGUID() - params = append(params, api.paramsWithUTM()...) - params = append(params, queryParamInvitationToken, api.invitationToken) - - return api.buildUIURL( - pathUISign, - params..., - ) -} - -// Login to the KS Cloud using the caller's accountID, clientID and secret key. -func (api *KSCloudAPI) Login() error { - if err := api.loginRequirements(); err != nil { - return err - } - - // 1. acquire auth token - body, err := json.Marshal(feLoginData{ClientId: api.clientID, Secret: api.secretKey}) - if err != nil { - return err - } - - rdr, _, err := api.post(api.authTokenURL(), body, withContentJSON(true)) - if err != nil { - return err - } - defer rdr.Close() - - resp, err := decode[feLoginResponse](rdr) - if err != nil { - return err - } - - api.feToken = resp - - // 2. acquire auth cookie - // Now that we have the JWT token, acquire a cookie from the API - api.authCookie, err = api.getAuthCookie() - if err != nil { - return err - } - - api.loggedIn = true - - return nil -} - -func (api *KSCloudAPI) authTokenURL() string { - return api.buildAuthURL(pathLogin) -} - -func (api *KSCloudAPI) getOpenidURL() string { - return api.buildAPIURL(pathToken) -} - -func (api *KSCloudAPI) getAuthCookie() (*http.Cookie, error) { - selectCustomer := ksCloudSelectCustomer{SelectedCustomerGuid: api.accountID} - body, err := json.Marshal(selectCustomer) - if err != nil { - return nil, err - } - - target := api.getOpenidURL() - o := api.defaultRequestOptions([]requestOption{withContentJSON(true), withCookie(nil)}) - req, err := http.NewRequestWithContext(o.reqContext, http.MethodPost, target, bytes.NewBuffer(body)) - if err != nil { - return nil, err - } - o.setHeaders(req) - o.traceReq(req) - resp, err := api.httpClient.Do(req) - if err != nil { - return nil, err - } - defer resp.Body.Close() - o.traceResp(resp) - - if resp.StatusCode != http.StatusOK { - return nil, fmt.Errorf("failed to get cookie from %s: status %d", target, resp.StatusCode) - } - - for _, cookie := range resp.Cookies() { - if cookie.Name == authenticationCookie { - return cookie, nil - } - } - - return nil, fmt.Errorf("no auth cookie in response from %s", target) -} - -func (api *KSCloudAPI) loginRequirements() error { - if api.accountID == "" { - return ErrLoginMissingAccountID - } - - if api.clientID == "" { - return ErrLoginMissingClientID - } - - if api.secretKey == "" { - return ErrLoginMissingSecretKey - } - - return nil -} - -// defaultRequestOptions adds standard authentication headers to all requests -func (api *KSCloudAPI) defaultRequestOptions(opts []requestOption) *requestOptions { - optionsWithDefaults := append(make([]requestOption, 0, 4), - withToken(api.feToken.Token), - withCookie(api.authCookie), - withTrace(api.withTrace), - ) - optionsWithDefaults = append(optionsWithDefaults, opts...) - - return requestOptionsWithDefaults(optionsWithDefaults) -} - -func (api *KSCloudAPI) get(fullURL string, opts ...requestOption) (io.ReadCloser, int64, error) { - o := api.defaultRequestOptions(opts) - req, err := http.NewRequestWithContext(o.reqContext, http.MethodGet, fullURL, nil) - if err != nil { - return nil, 0, err - } - - return api.do(req, o) -} - -func (api *KSCloudAPI) post(fullURL string, body []byte, opts ...requestOption) (io.ReadCloser, int64, error) { - o := api.defaultRequestOptions(opts) - req, err := http.NewRequestWithContext(o.reqContext, http.MethodPost, fullURL, bytes.NewBuffer(body)) - if err != nil { - return nil, 0, err - } - - return api.do(req, o) -} - -func (api *KSCloudAPI) delete(fullURL string, opts ...requestOption) (io.ReadCloser, int64, error) { - o := api.defaultRequestOptions(opts) - req, err := http.NewRequestWithContext(o.reqContext, http.MethodDelete, fullURL, nil) - if err != nil { - return nil, 0, err - } - - return api.do(req, o) -} - -func (api *KSCloudAPI) do(req *http.Request, o *requestOptions) (io.ReadCloser, int64, error) { - o.setHeaders(req) - o.traceReq(req) - - resp, err := api.httpClient.Do(req) - if err != nil { - return nil, 0, err - } - o.traceResp(resp) - - if resp.StatusCode >= 400 { - if req.URL.Path == pathLogin { - return nil, 0, errAuth(resp) - - } - return nil, 0, errAPI(resp) - } - - return resp.Body, resp.ContentLength, err -} - -func (api *KSCloudAPI) paramsWithGUID() []string { - return append(make([]string, 0, 6), - queryParamGUID, api.getCustomerGUIDFallBack(), - ) -} - -func (api *KSCloudAPI) paramsWithUTM() []string { - return append(make([]string, 0, 6), - queryParamUTMSource, "ARMOgithub", - queryParamUTMMedium, "createaccount", - ) -} - -func (api *KSCloudAPI) getCustomerGUIDFallBack() string { - if api.accountID != "" { - return api.accountID - } - return fallbackGUID -} diff --git a/core/cautils/getter/kscloudapi_mocks_test.go b/core/cautils/getter/kscloudapi_mocks_test.go deleted file mode 100644 index 74791149..00000000 --- a/core/cautils/getter/kscloudapi_mocks_test.go +++ /dev/null @@ -1,295 +0,0 @@ -package getter - -import ( - "os" - "path/filepath" - "testing" - - "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/armoapi-go/identifiers" - jsoniter "github.com/json-iterator/go" - "github.com/kubescape/kubescape/v2/internal/testutils" - "github.com/kubescape/opa-utils/reporthandling" - "github.com/kubescape/opa-utils/reporthandling/attacktrack/v1alpha1" - "github.com/stretchr/testify/require" -) - -func mockAttackTracks() []v1alpha1.AttackTrack { - return []v1alpha1.AttackTrack{ - { - ApiVersion: "v1", - Kind: "track", - Metadata: map[string]interface{}{"label": "name"}, - Spec: v1alpha1.AttackTrackSpecification{ - Version: "v2", - Description: "a mock", - Data: v1alpha1.AttackTrackStep{ - Name: "track1", - Description: "mock-step", - SubSteps: []v1alpha1.AttackTrackStep{ - { - Name: "track1", - Description: "mock-step", - Controls: []v1alpha1.IAttackTrackControl{ - mockControlPtr("control-1"), - }, - }, - }, - Controls: []v1alpha1.IAttackTrackControl{ - mockControlPtr("control-2"), - mockControlPtr("control-3"), - }, - }, - }, - }, - { - ApiVersion: "v1", - Kind: "track", - Metadata: map[string]interface{}{"label": "stuff"}, - Spec: v1alpha1.AttackTrackSpecification{ - Version: "v1", - Description: "another mock", - Data: v1alpha1.AttackTrackStep{ - Name: "track2", - Description: "mock-step2", - SubSteps: []v1alpha1.AttackTrackStep{ - { - Name: "track3", - Description: "mock-step", - Controls: []v1alpha1.IAttackTrackControl{ - mockControlPtr("control-4"), - }, - }, - }, - Controls: []v1alpha1.IAttackTrackControl{ - mockControlPtr("control-5"), - mockControlPtr("control-6"), - }, - }, - }, - }, - } -} - -func mockFrameworks() []reporthandling.Framework { - id1s := []string{"control-1", "control-2"} - id2s := []string{"control-3", "control-4"} - id3s := []string{"control-5", "control-6"} - - return []reporthandling.Framework{ - { - PortalBase: armotypes.PortalBase{ - Name: "mock-1", - }, - CreationTime: "now", - Description: "mock-1", - Controls: []reporthandling.Control{ - mockControl("control-1"), - mockControl("control-2"), - }, - ControlsIDs: &id1s, - SubSections: map[string]*reporthandling.FrameworkSubSection{ - "section1": { - ID: "section-id", - ControlIDs: id1s, - }, - }, - }, - { - PortalBase: armotypes.PortalBase{ - Name: "mock-2", - }, - CreationTime: "then", - Description: "mock-2", - Controls: []reporthandling.Control{ - mockControl("control-3"), - mockControl("control-4"), - }, - ControlsIDs: &id2s, - SubSections: map[string]*reporthandling.FrameworkSubSection{ - "section2": { - ID: "section-id", - ControlIDs: id2s, - }, - }, - }, - { - PortalBase: armotypes.PortalBase{ - Name: "nsa", - }, - CreationTime: "tomorrow", - Description: "nsa mock", - Controls: []reporthandling.Control{ - mockControl("control-5"), - mockControl("control-6"), - }, - ControlsIDs: &id3s, - SubSections: map[string]*reporthandling.FrameworkSubSection{ - "section2": { - ID: "section-id", - ControlIDs: id3s, - }, - }, - }, - } -} - -func mockControl(controlID string) reporthandling.Control { - return reporthandling.Control{ - ControlID: controlID, - } -} -func mockControlPtr(controlID string) *reporthandling.Control { - val := mockControl(controlID) - - return &val -} - -func mockExceptions() []armotypes.PostureExceptionPolicy { - return []armotypes.PostureExceptionPolicy{ - { - PolicyType: "postureExceptionPolicy", - CreationTime: "now", - Actions: []armotypes.PostureExceptionPolicyActions{ - "alertOnly", - }, - Resources: []identifiers.PortalDesignator{ - { - DesignatorType: "Attributes", - Attributes: map[string]string{ - "kind": "Pod", - "name": "coredns-[A-Za-z0-9]+-[A-Za-z0-9]+", - "namespace": "kube-system", - }, - }, - { - DesignatorType: "Attributes", - Attributes: map[string]string{ - "kind": "Pod", - "name": "etcd-.*", - "namespace": "kube-system", - }, - }, - }, - PosturePolicies: []armotypes.PosturePolicy{ - { - FrameworkName: "MITRE", - ControlID: "C-.*", - }, - { - FrameworkName: "another-framework", - ControlID: "a regexp", - }, - }, - }, - { - PolicyType: "postureExceptionPolicy", - CreationTime: "then", - Actions: []armotypes.PostureExceptionPolicyActions{ - "alertOnly", - }, - Resources: []identifiers.PortalDesignator{ - { - DesignatorType: "Attributes", - Attributes: map[string]string{ - "kind": "Deployment", - "name": "my-regexp", - }, - }, - { - DesignatorType: "Attributes", - Attributes: map[string]string{ - "kind": "Secret", - "name": "another-regexp", - }, - }, - }, - PosturePolicies: []armotypes.PosturePolicy{ - { - FrameworkName: "yet-another-framework", - ControlID: "a regexp", - }, - }, - }, - } -} - -func mockTenantResponse() *TenantResponse { - return &TenantResponse{ - TenantID: "id", - Token: "token", - Expires: "expiry-time", - AdminMail: "admin@example.com", - } -} - -func mockCustomerConfig(cluster, scope string) func() *armotypes.CustomerConfig { - if cluster == "" { - cluster = "my-cluster" - } - - if scope == "" { - scope = "default" - } - - return func() *armotypes.CustomerConfig { - return &armotypes.CustomerConfig{ - Name: "user", - Attributes: map[string]interface{}{ - "label": "value", - }, - Scope: identifiers.PortalDesignator{ - DesignatorType: "Attributes", - Attributes: map[string]string{ - "kind": "Cluster", - "name": cluster, - "scope": scope, - }, - }, - Settings: armotypes.Settings{ - PostureControlInputs: map[string][]string{ - "inputs-1": {"x1", "y2"}, - "inputs-2": {"x2", "y2"}, - }, - PostureScanConfig: armotypes.PostureScanConfig{ - ScanFrequency: armotypes.ScanFrequency("weekly"), - }, - VulnerabilityScanConfig: armotypes.VulnerabilityScanConfig{ - ScanFrequency: armotypes.ScanFrequency("daily"), - CriticalPriorityThreshold: 1, - HighPriorityThreshold: 2, - MediumPriorityThreshold: 3, - ScanNewDeployment: true, - AllowlistRegistries: []string{"a", "b"}, - BlocklistRegistries: []string{"c", "d"}, - }, - SlackConfigurations: armotypes.SlackSettings{ - Token: "slack-token", - }, - }, - } - } -} - -func mockLoginResponse() *feLoginResponse { - return &feLoginResponse{ - Token: "access-token", - RefreshToken: "refresh-token", - Expires: "expiry-time", - ExpiresIn: 123, - } -} - -func mockPostureReport(t testing.TB, reportID, cluster string) *PostureReport { - fixture := filepath.Join(testutils.CurrentDir(), "testdata", "mock_posture_report.json") - - buf, err := os.ReadFile(fixture) - require.NoError(t, err) - - var report PostureReport - require.NoError(t, - jsoniter.Unmarshal(buf, &report), - ) - - return &report -} diff --git a/core/cautils/getter/kscloudapi_test.go b/core/cautils/getter/kscloudapi_test.go index 4e9f5529..1fdff370 100644 --- a/core/cautils/getter/kscloudapi_test.go +++ b/core/cautils/getter/kscloudapi_test.go @@ -1,16 +1,11 @@ package getter import ( - "fmt" - "io" - "net/http" - "net/http/httptest" "os" - "strings" "sync" "testing" - "github.com/stretchr/testify/assert" + v1 "github.com/kubescape/backend/pkg/client/v1" "github.com/stretchr/testify/require" ) @@ -25,8 +20,8 @@ const ( var ( globalMx sync.Mutex // a mutex to avoid data races on package globals while testing - testOptions = []KSCloudOption{ - WithTrace(os.Getenv("DEBUG_TEST") != ""), + testOptions = []v1.KSCloudOption{ + v1.WithTrace(os.Getenv("DEBUG_TEST") != ""), } ) @@ -38,1315 +33,17 @@ func TestGlobalKSCloudAPIConnector(t *testing.T) { globalKSCloudAPIConnector = nil - t.Run("uninitialized global connector should yield a prod-ready KS client", func(t *testing.T) { - prod := NewKSCloudAPIProd() - require.EqualValues(t, prod, GetKSCloudAPIConnector()) + t.Run("uninitialized global connector should yield an empty KS client", func(t *testing.T) { + empty := v1.NewEmptyKSCloudAPI() + require.EqualValues(t, empty, GetKSCloudAPIConnector()) }) t.Run("initialized global connector should yield the same pointer", func(t *testing.T) { - dev := NewKSCloudAPIDev() - SetKSCloudAPIConnector(dev) + ksCloud, _ := v1.NewKSCloudAPI("test-123", "test-456", "account") + SetKSCloudAPIConnector(ksCloud) client := GetKSCloudAPIConnector() - require.Equal(t, dev, client) + require.Equal(t, ksCloud, client) require.Equal(t, client, GetKSCloudAPIConnector()) }) } - -func TestFallBackGUID(t *testing.T) { - t.Run("should yield a GUID even though the account ID is not set", func(t *testing.T) { - ks := NewKSCloudAPICustomized("", "") - require.NotEmpty(t, ks.getCustomerGUIDFallBack()) - }) -} - -// func TestKSCloudAPI(t *testing.T) { -// // NOTE: -// // (i) mock handlers do not use "require" in order to let goroutines end normally upon failure. -// // (ii) run with DEBUG_TEST=1 go test -v -run KSCloudAPI to get a trace of all HTTP traffic. - -// srv := mockAPIServer(t, withAPIAuth(true)) // assert that a token is passed as header -// t.Cleanup(srv.Close) - -// ks := NewKSCloudAPICustomized( -// srv.Root(), // BEURL: API URL -// srv.Root(), // AUTHURL: Authentication URL -// append( -// testOptions, -// WithReportURL(srv.Root()), -// )..., -// ) -// ks.SetAccountID("armo") -// ks.SetClientID("armo") -// ks.SetSecretKey("armo") -// ks.SetInvitationToken("armo") -// hdrs := map[string]string{"key": "value"} -// body := []byte("body-post") - -// t.Run("with authenticated", func(t *testing.T) { -// require.NoError(t, ks.Login()) -// require.True(t, ks.IsLoggedIn()) - -// require.NotEmpty(t, ks.feToken.Token) -// require.NotNil(t, ks.authCookie) - -// t.Run("with generic REST methods", func(t *testing.T) { -// t.Run("should POST", func(t *testing.T) { -// t.Parallel() - -// resp, err := ks.Post(srv.URL(pathTestPost), hdrs, body) -// require.NoError(t, err) - -// require.EqualValues(t, string(body), resp) -// }) - -// t.Run("should POST (no headers)", func(t *testing.T) { -// t.Parallel() - -// resp, err := ks.Post(srv.URL(pathTestPost), nil, body) -// require.NoError(t, err) - -// require.EqualValues(t, string(body), resp) -// }) - -// t.Run("should DELETE", func(t *testing.T) { -// t.Parallel() - -// resp, err := ks.Delete(srv.URL(pathTestDelete), hdrs) -// require.NoError(t, err) - -// require.EqualValues(t, "body-delete", resp) -// }) - -// t.Run("should GET", func(t *testing.T) { -// t.Parallel() - -// resp, err := ks.Get(srv.URL(pathTestGet), hdrs) -// require.NoError(t, err) - -// require.EqualValues(t, "body-get", resp) -// }) -// }) - -// t.Run("should retrieve AttackTracks", func(t *testing.T) { -// t.Parallel() - -// tracks, err := ks.GetAttackTracks() -// require.NoError(t, err) -// require.NotNil(t, tracks) - -// expected := mockAttackTracks() - -// // make sure controls don't leak -// for i := range expected { -// expected[i].Spec.Data.Controls = nil // doesn't pass the JSON marshal -// for j := range expected[i].Spec.Data.SubSteps { -// expected[i].Spec.Data.SubSteps[j].Controls = nil -// } -// } -// require.EqualValues(t, expected, tracks) -// }) - -// t.Run("with frameworks", func(t *testing.T) { -// t.Run("should retrieve Framework #1", func(t *testing.T) { -// t.Parallel() - -// framework, err := ks.GetFramework("mock-1") -// require.NoError(t, err) -// require.NotNil(t, framework) - -// mocked := mockFrameworks() -// expected := &mocked[0] -// require.EqualValues(t, expected, framework) -// }) - -// t.Run("should retrieve Framework #2", func(t *testing.T) { -// t.Parallel() - -// framework, err := ks.GetFramework("mock-2") -// require.NoError(t, err) -// require.NotNil(t, framework) - -// mocked := mockFrameworks() -// expected := &mocked[1] -// require.EqualValues(t, expected, framework) -// }) - -// t.Run("should retrieve native Framework", func(t *testing.T) { -// t.Parallel() - -// const testFramework = "MITRE" -// expected, err := os.ReadFile(testFrameworkFile(testFramework)) -// require.NoError(t, err) - -// framework, err := ks.GetFramework("miTrE") -// require.NoError(t, err) -// require.NotNil(t, framework) -// jazon, err := json.Marshal(framework) -// require.NoError(t, err) -// require.JSONEq(t, string(expected), string(jazon)) -// }) - -// t.Run("should retrieve all Frameworks", func(t *testing.T) { -// t.Parallel() - -// // NOTE: MITRE fixture is not part of the base mock - -// expected := mockFrameworks() -// frameworks, err := ks.GetFrameworks() -// require.NoError(t, err) -// require.Len(t, frameworks, 3) -// require.EqualValues(t, expected, frameworks) -// }) - -// t.Run("should list all Frameworks", func(t *testing.T) { -// t.Parallel() - -// mocks := mockFrameworks() -// expected := make([]string, 0, 3) -// for _, fw := range mocks { -// expected = append(expected, fw.Name) -// } - -// frameworkNames, err := ks.ListFrameworks() -// require.NoError(t, err) -// require.Len(t, frameworkNames, 3) -// require.ElementsMatch(t, expected, frameworkNames) -// }) - -// t.Run("should list custom Frameworks", func(t *testing.T) { -// t.Parallel() - -// mocks := mockFrameworks() -// expected := make([]string, 0, 2) -// for _, fw := range mocks[:len(mocks)-1] { -// expected = append(expected, fw.Name) -// } - -// frameworkNames, err := ks.ListCustomFrameworks() -// require.NoError(t, err) -// require.Len(t, frameworkNames, 2) -// require.ElementsMatch(t, expected, frameworkNames) -// }) -// }) - -// t.Run("with controls", func(t *testing.T) { -// t.Run("should NOT retrieve Control (not a public API)", func(t *testing.T) { -// t.Parallel() - -// const id = "control-1" - -// control, err := ks.GetControl(id) -// require.Error(t, err) -// require.Nil(t, control) -// require.Contains(t, err.Error(), "is not public") -// }) - -// t.Run("should NOT list Controls (not a public API)", func(t *testing.T) { -// t.Parallel() - -// control, err := ks.ListControls() -// require.Error(t, err) -// require.Nil(t, control) -// require.Contains(t, err.Error(), "is not public") -// }) -// }) - -// t.Run("with exceptions", func(t *testing.T) { -// t.Run("should retrieve Exceptions", func(t *testing.T) { -// t.Parallel() - -// expected := mockExceptions() -// exceptions, err := ks.GetExceptions("") -// require.NoError(t, err) -// require.Len(t, exceptions, 2) -// require.EqualValues(t, expected, exceptions) -// }) - -// t.Run("should POST Exceptions", func(t *testing.T) { -// t.Parallel() - -// require.NoError(t, -// ks.PostExceptions(mockExceptions()), -// ) -// }) - -// t.Run("DELETE Exception requires a name", func(t *testing.T) { -// t.Parallel() - -// require.Error(t, -// ks.DeleteException(""), -// ) -// }) - -// t.Run("should DELETE Exception", func(t *testing.T) { -// t.Parallel() - -// require.NoError(t, -// ks.DeleteException("mock"), -// ) -// }) -// }) - -// t.Run("should retrieve Tenant", func(t *testing.T) { -// t.Parallel() - -// expected := mockTenantResponse() -// tenant, err := ks.GetTenant() -// require.NoError(t, err) -// require.NotNil(t, tenant) -// require.EqualValues(t, expected, tenant) -// }) - -// t.Run("with CustomerConfig", func(t *testing.T) { -// t.Run("empty CustomerConfig", func(t *testing.T) { -// t.Parallel() - -// kno := NewKSCloudAPICustomized( -// "", -// srv.Root(), -// ) - -// account, err := kno.GetAccountConfig("") -// require.NoError(t, err) -// require.NotNil(t, account) -// require.Empty(t, *account) -// }) - -// t.Run("should retrieve CustomerConfig", func(t *testing.T) { -// t.Parallel() - -// expected := mockCustomerConfig("", "")() -// account, err := ks.GetAccountConfig("") -// require.NoError(t, err) -// require.NotNil(t, account) -// require.EqualValues(t, expected, account) -// }) - -// t.Run("should retrieve CustomerConfig for cluster", func(t *testing.T) { -// t.Parallel() - -// const cluster = "special-cluster" - -// expected := mockCustomerConfig(cluster, "")() -// account, err := ks.GetAccountConfig(cluster) -// require.NoError(t, err) -// require.NotNil(t, account) -// require.EqualValues(t, expected, account) -// }) - -// t.Run("should retrieve scoped CustomerConfig", func(t *testing.T) { -// // NOTE: this is not directly exposed as an exported method of the API client, -// // but called internally on some specific condition that is hard to reproduce in test. -// t.Parallel() - -// mocks := mockCustomerConfig("", "customer")() -// expected, err := json.Marshal(mocks) -// require.NoError(t, err) - -// account, err := ks.Get(ks.getAccountConfigDefault(""), nil) -// require.NoError(t, err) -// require.NotNil(t, account) -// require.JSONEq(t, string(expected), account) -// }) - -// t.Run("should retrieve scoped CustomerConfig for cluster", func(t *testing.T) { -// // NOTE: same as above -// t.Parallel() - -// const cluster = "special-cluster" - -// mocks := mockCustomerConfig(cluster, "customer")() -// expected, err := json.Marshal(mocks) -// require.NoError(t, err) - -// account, err := ks.Get(ks.getAccountConfigDefault(cluster), nil) -// require.NoError(t, err) -// require.NotNil(t, account) -// require.JSONEq(t, string(expected), account) -// }) - -// t.Run("should retrieve ControlInputs", func(t *testing.T) { -// t.Parallel() - -// config := mockCustomerConfig("", "")() -// expected := config.Settings.PostureControlInputs - -// inputs, err := ks.GetControlsInputs("") -// require.NoError(t, err) -// require.NotNil(t, inputs) -// require.EqualValues(t, expected, inputs) -// }) -// }) - -// t.Run("should submit report", func(t *testing.T) { -// t.Parallel() - -// const ( -// cluster = "special-cluster" -// reportID = "5d817063-096f-4d91-b39b-8665240080af" -// ) - -// submitted := mockPostureReport(t, reportID, cluster) -// require.NoError(t, -// ks.SubmitReport(submitted), -// ) -// }) -// }) - -// t.Run("should POST with options", func(t *testing.T) { -// // exercise some options of the client -// t.Parallel() - -// log.SetOutput(io.Discard) -// defer func() { -// log.SetOutput(os.Stderr) -// }() -// kt := NewKSCloudAPICustomized(srv.Root(), srv.Root(), -// WithHTTPClient(&http.Client{}), -// WithTimeout(500*time.Millisecond), -// WithTrace(true), -// ) -// kt.SetAccountID("armo") -// kt.SetClientID("armo") -// kt.SetSecretKey("armo") - -// require.NoError(t, kt.Login()) -// require.True(t, kt.IsLoggedIn()) - -// resp, err := kt.Post(srv.URL(pathTestPost), hdrs, body) -// require.NoError(t, err) - -// require.EqualValues(t, string(body), resp) -// }) - -// t.Run("with login", func(t *testing.T) { -// t.Run("login requires an account ID", func(t *testing.T) { -// t.Parallel() - -// kno := NewKSCloudAPICustomized( -// "", -// srv.Root(), -// ) -// kno.SetClientID("armo") -// kno.SetSecretKey("armo") - -// err := kno.Login() -// require.Error(t, err) -// require.Contains(t, err.Error(), "missing accountID") -// }) - -// t.Run("login requires a client ID", func(t *testing.T) { -// t.Parallel() - -// kno := NewKSCloudAPICustomized( -// "", -// srv.Root(), -// ) -// kno.SetAccountID("armo") -// kno.SetSecretKey("armo") - -// err := kno.Login() -// require.Error(t, err) -// require.Contains(t, err.Error(), "missing clientID") -// }) - -// t.Run("login requires a secret key", func(t *testing.T) { -// t.Parallel() - -// kno := NewKSCloudAPICustomized( -// "", -// srv.Root(), -// ) -// kno.SetAccountID("armo") -// kno.SetClientID("armo") - -// err := kno.Login() -// require.Error(t, err) -// require.Contains(t, err.Error(), "missing secretKey") -// }) -// }) - -// t.Run("with getters & setters", func(t *testing.T) { -// t.Parallel() - -// kno := NewKSCloudAPICustomized( -// "", -// srv.Root(), -// ) - -// pickString := func() string { -// return strconv.Itoa(rand.Intn(10000)) //nolint:gosec -// } - -// t.Run("should get&set account", func(t *testing.T) { -// str := pickString() -// kno.SetAccountID(str) -// require.Equal(t, str, kno.GetAccountID()) -// }) - -// t.Run("should get&set client", func(t *testing.T) { -// str := pickString() -// kno.SetClientID(str) -// require.Equal(t, str, kno.GetClientID()) -// }) - -// t.Run("should get&set key", func(t *testing.T) { -// str := pickString() -// kno.SetSecretKey(str) -// require.Equal(t, str, kno.GetSecretKey()) -// }) - -// t.Run("should get&set invitation token", func(t *testing.T) { -// str := pickString() -// kno.SetInvitationToken(str) -// require.Equal(t, str, kno.GetInvitationToken()) -// }) - -// t.Run("should get&set report URL", func(t *testing.T) { -// str := pickString() -// kno.SetCloudReportURL(str) -// require.Equal(t, str, kno.GetCloudReportURL()) -// }) - -// t.Run("should get&set API URL", func(t *testing.T) { -// str := pickString() -// kno.SetCloudAPIURL(str) -// require.Equal(t, str, kno.GetCloudAPIURL()) -// }) - -// t.Run("should get&set UI URL", func(t *testing.T) { -// str := pickString() -// kno.SetCloudUIURL(str) -// require.Equal(t, str, kno.GetCloudUIURL()) -// }) - -// t.Run("should get&set auth URL", func(t *testing.T) { -// str := pickString() -// kno.SetCloudAuthURL(str) -// require.Equal(t, str, kno.GetCloudAuthURL()) -// }) -// }) - -// t.Run("with API errors", func(t *testing.T) { -// // exercise the client when the API returns errors -// t.Parallel() - -// errAPI := errors.New("test error") -// errSrv := mockAPIServer(t, withAPIError(errAPI)) -// t.Cleanup(errSrv.Close) - -// ke := NewKSCloudAPICustomized( -// errSrv.Root(), -// errSrv.Root(), -// ) -// ke.SetAccountID("armo") -// ke.SetClientID("armo") -// ke.SetSecretKey("armo") - -// hdrs := map[string]string{"key": "value"} -// body := []byte("body-post") - -// t.Run("API calls should error", func(t *testing.T) { -// _, err := ke.Post(errSrv.URL(pathTestPost), hdrs, body) -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.Delete(errSrv.URL(pathTestDelete), hdrs) -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.Get(errSrv.URL(pathTestGet), hdrs) -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.GetExceptions("") -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// err = ke.PostExceptions(mockExceptions()) -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// err = ke.DeleteException("mock") -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.GetTenant() -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.GetControlsInputs("") -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.GetAccountConfig("") -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// err = ke.Login() -// require.Error(t, err) -// require.Contains(t, err.Error(), "error authenticating") -// require.False(t, ke.IsLoggedIn()) - -// _, err = ke.GetAttackTracks() -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.GetFramework("mock-1") -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.GetFrameworks() -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.ListFrameworks() -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) - -// _, err = ke.ListCustomFrameworks() -// require.Error(t, err) -// require.Contains(t, err.Error(), errAPI.Error()) -// }) -// }) - -// t.Run("with API returning invalid response", func(t *testing.T) { -// // exercise the client when the API returns an invalid response -// t.Parallel() - -// errSrv := mockAPIServer(t, withAPIGarbled(true)) -// t.Cleanup(errSrv.Close) - -// ke := NewKSCloudAPICustomized( -// errSrv.Root(), -// errSrv.Root(), -// ) -// ke.SetAccountID("armo") -// ke.SetClientID("armo") -// ke.SetSecretKey("armo") - -// t.Run("API calls should return unmarshalling error", func(t *testing.T) { -// // only API calls that return a typed response are checked - -// _, err := ke.GetExceptions("") -// require.Error(t, err) - -// _, err = ke.GetTenant() -// require.Error(t, err) - -// _, err = ke.GetAccountConfig("") -// require.Error(t, err) - -// err = ke.Login() -// require.Error(t, err) -// require.False(t, ke.IsLoggedIn()) - -// _, err = ke.GetControlsInputs("") -// require.Error(t, err) - -// _, err = ke.GetAttackTracks() -// require.Error(t, err) - -// _, err = ke.GetFramework("mock-1") -// require.Error(t, err) - -// _, err = ke.GetFrameworks() -// require.Error(t, err) - -// _, err = ke.ListFrameworks() -// require.Error(t, err) - -// _, err = ke.ListCustomFrameworks() -// require.Error(t, err) -// }) -// }) - -// t.Run("with no cookie response", func(t *testing.T) { -// // simulates a successul login, but the second stage (retrieving the cookie) fails: no cookie is set in response -// t.Parallel() - -// errSrv := mockAPIServer(t, withAPIAuth(true), withAPINoCookie(true)) // assert that a token is passed as header, and no cookie is returned -// t.Cleanup(errSrv.Close) - -// kt := NewKSCloudAPICustomized(errSrv.Root(), errSrv.Root(), testOptions...) -// kt.SetAccountID("armo") -// kt.SetClientID("armo") -// kt.SetSecretKey("armo") - -// err := kt.Login() -// require.Error(t, err) -// require.Contains(t, err.Error(), "no auth cookie in response") -// require.False(t, kt.IsLoggedIn()) -// }) - -// t.Run("with error on cookie response", func(t *testing.T) { -// // simulates a successul login, but the second stage (retrieving the cookie) fails: API error -// t.Parallel() - -// errSrv := mockAPIServer(t, withAPIAuth(true), withAPIErrOnCookie(errors.New("cookie error"))) -// t.Cleanup(errSrv.Close) - -// kt := NewKSCloudAPICustomized(errSrv.Root(), errSrv.Root(), testOptions...) -// kt.SetAccountID("armo") -// kt.SetClientID("armo") -// kt.SetSecretKey("armo") - -// err := kt.Login() -// require.Error(t, err) -// require.Contains(t, err.Error(), "failed to get cookie") -// require.False(t, kt.IsLoggedIn()) -// }) -// } - -func TestKSCloudAPISmoke(t *testing.T) { - t.Run("smoke-test constructors", func(t *testing.T) { - require.NotNil(t, NewKSCloudAPIDev()) - require.NotNil(t, NewKSCloudAPIStaging()) - require.NotNil(t, NewKSCloudAPIProd()) - }) -} - -type ( - testServer struct { - *httptest.Server - *mockAPIOptions - } - - mockAPIOption func(*mockAPIOptions) - mockAPIOptions struct { - withError error // responds error systematically - withGarbled bool // responds garbled JSON (if a JSON response is expected) - withAuth bool // asserts a token in headers - withNoCookie bool // cookie is not set in response - withErrOnCookie error // sets the cookie but returns error in response - } -) - -func (s *testServer) Root() string { - return s.Server.URL -} - -func (s *testServer) URL(pth string) string { - pth = strings.TrimLeft(pth, "/") - - return fmt.Sprintf("%s/%s", s.Server.URL, pth) -} - -// WantsError responds with the configured error. -func (o *mockAPIOptions) WantsError(w http.ResponseWriter) bool { - if o.withError == nil { - return false - } - - http.Error(w, o.withError.Error(), http.StatusInternalServerError) - - return true -} - -// WantsGarbled responds with invalid JSON -func (o *mockAPIOptions) WantsGarbled(w http.ResponseWriter) bool { - if !o.withGarbled { - return false - } - - invalidJSON(w) - - return true -} - -// AssertAuth asserts the presence of an Authorization Bearer token. -func (o *mockAPIOptions) AssertAuth(t testing.TB, r *http.Request) bool { - if !o.withAuth { - return true - } - - header := r.Header.Get("Authorization") - if !assert.NotEmpty(t, header) { - return false - } - - var token string - _, err := fmt.Sscanf(header, "Bearer %s", &token) - if !assert.NoError(t, err) { - return false - } - - return assert.NotEmpty(t, token) -} - -func withAPIError(err error) mockAPIOption { - return func(o *mockAPIOptions) { - o.withError = err - } -} - -func withAPIGarbled(enabled bool) mockAPIOption { - return func(o *mockAPIOptions) { - o.withGarbled = enabled - } -} - -func withAPIAuth(enabled bool) mockAPIOption { - return func(o *mockAPIOptions) { - o.withAuth = enabled - } -} - -func withAPINoCookie(enabled bool) mockAPIOption { - return func(o *mockAPIOptions) { - o.withNoCookie = enabled - } -} - -func withAPIErrOnCookie(err error) mockAPIOption { - return func(o *mockAPIOptions) { - o.withErrOnCookie = err - } -} - -func apiOptions(opts []mockAPIOption) *mockAPIOptions { - o := &mockAPIOptions{} - for _, apply := range opts { - apply(o) - } - - return o -} - -func mockAPIServer(t testing.TB, opts ...mockAPIOption) *testServer { - h := http.NewServeMux() - - // test options: regular mock (default), error or garbled JSON output - server := &testServer{ - Server: httptest.NewServer(h), - mockAPIOptions: apiOptions(opts), - } - - h.HandleFunc(pathTestPost, func(w http.ResponseWriter, r *http.Request) { - if !isPost(t, r) { - w.WriteHeader(http.StatusMethodNotAllowed) - - return - } - - if !server.AssertAuth(t, r) { - w.WriteHeader(http.StatusUnauthorized) - - return - } - - if server.WantsError(w) { - return - } - - if server.WantsGarbled(w) { - return - } - - echoRequest(w, r) - }) - - h.HandleFunc(pathTestDelete, func(w http.ResponseWriter, r *http.Request) { - if !isDelete(t, r) { - w.WriteHeader(http.StatusMethodNotAllowed) - - return - } - - if !server.AssertAuth(t, r) { - w.WriteHeader(http.StatusUnauthorized) - - return - } - - if server.WantsError(w) { - return - } - - if server.WantsGarbled(w) { - return - } - - echoHeaders(w, r) - fmt.Fprintf(w, "body-delete") - }) - - h.HandleFunc(pathTestGet, func(w http.ResponseWriter, r *http.Request) { - if !isGet(t, r) { - w.WriteHeader(http.StatusMethodNotAllowed) - - return - } - - if !server.AssertAuth(t, r) { - w.WriteHeader(http.StatusUnauthorized) - - return - } - - if server.WantsError(w) { - return - } - - if server.WantsGarbled(w) { - return - } - - echoHeaders(w, r) - fmt.Fprintf(w, "body-get") - }) - - h.HandleFunc(pathAttackTracks, mockHandlerAttackTracks(t, opts...)) - h.HandleFunc(pathFrameworks, mockHandlerFrameworks(t, opts...)) - h.HandleFunc(pathExceptions, mockHandlerExceptions(t, opts...)) - h.HandleFunc(pathTenant, mockHandlerTenant(t, opts...)) - h.HandleFunc(pathExceptionPolicy, mockHandlerPostureExceptionPolicy(t, opts...)) - h.HandleFunc(pathCustomerConfig, mockHandlerCustomerConfiguration(t, opts...)) - h.HandleFunc(pathLogin, mockHandlerLogin(t, opts...)) - h.HandleFunc(pathToken, mockHandlerToken(t, opts...)) - h.HandleFunc(pathReport, mockHandlerReport(t, opts...)) - - return server -} - -func mockHandlerGetWithGUID[T any](t testing.TB, generator func() T, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - o := apiOptions(opts) - - return func(w http.ResponseWriter, r *http.Request) { - if !isGet(t, r) { - w.WriteHeader(http.StatusMethodNotAllowed) - - return - } - - if !o.AssertAuth(t, r) { - w.WriteHeader(http.StatusUnauthorized) - - return - } - - if !hasGUID(t, r) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if o.WantsError(w) { - return - } - - if o.WantsGarbled(w) { - return - } - - enc := json.NewEncoder(w) - var doc T - assert.NoErrorf(t, enc.Encode(generator()), "expected %T fixture to marshal to JSON", doc) - } -} - -func mockHandlerFrameworks(t testing.TB, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - o := apiOptions(opts) - - return func(w http.ResponseWriter, r *http.Request) { - if !isGet(t, r) { - w.WriteHeader(http.StatusMethodNotAllowed) - - return - } - - if !o.AssertAuth(t, r) { - w.WriteHeader(http.StatusUnauthorized) - - return - } - - if !hasGUID(t, r) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if o.WantsError(w) { - return - } - - if o.WantsGarbled(w) { - return - } - - frameworks := mockFrameworks() - name := r.Form.Get("frameworkName") - if name == "" { - enc := json.NewEncoder(w) - assert.NoErrorf(t, enc.Encode(frameworks), "expected Framework fixture to marshal to JSON") - - return - } - - assert.Contains(t, []string{"mock-1", "mock-2", "MITRE"}, name) - - var framework Framework - switch name { - case "mock-1": - framework = frameworks[0] - case "mock-2": - framework = frameworks[1] - case "MITRE": - // load MITRE from JSON fixture - const testFramework = "MITRE" - buf, err := os.ReadFile(testFrameworkFile(testFramework)) - if !assert.NoError(t, err) { - w.WriteHeader(http.StatusInternalServerError) - - return - } - _, _ = w.Write(buf) - } - - enc := json.NewEncoder(w) - assert.NoErrorf(t, enc.Encode(framework), "expected Framework fixture to marshal to JSON") - } -} - -func mockHandlerAttackTracks(t testing.TB, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - return mockHandlerGetWithGUID(t, mockAttackTracks, opts...) -} - -func mockHandlerExceptions(t testing.TB, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - return mockHandlerGetWithGUID(t, mockExceptions, opts...) -} - -func mockHandlerTenant(t testing.TB, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - return mockHandlerGetWithGUID(t, mockTenantResponse, opts...) -} - -func mockHandlerCustomerConfiguration(t testing.TB, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - o := apiOptions(opts) - - return func(w http.ResponseWriter, r *http.Request) { - if !assert.NoErrorf(t, r.ParseForm(), "expected params to parse") { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if !o.AssertAuth(t, r) { - w.WriteHeader(http.StatusUnauthorized) - - return - } - - if o.WantsError(w) { - return - } - - if o.WantsGarbled(w) { - return - } - - cluster := r.Form.Get("clusterName") - scope := r.Form.Get("scope") - - mockHandlerGetWithGUID(t, mockCustomerConfig(cluster, scope), opts...)(w, r) - } -} - -func mockHandlerPostureExceptionPolicy(t testing.TB, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - o := apiOptions(opts) - - return func(w http.ResponseWriter, r *http.Request) { - if !assert.Containsf(t, []string{http.MethodPost, http.MethodDelete}, r.Method, "expected a POST or DELETE method, but got %q", r.Method) { - w.WriteHeader(http.StatusMethodNotAllowed) - - return - } - - if !assert.NoErrorf(t, r.ParseForm(), "expected params to parse") { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if !o.AssertAuth(t, r) { - w.WriteHeader(http.StatusUnauthorized) - - return - } - - if !assert.NotEmpty(t, r.Form) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if o.WantsError(w) { - return - } - - if o.WantsGarbled(w) { - return - } - - if r.Method == http.MethodPost { - if !isJSON(t, r) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - buf, err := io.ReadAll(r.Body) - defer func() { - _ = r.Body.Close() - }() - - if !assert.NoError(t, err) { - w.WriteHeader(http.StatusInternalServerError) - - return - } - - var payload PostureExceptionPolicy - if !assert.NoErrorf(t, json.Unmarshal(buf, &payload), "expected payload to unmarshal into PostureExceptionPolicy, but got: %q", string(buf)) { - w.WriteHeader(http.StatusBadRequest) - } - - return - } - - // DELETE - - if !hasGUID(t, r) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if name := r.Form.Get("policyName"); name == "" { - w.WriteHeader(http.StatusBadRequest) - } - } -} - -func mockHandlerLogin(t testing.TB, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - o := apiOptions(opts) - - return func(w http.ResponseWriter, r *http.Request) { - if !isPost(t, r) { - w.WriteHeader(http.StatusMethodNotAllowed) - - return - } - - if !isJSON(t, r) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if o.WantsError(w) { - return - } - - if o.WantsGarbled(w) { - return - } - - w.Header().Add("Content-Type", "application/json") - enc := json.NewEncoder(w) - assert.NoErrorf(t, enc.Encode(mockLoginResponse()), "expected %T fixture to marshal to JSON", feLoginResponse{}) - } -} - -func mockHandlerToken(t testing.TB, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - o := apiOptions(opts) - - return func(w http.ResponseWriter, r *http.Request) { - if !isPost(t, r) { - w.WriteHeader(http.StatusMethodNotAllowed) - - return - } - - if !o.AssertAuth(t, r) { - w.WriteHeader(http.StatusUnauthorized) - - return - } - - if !isJSON(t, r) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if o.WantsError(w) { - return - } - - if o.WantsGarbled(w) { - return - } - - buf, err := io.ReadAll(r.Body) - defer func() { - _ = r.Body.Close() - }() - - if !assert.NoError(t, err) { - w.WriteHeader(http.StatusInternalServerError) - - return - } - - var payload ksCloudSelectCustomer - if !assert.NoErrorf(t, json.Unmarshal(buf, &payload), "expected payload to unmarshal into ksCloudSelectCustomer, but got: %q", string(buf)) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if !assert.NotEmptyf(t, payload.SelectedCustomerGuid, "requires account GUID in payload") { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if !o.withNoCookie { - http.SetCookie(w, &http.Cookie{Name: authenticationCookie, Value: "someToken", SameSite: http.SameSiteStrictMode}) - } - - if o.withErrOnCookie != nil { - http.Error(w, o.withErrOnCookie.Error(), http.StatusInternalServerError) - } - } -} - -func mockHandlerReport(t testing.TB, opts ...mockAPIOption) func(http.ResponseWriter, *http.Request) { - o := apiOptions(opts) - - return func(w http.ResponseWriter, r *http.Request) { - if !isPost(t, r) { - w.WriteHeader(http.StatusMethodNotAllowed) - - return - } - - if !assert.NoErrorf(t, r.ParseForm(), "expected params to parse") { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if !o.AssertAuth(t, r) { - w.WriteHeader(http.StatusUnauthorized) - - return - } - - if !assert.NotEmpty(t, r.Form) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if o.WantsError(w) { - return - } - - if o.WantsGarbled(w) { - return - } - - if !isJSON(t, r) { - w.WriteHeader(http.StatusBadRequest) - - return - } - - if name := r.Form.Get("contextName"); name == "" { - w.WriteHeader(http.StatusBadRequest) - } - - if name := r.Form.Get("clusterName"); name == "" { - w.WriteHeader(http.StatusBadRequest) - } - - if name := r.Form.Get("reportGUID"); name == "" { - w.WriteHeader(http.StatusBadRequest) - } - - buf, err := io.ReadAll(r.Body) - defer func() { - _ = r.Body.Close() - }() - - if !assert.NoError(t, err) { - w.WriteHeader(http.StatusInternalServerError) - - return - } - - var payload PostureReport - if !assert.NoErrorf(t, json.Unmarshal(buf, &payload), "expected payload to unmarshal into PostureReport, but got: %q", string(buf)) { - w.WriteHeader(http.StatusBadRequest) - } - } -} - -func echoRequest(w http.ResponseWriter, r *http.Request) { - echoHeaders(w, r) - echoBody(w, r) -} - -func echoHeaders(w http.ResponseWriter, r *http.Request) { - for key, vals := range r.Header { - for _, val := range vals { - w.Header().Add(key, val) - } - } -} - -func echoBody(w http.ResponseWriter, r *http.Request) { - defer func() { _ = r.Body.Close() }() - _, _ = io.Copy(w, r.Body) -} - -func isPost(t testing.TB, r *http.Request) bool { - return assert.Truef(t, strings.EqualFold(http.MethodPost, r.Method), "expected a POST method called, but got %q", r.Method) -} - -func isDelete(t testing.TB, r *http.Request) bool { - return assert.Truef(t, strings.EqualFold(http.MethodDelete, r.Method), "expected a DELETE method called, but got %q", r.Method) -} - -func isGet(t testing.TB, r *http.Request) bool { - return assert.Truef(t, strings.EqualFold(http.MethodGet, r.Method), "expected a GET method called, but got %q", r.Method) -} - -func isJSON(t testing.TB, r *http.Request) bool { - contentType := r.Header.Get("Content-Type") - - return assert.Equalf(t, "application/json", contentType, "expected application/json content type") -} - -func hasGUID(t testing.TB, r *http.Request) bool { - if !assert.NoErrorf(t, r.ParseForm(), "expected params to parse") { - return false - } - - if !assert.NotEmpty(t, r.Form) { - return false - } - - if !assert.NotEmpty(t, r.Form.Get("customerGUID")) { - return false - } - - return true -} - -func invalidJSON(w http.ResponseWriter) { - fmt.Fprintf(w, `{"garbled":`) -} diff --git a/core/cautils/getter/kscloudoptions.go b/core/cautils/getter/kscloudoptions.go deleted file mode 100644 index 5c0e4a85..00000000 --- a/core/cautils/getter/kscloudoptions.go +++ /dev/null @@ -1,202 +0,0 @@ -package getter - -import ( - "context" - "fmt" - "log" - "net/http" - "net/http/httputil" - "time" -) - -type ( - // KSCloudOption allows to configure the behavior of the KS Cloud client. - KSCloudOption func(*ksCloudOptions) - - // ksCloudOptions holds all the configurable parts of the KS Cloud client. - ksCloudOptions struct { - httpClient *http.Client - cloudReportURL string - cloudUIURL string - timeout *time.Duration - withTrace bool - } - - // request option instructs post/get/delete to alter the outgoing request - requestOption func(*requestOptions) - - // requestOptions knows how to enrich a request with headers - requestOptions struct { - withJSON bool - withToken string - withCookie *http.Cookie - withTrace bool - headers map[string]string - reqContext context.Context - } -) - -// KS Cloud client options - -// WithHTTPClient overrides the default http.Client used by the KS Cloud client. -func WithHTTPClient(client *http.Client) KSCloudOption { - return func(o *ksCloudOptions) { - o.httpClient = client - } -} - -// WithTimeout sets a global timeout on a operations performed by the KS Cloud client. -// -// A value of 0 means no timeout. -// -// The default is 61s. -func WithTimeout(timeout time.Duration) KSCloudOption { - duration := timeout - - return func(o *ksCloudOptions) { - o.timeout = &duration - } -} - -// WithReportURL specifies the URL to post reports. -func WithReportURL(u string) KSCloudOption { - return func(o *ksCloudOptions) { - o.cloudReportURL = u - } -} - -// WithFrontendURL specifies the URL to access the KS Cloud UI. -func WithFrontendURL(u string) KSCloudOption { - return func(o *ksCloudOptions) { - o.cloudUIURL = u - } -} - -// WithTrace toggles requests dump for inspection & debugging. -func WithTrace(enabled bool) KSCloudOption { - return func(o *ksCloudOptions) { - o.withTrace = enabled - } -} - -var defaultClient = &http.Client{ - Timeout: 61 * time.Second, -} - -// ksCloudOptionsWithDefaults sets defaults for the KS client and applies overrides. -func ksCloudOptionsWithDefaults(opts []KSCloudOption) *ksCloudOptions { - options := &ksCloudOptions{ - httpClient: defaultClient, - } - - for _, apply := range opts { - apply(options) - } - - if options.timeout != nil { - // non-default timeout (0 means no timeout) - // clone the client and override the timeout - client := *options.httpClient - client.Timeout = *options.timeout - options.httpClient = &client - } - - return options -} - -// http request options - -// withContentJSON sets JSON content type for a request -func withContentJSON(enabled bool) requestOption { - return func(o *requestOptions) { - o.withJSON = enabled - } -} - -// withToken sets an Authorization header for a request -func withToken(token string) requestOption { - return func(o *requestOptions) { - o.withToken = token - } -} - -// withCookie sets an authentication cookie for a request -func withCookie(cookie *http.Cookie) requestOption { - return func(o *requestOptions) { - o.withCookie = cookie - } -} - -// withExtraHeaders adds extra headers to a request -func withExtraHeaders(headers map[string]string) requestOption { - return func(o *requestOptions) { - o.headers = headers - } -} - -/* not used yet -// withContext sets the context of a request. -// -// By default, context.Background() is used. -func withContext(ctx context.Context) requestOption { - return func(o *requestOptions) { - o.reqContext = ctx - } -} -*/ - -// withTrace dumps requests for debugging -func withTrace(enabled bool) requestOption { - return func(o *requestOptions) { - o.withTrace = enabled - } -} - -func (o *requestOptions) setHeaders(req *http.Request) { - if o.withJSON { - req.Header.Set("Content-Type", "application/json") - } - - if len(o.withToken) > 0 { - req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", o.withToken)) - } - - if o.withCookie != nil { - req.AddCookie(o.withCookie) - } - - for k, v := range o.headers { - req.Header.Set(k, v) - } -} - -// traceReq dumps the content of an outgoing request for inspecting or debugging the client. -func (o *requestOptions) traceReq(req *http.Request) { - if !o.withTrace { - return - } - - dump, _ := httputil.DumpRequestOut(req, true) - log.Printf("%s\n", dump) -} - -// traceResp dumps the content of an API response for inspecting or debugging the client. -func (o *requestOptions) traceResp(resp *http.Response) { - if !o.withTrace { - return - } - - dump, _ := httputil.DumpResponse(resp, true) - log.Printf("%s\n", dump) -} - -func requestOptionsWithDefaults(opts []requestOption) *requestOptions { - o := &requestOptions{ - reqContext: context.Background(), - } - for _, apply := range opts { - apply(o) - } - - return o -} diff --git a/core/cautils/getter/url.go b/core/cautils/getter/url.go deleted file mode 100644 index 50fbbbd9..00000000 --- a/core/cautils/getter/url.go +++ /dev/null @@ -1,65 +0,0 @@ -package getter - -import ( - "net/url" - "path" -) - -// buildAPIURL builds an URL pointing to the API backend. -func (api *KSCloudAPI) buildAPIURL(pth string, pairs ...string) string { - return buildQuery(url.URL{ - Scheme: api.scheme, - Host: api.host, - Path: pth, - }, pairs...) -} - -// buildUIURL builds an URL pointing to the UI frontend. -func (api *KSCloudAPI) buildUIURL(pth string, pairs ...string) string { - return buildQuery(url.URL{ - Scheme: api.uischeme, - Host: api.uihost, - Path: pth, - }, pairs...) -} - -// buildAuthURL builds an URL pointing to the authentication endpoint. -func (api *KSCloudAPI) buildAuthURL(pth string, pairs ...string) string { - return buildQuery(url.URL{ - Scheme: api.authscheme, - Host: api.authhost, - Path: pth, - }, pairs...) -} - -// buildReportURL builds an URL pointing to the reporting endpoint. -func (api *KSCloudAPI) buildReportURL(pth string, pairs ...string) string { - return buildQuery(url.URL{ - Scheme: api.reportscheme, - Host: api.reporthost, - Path: pth, - }, pairs...) -} - -// buildQuery builds an URL with query params. -// -// Params are provided in pairs (param name, value). -func buildQuery(u url.URL, pairs ...string) string { - if len(pairs)%2 != 0 { - panic("dev error: buildURL accepts query params in (name, value) pairs") - } - - q := u.Query() - - for i := 0; i < len(pairs)-1; i += 2 { - param := pairs[i] - value := pairs[i+1] - - q.Add(param, value) - } - - u.RawQuery = q.Encode() - u.Path = path.Clean(u.Path) - - return u.String() -} diff --git a/core/cautils/getter/url_test.go b/core/cautils/getter/url_test.go deleted file mode 100644 index 0befcea3..00000000 --- a/core/cautils/getter/url_test.go +++ /dev/null @@ -1,86 +0,0 @@ -package getter - -import ( - "testing" - - "github.com/stretchr/testify/require" -) - -func TestBuildURL(t *testing.T) { - t.Parallel() - - ks := NewKSCloudAPICustomized( - "api.example.com", "auth.example.com", // required - WithFrontendURL("ui.example.com"), // optional - WithReportURL("report.example.com"), // optional - ) - - t.Run("should build API URL with query params on https host", func(t *testing.T) { - require.Equal(t, - "https://api.example.com/path?q1=v1&q2=v2", - ks.buildAPIURL("/path", "q1", "v1", "q2", "v2"), - ) - }) - - t.Run("should build API URL with query params on http host", func(t *testing.T) { - ku := NewKSCloudAPICustomized("http://api.example.com", "auth.example.com") - - require.Equal(t, - "http://api.example.com/path?q1=v1&q2=v2", - ku.buildAPIURL("/path", "q1", "v1", "q2", "v2"), - ) - }) - - t.Run("should panic when params are not provided in pairs", func(t *testing.T) { - require.Panics(t, func() { - // notice how the linter detects wrong args - _ = ks.buildAPIURL("/path", "q1", "v1", "q2") //nolint:staticcheck - }) - }) - - t.Run("should build UI URL with query params on https host", func(t *testing.T) { - require.Equal(t, - "https://ui.example.com/path?q1=v1&q2=v2", - ks.buildUIURL("/path", "q1", "v1", "q2", "v2"), - ) - }) - - t.Run("should build report URL with query params on https host", func(t *testing.T) { - require.Equal(t, - "https://report.example.com/path?q1=v1&q2=v2", - ks.buildReportURL("/path", "q1", "v1", "q2", "v2"), - ) - }) -} - -func TestViewURL(t *testing.T) { - t.Parallel() - - ks := NewKSCloudAPICustomized( - "api.example.com", "auth.example.com", // required - WithFrontendURL("ui.example.com"), // optional - WithReportURL("report.example.com"), // optional - ) - ks.SetAccountID("me") - ks.SetInvitationToken("invite") - - t.Run("should render UI report URL", func(t *testing.T) { - require.Equal(t, "https://ui.example.com/repository-scanning/xyz", ks.ViewReportURL("xyz")) - }) - - t.Run("should render UI dashboard URL", func(t *testing.T) { - require.Equal(t, "https://ui.example.com/dashboard", ks.ViewDashboardURL()) - }) - - t.Run("should render UI RBAC URL", func(t *testing.T) { - require.Equal(t, "https://ui.example.com/rbac-visualizer", ks.ViewRBACURL()) - }) - - t.Run("should render UI scan URL", func(t *testing.T) { - require.Equal(t, "https://ui.example.com/compliance/cluster", ks.ViewScanURL("cluster")) - }) - - t.Run("should render UI sign URL", func(t *testing.T) { - require.Equal(t, "https://ui.example.com/account/sign-up?customerGUID=me&invitationToken=invite&utm_medium=createaccount&utm_source=ARMOgithub", ks.ViewSignURL()) - }) -} diff --git a/core/cautils/getter/utils.go b/core/cautils/getter/utils.go index 59d5dd8f..3d1d15d1 100644 --- a/core/cautils/getter/utils.go +++ b/core/cautils/getter/utils.go @@ -1,28 +1,9 @@ package getter import ( - "fmt" - "io" - "net/http" "strings" ) -// parseHost picks a host from a hostname or an URL and detects the scheme. -// -// The default scheme is https. This may be altered by specifying an explicit http://hostname URL. -func parseHost(host string) (string, string) { - if strings.HasPrefix(host, "http://") { - return "http", strings.Replace(host, "http://", "", 1) // cut... index ... - } - - // default scheme - return "https", strings.Replace(host, "https://", "", 1) -} - -func isNativeFramework(framework string) bool { - return contains(NativeFrameworks, framework) -} - func contains(s []string, str string) bool { for _, v := range s { if strings.EqualFold(v, str) { @@ -32,51 +13,3 @@ func contains(s []string, str string) bool { return false } - -func min(a, b int64) int64 { - if a < b { - return a - } - - return b -} - -// errAPI reports an API error, with a cap on the length of the error message. -func errAPI(resp *http.Response) error { - const maxSize = 1024 - - reason := new(strings.Builder) - if resp.Body != nil { - size := min(resp.ContentLength, maxSize) - if size > 0 { - reason.Grow(int(size)) - } - - _, _ = io.CopyN(reason, resp.Body, size) - defer resp.Body.Close() - } - - return fmt.Errorf("http-error: '%s', reason: '%s'", resp.Status, reason.String()) -} - -// errAuth returns an authentication error. -// -// Authentication errors upon login croak a less detailed message. -func errAuth(resp *http.Response) error { - return fmt.Errorf("error authenticating: %d", resp.StatusCode) -} - -func readString(rdr io.Reader, sizeHint int64) (string, error) { - - // if the response is empty, return an empty string - if sizeHint < 0 { - return "", nil - } - - var b strings.Builder - - b.Grow(int(sizeHint)) - _, err := io.Copy(&b, rdr) - - return b.String(), err -} diff --git a/core/cautils/getter/utils_test.go b/core/cautils/getter/utils_test.go deleted file mode 100644 index e40dd662..00000000 --- a/core/cautils/getter/utils_test.go +++ /dev/null @@ -1,99 +0,0 @@ -package getter - -import ( - "io" - "testing" - - "github.com/stretchr/testify/require" -) - -func TestParseHost(t *testing.T) { - t.Parallel() - - t.Run("should recognize http scheme", func(t *testing.T) { - t.Parallel() - - const input = "http://localhost:7555" - scheme, host := parseHost(input) - require.Equal(t, "http", scheme) - require.Equal(t, "localhost:7555", host) - }) - - t.Run("should recognize https scheme", func(t *testing.T) { - t.Parallel() - - const input = "https://localhost:7555" - scheme, host := parseHost(input) - require.Equal(t, "https", scheme) - require.Equal(t, "localhost:7555", host) - }) - - t.Run("should adopt https scheme by default", func(t *testing.T) { - t.Parallel() - - const input = "portal-dev.armo.cloud" - scheme, host := parseHost(input) - require.Equal(t, "https", scheme) - require.Equal(t, "portal-dev.armo.cloud", host) - }) -} - -func TestIsNativeFramework(t *testing.T) { - t.Parallel() - - require.Truef(t, isNativeFramework("nSa"), "expected nsa to be native (case insensitive)") - require.Falsef(t, isNativeFramework("foo"), "expected framework to be custom") -} - -func Test_readString(t *testing.T) { - type args struct { - rdr io.Reader - sizeHint int64 - } - tests := []struct { - name string - args args - want string - wantErr bool - }{ - { - name: "should return empty string if sizeHint is negative", - args: args{ - rdr: nil, - sizeHint: -1, - }, - want: "", - wantErr: false, - }, - { - name: "should return empty string if sizeHint is zero", - args: args{ - rdr: &io.LimitedReader{}, - sizeHint: 0, - }, - want: "", - wantErr: false, - }, - { - name: "should return empty string if sizeHint is positive", - args: args{ - rdr: &io.LimitedReader{}, - sizeHint: 1, - }, - want: "", - wantErr: false, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - got, err := readString(tt.args.rdr, tt.args.sizeHint) - if (err != nil) != tt.wantErr { - t.Errorf("readString() error = %v, wantErr %v", err, tt.wantErr) - return - } - if got != tt.want { - t.Errorf("readString() = %v, want %v", got, tt.want) - } - }) - } -} diff --git a/core/cautils/rootinfo.go b/core/cautils/rootinfo.go index 964820c1..a2971394 100644 --- a/core/cautils/rootinfo.go +++ b/core/cautils/rootinfo.go @@ -7,43 +7,23 @@ import ( ) type RootInfo struct { - Logger string // logger level - LoggerName string // logger name ("pretty"/"zap"/"none") - CacheDir string // cached dir - DisableColor bool // Disable Color - EnableColor bool // Force enable Color - - KSCloudBEURLs string // Kubescape Cloud URL - KSCloudBEURLsDep string // Kubescape Cloud URL + Logger string // logger level + LoggerName string // logger name ("pretty"/"zap"/"none") + CacheDir string // cached dir + DisableColor bool // Disable Color + EnableColor bool // Force enable Color + DiscoveryServerURL string // Discovery Server URL (See https://github.com/kubescape/backend/tree/main/pkg/servicediscovery) } type CloudURLs struct { CloudReportURL string CloudAPIURL string - CloudUIURL string - CloudAuthURL string } -type Credentials struct { - Account string - ClientID string - SecretKey string -} - -// To check if the user's credentials: accountID / clientID / secretKey are valid. -func (credentials *Credentials) Validate() error { - +// To check if the provided account ID is valid +func ValidateAccountID(accountID string) error { // Check if the Account-ID is valid - if _, err := uuid.Parse(credentials.Account); credentials.Account != "" && err != nil { - return fmt.Errorf("bad argument: account must be a valid UUID") - } - // Check if the Client-ID is valid - if _, err := uuid.Parse(credentials.ClientID); credentials.ClientID != "" && err != nil { - return fmt.Errorf("bad argument: account must be a valid UUID") - } - - // Check if the Secret-Key is valid - if _, err := uuid.Parse(credentials.SecretKey); credentials.SecretKey != "" && err != nil { - return fmt.Errorf("bad argument: account must be a valid UUID") + if _, err := uuid.Parse(accountID); accountID != "" && err != nil { + return fmt.Errorf("bad argument: accound ID must be a valid UUID") } return nil diff --git a/core/cautils/rootinfo_test.go b/core/cautils/rootinfo_test.go index 20b70166..c4a5c6ec 100644 --- a/core/cautils/rootinfo_test.go +++ b/core/cautils/rootinfo_test.go @@ -2,11 +2,9 @@ package cautils import "testing" -func TestCredentials_Validate(t *testing.T) { +func TestValidateAccountID(t *testing.T) { type fields struct { - Account string - ClientID string - SecretKey string + Account string } tests := []struct { name string @@ -27,44 +25,11 @@ func TestCredentials_Validate(t *testing.T) { }, wantErr: true, }, - { - name: "valid client ID", - fields: fields{ - ClientID: "22019933-feac-4012-a8eb-e81461ba6655", - }, - wantErr: false, - }, - { - name: "invalid client ID", - fields: fields{ - ClientID: "22019933-feac-4012-a8eb-e81461ba665", - }, - wantErr: true, - }, - { - name: "valid secret key", - fields: fields{ - SecretKey: "22019933-feac-4012-a8eb-e81461ba6655", - }, - wantErr: false, - }, - { - name: "invalid secret key", - fields: fields{ - SecretKey: "22019933-feac-4012-a8eb-e81461ba665", - }, - wantErr: true, - }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - credentials := &Credentials{ - Account: tt.fields.Account, - ClientID: tt.fields.ClientID, - SecretKey: tt.fields.SecretKey, - } - if err := credentials.Validate(); (err != nil) != tt.wantErr { - t.Errorf("Credentials.Validate() error = %v, wantErr %v", err, tt.wantErr) + if err := ValidateAccountID(tt.fields.Account); (err != nil) != tt.wantErr { + t.Errorf("ValidateAccountID() error = %v, wantErr %v", err, tt.wantErr) } }) } diff --git a/core/cautils/scaninfo.go b/core/cautils/scaninfo.go index 4ac8332f..228d44e4 100644 --- a/core/cautils/scaninfo.go +++ b/core/cautils/scaninfo.go @@ -124,12 +124,11 @@ type ScanInfo struct { ComplianceThreshold float32 // Compliance score threshold FailThresholdSeverity string // Severity at and above which the command should fail Submit bool // Submit results to Kubescape Cloud BE - CreateAccount bool // Create account in Kubescape Cloud BE if no account found in local cache ScanID string // Report id of the current scan HostSensorEnabled BoolPtrFlag // Deploy Kubescape K8s host scanner to collect data from certain controls HostSensorYamlPath string // Path to hostsensor file Local bool // Do not submit results - Credentials Credentials // account ID + AccountID string // account ID KubeContext string // context name FrameworkScan bool // false if scanning control ScanAll bool // true if scan all frameworks @@ -296,11 +295,10 @@ func scanInfoToScanMetadata(ctx context.Context, scanInfo *ScanInfo) *reporthand } func (scanInfo *ScanInfo) GetScanningContext() ScanningContext { - input := "" if len(scanInfo.InputPatterns) > 0 { - input = scanInfo.InputPatterns[0] + return GetScanningContext(scanInfo.InputPatterns[0]) } - return GetScanningContext(input) + return GetScanningContext("") } // GetScanningContext get scanning context from the input param diff --git a/core/cautils/scaninfo_test.go b/core/cautils/scaninfo_test.go index 6137689b..489ff51a 100644 --- a/core/cautils/scaninfo_test.go +++ b/core/cautils/scaninfo_test.go @@ -2,6 +2,8 @@ package cautils import ( "context" + "os" + "path/filepath" "testing" reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" @@ -23,13 +25,11 @@ func TestSetContextMetadata(t *testing.T) { /*{ ctx := reporthandlingv2.ContextMetadata{} setContextMetadata(&ctx, "https://github.com/kubescape/kubescape") - assert.Nil(t, ctx.ClusterContextMetadata) assert.Nil(t, ctx.DirectoryContextMetadata) assert.Nil(t, ctx.FileContextMetadata) assert.Nil(t, ctx.HelmContextMetadata) assert.NotNil(t, ctx.RepoContextMetadata) - assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Repo) assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Owner) assert.Equal(t, "master", ctx.RepoContextMetadata.Branch) @@ -37,12 +37,18 @@ func TestSetContextMetadata(t *testing.T) { } func TestGetHostname(t *testing.T) { + // Test that the hostname is not empty assert.NotEqual(t, "", getHostname()) } func TestGetScanningContext(t *testing.T) { + // Test with empty input assert.Equal(t, ContextCluster, GetScanningContext("")) + + // Test with Git URL input assert.Equal(t, ContextGitURL, GetScanningContext("https://github.com/kubescape/kubescape")) + + // TODO: Add more tests with other input types } func TestScanInfoFormats(t *testing.T) { @@ -71,3 +77,30 @@ func TestScanInfoFormats(t *testing.T) { }) } } + +func TestGetScanningContextWithFile(t *testing.T) { + // Test with a file + dir, err := os.MkdirTemp("", "example") + if err != nil { + t.Fatal(err) + } + defer os.RemoveAll(dir) + + filePath := filepath.Join(dir, "file.txt") + if _, err := os.Create(filePath); err != nil { + t.Fatal(err) + } + + assert.Equal(t, ContextFile, GetScanningContext(filePath)) +} + +func TestGetScanningContextWithDir(t *testing.T) { + // Test with a directory + dir, err := os.MkdirTemp("", "example") + if err != nil { + t.Fatal(err) + } + defer os.RemoveAll(dir) + + assert.Equal(t, ContextDir, GetScanningContext(dir)) +} diff --git a/core/cautils/versioncheck.go b/core/cautils/versioncheck.go index 420d2e38..b2ab4b27 100644 --- a/core/cautils/versioncheck.go +++ b/core/cautils/versioncheck.go @@ -31,7 +31,7 @@ type IVersionCheckHandler interface { func NewIVersionCheckHandler(ctx context.Context) IVersionCheckHandler { if BuildNumber == "" { - logger.L().Ctx(ctx).Warning("Unknown build number, this might affect your scan results. Please make sure you are updated to latest version") + logger.L().Ctx(ctx).Warning("Unknown build number, this might affect your scan results. Please make sure that you are running the latest version") } if v, ok := os.LookupEnv(CLIENT_ENV); ok && v != "" { diff --git a/core/core/cachedconfig.go b/core/core/cachedconfig.go index 22ee9a94..b1514eae 100644 --- a/core/core/cachedconfig.go +++ b/core/core/cachedconfig.go @@ -4,47 +4,35 @@ import ( "context" "fmt" + "github.com/kubescape/kubescape/v2/core/cautils" metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" ) func (ks *Kubescape) SetCachedConfig(setConfig *metav1.SetConfig) error { - - tenant := getTenantConfig(nil, "", "", nil) + tenant := cautils.GetTenantConfig("", "", "", nil) if setConfig.Account != "" { tenant.GetConfigObj().AccountID = setConfig.Account } - if setConfig.SecretKey != "" { - tenant.GetConfigObj().SecretKey = setConfig.SecretKey - } - if setConfig.ClientID != "" { - tenant.GetConfigObj().ClientID = setConfig.ClientID - } if setConfig.CloudAPIURL != "" { tenant.GetConfigObj().CloudAPIURL = setConfig.CloudAPIURL } - if setConfig.CloudAuthURL != "" { - tenant.GetConfigObj().CloudAuthURL = setConfig.CloudAuthURL - } if setConfig.CloudReportURL != "" { tenant.GetConfigObj().CloudReportURL = setConfig.CloudReportURL } - if setConfig.CloudUIURL != "" { - tenant.GetConfigObj().CloudUIURL = setConfig.CloudUIURL - } return tenant.UpdateCachedConfig() } // View cached configurations func (ks *Kubescape) ViewCachedConfig(viewConfig *metav1.ViewConfig) error { - tenant := getTenantConfig(nil, "", "", getKubernetesApi()) // change k8sinterface + tenant := cautils.GetTenantConfig("", "", "", getKubernetesApi()) // change k8sinterface fmt.Fprintf(viewConfig.Writer, "%s\n", tenant.GetConfigObj().Config()) return nil } func (ks *Kubescape) DeleteCachedConfig(ctx context.Context, deleteConfig *metav1.DeleteConfig) error { - tenant := getTenantConfig(nil, "", "", nil) // change k8sinterface + tenant := cautils.GetTenantConfig("", "", "", nil) // change k8sinterface return tenant.DeleteCachedConfig(ctx) } diff --git a/core/core/delete.go b/core/core/delete.go deleted file mode 100644 index 53fc774f..00000000 --- a/core/core/delete.go +++ /dev/null @@ -1,36 +0,0 @@ -package core - -import ( - "fmt" - - logger "github.com/kubescape/go-logger" - "github.com/kubescape/go-logger/helpers" - "github.com/kubescape/kubescape/v2/core/cautils/getter" - v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" -) - -func (ks *Kubescape) DeleteExceptions(delExceptions *v1.DeleteExceptions) error { - - // load cached config - getTenantConfig(&delExceptions.Credentials, "", "", getKubernetesApi()) - - // login kubescape SaaS - ksCloudAPI := getter.GetKSCloudAPIConnector() - if err := ksCloudAPI.Login(); err != nil { - return err - } - - for i := range delExceptions.Exceptions { - exceptionName := delExceptions.Exceptions[i] - if exceptionName == "" { - continue - } - logger.L().Info("Deleting exception", helpers.String("name", exceptionName)) - if err := ksCloudAPI.DeleteException(exceptionName); err != nil { - return fmt.Errorf("failed to delete exception '%s', reason: %s", exceptionName, err.Error()) - } - logger.L().Success("Exception deleted successfully") - } - - return nil -} diff --git a/core/core/download.go b/core/core/download.go index ad50719d..7319d63e 100644 --- a/core/core/download.go +++ b/core/core/download.go @@ -9,6 +9,7 @@ import ( logger "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/cautils/getter" metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" ) @@ -91,7 +92,7 @@ func downloadArtifacts(ctx context.Context, downloadInfo *metav1.DownloadInfo) e } func downloadConfigInputs(ctx context.Context, downloadInfo *metav1.DownloadInfo) error { - tenant := getTenantConfig(&downloadInfo.Credentials, "", "", getKubernetesApi()) + tenant := cautils.GetTenantConfig(downloadInfo.AccountID, "", "", getKubernetesApi()) controlsInputsGetter := getConfigInputsGetter(ctx, downloadInfo.Identifier, tenant.GetAccountID(), nil) controlInputs, err := controlsInputsGetter.GetControlsInputs(tenant.GetContextName()) @@ -114,7 +115,7 @@ func downloadConfigInputs(ctx context.Context, downloadInfo *metav1.DownloadInfo } func downloadExceptions(ctx context.Context, downloadInfo *metav1.DownloadInfo) error { - tenant := getTenantConfig(&downloadInfo.Credentials, "", "", getKubernetesApi()) + tenant := cautils.GetTenantConfig(downloadInfo.AccountID, "", "", getKubernetesApi()) exceptionsGetter := getExceptionsGetter(ctx, "", tenant.GetAccountID(), nil) exceptions, err := exceptionsGetter.GetExceptions(tenant.GetContextName()) @@ -136,7 +137,7 @@ func downloadExceptions(ctx context.Context, downloadInfo *metav1.DownloadInfo) func downloadAttackTracks(ctx context.Context, downloadInfo *metav1.DownloadInfo) error { var err error - tenant := getTenantConfig(&downloadInfo.Credentials, "", "", getKubernetesApi()) + tenant := cautils.GetTenantConfig(downloadInfo.AccountID, "", "", getKubernetesApi()) attackTracksGetter := getAttackTracksGetter(ctx, "", tenant.GetAccountID(), nil) @@ -160,9 +161,9 @@ func downloadAttackTracks(ctx context.Context, downloadInfo *metav1.DownloadInfo func downloadFramework(ctx context.Context, downloadInfo *metav1.DownloadInfo) error { - tenant := getTenantConfig(&downloadInfo.Credentials, "", "", getKubernetesApi()) + tenant := cautils.GetTenantConfig(downloadInfo.AccountID, "", "", getKubernetesApi()) - g := getPolicyGetter(ctx, nil, tenant.GetTenantEmail(), true, nil) + g := getPolicyGetter(ctx, nil, tenant.GetAccountID(), true, nil) if downloadInfo.Identifier == "" { // if framework name not specified - download all frameworks @@ -202,9 +203,9 @@ func downloadFramework(ctx context.Context, downloadInfo *metav1.DownloadInfo) e func downloadControl(ctx context.Context, downloadInfo *metav1.DownloadInfo) error { - tenant := getTenantConfig(&downloadInfo.Credentials, "", "", getKubernetesApi()) + tenant := cautils.GetTenantConfig(downloadInfo.AccountID, "", "", getKubernetesApi()) - g := getPolicyGetter(ctx, nil, tenant.GetTenantEmail(), false, nil) + g := getPolicyGetter(ctx, nil, tenant.GetAccountID(), false, nil) if downloadInfo.Identifier == "" { // TODO - support diff --git a/core/core/initutils.go b/core/core/initutils.go index 6085f818..2c73b384 100644 --- a/core/core/initutils.go +++ b/core/core/initutils.go @@ -30,12 +30,6 @@ func getKubernetesApi() *k8sinterface.KubernetesApi { } return k8sinterface.NewKubernetesApi() } -func getTenantConfig(credentials *cautils.Credentials, clusterName string, customClusterName string, k8s *k8sinterface.KubernetesApi) cautils.ITenantConfig { - if !k8sinterface.IsConnectedToCluster() || k8s == nil { - return cautils.NewLocalConfig(getter.GetKSCloudAPIConnector(), credentials, clusterName, customClusterName) - } - return cautils.NewClusterConfig(k8s, getter.GetKSCloudAPIConnector(), credentials, clusterName, customClusterName) -} func getExceptionsGetter(ctx context.Context, useExceptions string, accountID string, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IExceptionsGetter { if useExceptions != "" { @@ -74,7 +68,7 @@ func getReporter(ctx context.Context, tenantConfig cautils.ITenantConfig, report if scanInfo.GetScanningContext() != cautils.ContextCluster { submitData = reporterv2.SubmitContextRepository } - return reporterv2.NewReportEventReceiver(tenantConfig.GetConfigObj(), reportID, submitData) + return reporterv2.NewReportEventReceiver(tenantConfig, reportID, submitData) } if tenantConfig.GetAccountID() == "" { // Add link only when scanning a cluster using a framework @@ -89,7 +83,7 @@ func getReporter(ctx context.Context, tenantConfig cautils.ITenantConfig, report return reporterv2.NewReportMock("", message) } -func getResourceHandler(ctx context.Context, scanInfo *cautils.ScanInfo, tenantConfig cautils.ITenantConfig, k8s *k8sinterface.KubernetesApi, hostSensorHandler hostsensorutils.IHostSensor, registryAdaptors *resourcehandler.RegistryAdaptors) resourcehandler.IResourceHandler { +func getResourceHandler(ctx context.Context, scanInfo *cautils.ScanInfo, tenantConfig cautils.ITenantConfig, k8s *k8sinterface.KubernetesApi, hostSensorHandler hostsensorutils.IHostSensor) resourcehandler.IResourceHandler { ctx, span := otel.Tracer("").Start(ctx, "getResourceHandler") defer span.End() @@ -100,7 +94,7 @@ func getResourceHandler(ctx context.Context, scanInfo *cautils.ScanInfo, tenantC getter.GetKSCloudAPIConnector() rbacObjects := getRBACHandler(tenantConfig, k8s, scanInfo.Submit) - return resourcehandler.NewK8sResourceHandler(k8s, hostSensorHandler, rbacObjects, registryAdaptors) + return resourcehandler.NewK8sResourceHandler(k8s, hostSensorHandler, rbacObjects, tenantConfig.GetContextName()) } // getHostSensorHandler yields a IHostSensor that knows how to collect a host's scanned resources. @@ -153,57 +147,59 @@ func policyIdentifierIdentities(pi []cautils.PolicyIdentifier) string { func setSubmitBehavior(scanInfo *cautils.ScanInfo, tenantConfig cautils.ITenantConfig) { /* + If keep-local OR scan type which is not submittable - Do not send report + If CloudReportURL not set - Do not send report - If There is no account - Do not send report + If CloudReportURL is set + If There is no account - + Generate Account & Submit report - If There is account - - keep-local - Do not send report - Default - Submit report + If There is account - + Invalid Account ID - Do not send report + Valid Account - Submit report */ - if getter.GetKSCloudAPIConnector().GetCloudAPIURL() == "" { + // do not submit control/workload scanning + if !isScanTypeForSubmission(scanInfo.ScanType) || scanInfo.Local { scanInfo.Submit = false return } - // do not submit control scanning - if !scanInfo.FrameworkScan { + if getter.GetKSCloudAPIConnector().GetCloudReportURL() == "" { scanInfo.Submit = false return } - if scanInfo.Local { - scanInfo.Submit = false - return - } - - // do not submit single resource scan to BE - if scanInfo.ScanObject != nil { - scanInfo.Submit = false - return - } - - // If There is no account, or if the account is not legal, do not submit - if _, err := uuid.Parse(tenantConfig.GetAccountID()); err != nil { - scanInfo.Submit = false - } else { + // a new account will be created if a report URL is set and there is no account ID + if tenantConfig.GetAccountID() == "" { scanInfo.Submit = true + return } - if scanInfo.CreateAccount { - scanInfo.Submit = true + _, err := uuid.Parse(tenantConfig.GetAccountID()) + if err != nil { + logger.L().Warning("account is not a valid UUID", helpers.Error(err)) } + // submit if account is valid + scanInfo.Submit = err == nil +} + +func isScanTypeForSubmission(scanType cautils.ScanTypes) bool { + if scanType == cautils.ScanTypeControl || scanType == cautils.ScanTypeWorkload { + return false + } + return true } // setPolicyGetter set the policy getter - local file/github release/Kubescape Cloud API -func getPolicyGetter(ctx context.Context, loadPoliciesFromFile []string, tenantEmail string, frameworkScope bool, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IPolicyGetter { +func getPolicyGetter(ctx context.Context, loadPoliciesFromFile []string, accountID string, frameworkScope bool, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IPolicyGetter { if len(loadPoliciesFromFile) > 0 { return getter.NewLoadPolicy(loadPoliciesFromFile) } - if tenantEmail != "" && getter.GetKSCloudAPIConnector().GetCloudAPIURL() != "" && frameworkScope { + if accountID != "" && getter.GetKSCloudAPIConnector().GetCloudAPIURL() != "" && frameworkScope { g := getter.GetKSCloudAPIConnector() // download policy from Kubescape Cloud backend return g } @@ -277,12 +273,12 @@ func getAttackTracksGetter(ctx context.Context, attackTracks, accountID string, } // getUIPrinter returns a printer that will be used to print to the program’s UI (terminal) -func GetUIPrinter(ctx context.Context, scanInfo *cautils.ScanInfo) printer.IPrinter { +func GetUIPrinter(ctx context.Context, scanInfo *cautils.ScanInfo, clusterName string) printer.IPrinter { var p printer.IPrinter if helpers.ToLevel(logger.L().GetLevel()) >= helpers.WarningLevel { p = &printerv2.SilentPrinter{} } else { - p = printerv2.NewPrettyPrinter(scanInfo.VerboseMode, scanInfo.FormatVersion, scanInfo.PrintAttackTree, cautils.ViewTypes(scanInfo.View), scanInfo.ScanType, scanInfo.InputPatterns) + p = printerv2.NewPrettyPrinter(scanInfo.VerboseMode, scanInfo.FormatVersion, scanInfo.PrintAttackTree, cautils.ViewTypes(scanInfo.View), scanInfo.ScanType, scanInfo.InputPatterns, clusterName) // Since the UI of the program is a CLI (Stdout), it means that it should always print to Stdout p.SetWriter(ctx, os.Stdout.Name()) diff --git a/core/core/initutils_test.go b/core/core/initutils_test.go index c067cd13..333bb9f4 100644 --- a/core/core/initutils_test.go +++ b/core/core/initutils_test.go @@ -88,7 +88,7 @@ func Test_getUIPrinter(t *testing.T) { View: string(tt.args.viewType), } - got := GetUIPrinter(tt.args.ctx, scanInfo) + got := GetUIPrinter(tt.args.ctx, scanInfo, "test-cluster") assert.Equal(t, tt.want.structType, reflect.TypeOf(got).String()) @@ -183,3 +183,49 @@ func TestGetSensorHandler(t *testing.T) { // TODO(fredbi): need to share the k8s client mock to test a happy path / deployment failure path } + +func TestIsScanTypeForSubmission(t *testing.T) { + test := []struct { + name string + scanType cautils.ScanTypes + want bool + }{ + { + name: "cluster scan", + scanType: cautils.ScanTypeCluster, + want: true, + }, + { + name: "repo scan", + scanType: cautils.ScanTypeRepo, + want: true, + }, + { + name: "workload scan", + scanType: cautils.ScanTypeWorkload, + want: false, + }, + { + name: "control scan", + scanType: cautils.ScanTypeControl, + want: false, + }, + { + name: "framework scan", + scanType: cautils.ScanTypeFramework, + want: true, + }, + { + name: "image scan", + scanType: cautils.ScanTypeImage, + want: true, + }, + } + + for _, tt := range test { + t.Run(tt.name, func(t *testing.T) { + got := isScanTypeForSubmission(tt.scanType) + assert.Equal(t, tt.want, got) + }) + } +} diff --git a/core/core/list.go b/core/core/list.go index 99b955b2..edca4ab2 100644 --- a/core/core/list.go +++ b/core/core/list.go @@ -53,22 +53,22 @@ func (ks *Kubescape) List(ctx context.Context, listPolicies *metav1.ListPolicies } func listFrameworks(ctx context.Context, listPolicies *metav1.ListPolicies) ([]string, error) { - tenant := getTenantConfig(&listPolicies.Credentials, "", "", getKubernetesApi()) // change k8sinterface - policyGetter := getPolicyGetter(ctx, nil, tenant.GetTenantEmail(), true, nil) + tenant := cautils.GetTenantConfig(listPolicies.AccountID, "", "", getKubernetesApi()) // change k8sinterface + policyGetter := getPolicyGetter(ctx, nil, tenant.GetAccountID(), true, nil) return listFrameworksNames(policyGetter), nil } func listControls(ctx context.Context, listPolicies *metav1.ListPolicies) ([]string, error) { - tenant := getTenantConfig(&listPolicies.Credentials, "", "", getKubernetesApi()) // change k8sinterface + tenant := cautils.GetTenantConfig(listPolicies.AccountID, "", "", getKubernetesApi()) // change k8sinterface - policyGetter := getPolicyGetter(ctx, nil, tenant.GetTenantEmail(), false, nil) + policyGetter := getPolicyGetter(ctx, nil, tenant.GetAccountID(), false, nil) return policyGetter.ListControls() } func listExceptions(ctx context.Context, listPolicies *metav1.ListPolicies) ([]string, error) { // load tenant metav1 - tenant := getTenantConfig(&listPolicies.Credentials, "", "", getKubernetesApi()) + tenant := cautils.GetTenantConfig(listPolicies.AccountID, "", "", getKubernetesApi()) var exceptionsNames []string ksCloudAPI := getExceptionsGetter(ctx, "", tenant.GetAccountID(), nil) diff --git a/core/core/patch.go b/core/core/patch.go index 21d37707..1b4cc0bc 100644 --- a/core/core/patch.go +++ b/core/core/patch.go @@ -90,8 +90,8 @@ func (ks *Kubescape) Patch(ctx context.Context, patchInfo *ksmetav1.PatchInfo) e var scanInfo cautils.ScanInfo scanInfo.SetScanType(cautils.ScanTypeImage) - outputPrinters := GetOutputPrinters(&scanInfo, ctx) - uiPrinter := GetUIPrinter(ctx, &scanInfo) + outputPrinters := GetOutputPrinters(&scanInfo, ctx, "") + uiPrinter := GetUIPrinter(ctx, &scanInfo, "") resultsHandler := resultshandling.NewResultsHandler(nil, outputPrinters, uiPrinter) resultsHandler.ImageScanData = []cautils.ImageScanData{ { diff --git a/core/core/scan.go b/core/core/scan.go index 67e3ddee..f924378b 100644 --- a/core/core/scan.go +++ b/core/core/scan.go @@ -6,7 +6,6 @@ import ( "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" - "github.com/kubescape/go-logger/iconlogger" "github.com/kubescape/k8s-interface/k8sinterface" "github.com/kubescape/k8s-interface/workloadinterface" "github.com/kubescape/kubescape/v2/core/cautils" @@ -50,23 +49,17 @@ func getInterfaces(ctx context.Context, scanInfo *cautils.ScanInfo) componentInt } // ================== setup tenant object ====================================== - ctxTenant, spanTenant := otel.Tracer("").Start(ctx, "setup tenant") - tenantConfig := getTenantConfig(&scanInfo.Credentials, k8sinterface.GetContextName(), scanInfo.CustomClusterName, k8s) + tenantConfig := cautils.GetTenantConfig(scanInfo.AccountID, k8sinterface.GetContextName(), scanInfo.CustomClusterName, k8s) // Set submit behavior AFTER loading tenant config setSubmitBehavior(scanInfo, tenantConfig) if scanInfo.Submit { // submit - Create tenant & Submit report - if err := tenantConfig.SetTenant(); err != nil { - logger.L().Ctx(ctxTenant).Error(err.Error()) - } - if scanInfo.OmitRawResources { logger.L().Ctx(ctx).Warning("omit-raw-resources flag will be ignored in submit mode") } } - spanTenant.End() // ================== version testing ====================================== @@ -82,13 +75,9 @@ func getInterfaces(ctx context.Context, scanInfo *cautils.ScanInfo) componentInt } spanHostScanner.End() - // ================== setup registry adaptors ====================================== - - registryAdaptors, _ := resourcehandler.NewRegistryAdaptors() - // ================== setup resource collector object ====================================== - resourceHandler := getResourceHandler(ctx, scanInfo, tenantConfig, k8s, hostSensorHandler, registryAdaptors) + resourceHandler := getResourceHandler(ctx, scanInfo, tenantConfig, k8s, hostSensorHandler) // ================== setup reporter & printer objects ====================================== @@ -96,9 +85,9 @@ func getInterfaces(ctx context.Context, scanInfo *cautils.ScanInfo) componentInt reportHandler := getReporter(ctx, tenantConfig, scanInfo.ScanID, scanInfo.Submit, scanInfo.FrameworkScan, *scanInfo) // setup printers - outputPrinters := GetOutputPrinters(scanInfo, ctx) + outputPrinters := GetOutputPrinters(scanInfo, ctx, tenantConfig.GetContextName()) - uiPrinter := GetUIPrinter(ctx, scanInfo) + uiPrinter := GetUIPrinter(ctx, scanInfo, tenantConfig.GetContextName()) // ================== return interface ====================================== @@ -112,12 +101,17 @@ func getInterfaces(ctx context.Context, scanInfo *cautils.ScanInfo) componentInt } } -func GetOutputPrinters(scanInfo *cautils.ScanInfo, ctx context.Context) []printer.IPrinter { +func GetOutputPrinters(scanInfo *cautils.ScanInfo, ctx context.Context, clusterName string) []printer.IPrinter { formats := scanInfo.Formats() outputPrinters := make([]printer.IPrinter, 0) for _, format := range formats { - printerHandler := resultshandling.NewPrinter(ctx, format, scanInfo.FormatVersion, scanInfo.PrintAttackTree, scanInfo.VerboseMode, cautils.ViewTypes(scanInfo.View)) + if !resultshandling.ValidatePrinter(scanInfo.ScanType, format) { + logger.L().Ctx(ctx).Fatal(fmt.Sprintf("Unsupported output format: %s", format)) + continue + } + + printerHandler := resultshandling.NewPrinter(ctx, format, scanInfo.FormatVersion, scanInfo.PrintAttackTree, scanInfo.VerboseMode, cautils.ViewTypes(scanInfo.View), clusterName) printerHandler.SetWriter(ctx, scanInfo.Output) outputPrinters = append(outputPrinters, printerHandler) } @@ -126,23 +120,18 @@ func GetOutputPrinters(scanInfo *cautils.ScanInfo, ctx context.Context) []printe func (ks *Kubescape) Scan(ctx context.Context, scanInfo *cautils.ScanInfo) (*resultshandling.ResultsHandler, error) { ctxInit, spanInit := otel.Tracer("").Start(ctx, "initialization") - logger.InitLogger(iconlogger.LoggerName) logger.L().Start("Kubescape scanner initializing") // ===================== Initialization ===================== scanInfo.Init(ctxInit) // initialize scan info interfaces := getInterfaces(ctxInit, scanInfo) - - cautils.ClusterName = interfaces.tenantConfig.GetContextName() // TODO - Deprecated - cautils.CustomerGUID = interfaces.tenantConfig.GetAccountID() // TODO - Deprecated - interfaces.report.SetClusterName(interfaces.tenantConfig.GetContextName()) - interfaces.report.SetCustomerGUID(interfaces.tenantConfig.GetAccountID()) + interfaces.report.SetTenantConfig(interfaces.tenantConfig) downloadReleasedPolicy := getter.NewDownloadReleasedPolicy() // download config inputs from github release // set policy getter only after setting the customerGUID - scanInfo.Getters.PolicyGetter = getPolicyGetter(ctxInit, scanInfo.UseFrom, interfaces.tenantConfig.GetTenantEmail(), scanInfo.FrameworkScan, downloadReleasedPolicy) + scanInfo.Getters.PolicyGetter = getPolicyGetter(ctxInit, scanInfo.UseFrom, interfaces.tenantConfig.GetAccountID(), scanInfo.FrameworkScan, downloadReleasedPolicy) scanInfo.Getters.ControlsInputsGetter = getConfigInputsGetter(ctxInit, scanInfo.ControlsInputs, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) scanInfo.Getters.ExceptionsGetter = getExceptionsGetter(ctxInit, scanInfo.UseExceptions, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) scanInfo.Getters.AttackTracksGetter = getAttackTracksGetter(ctxInit, scanInfo.AttackTracks, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) @@ -165,7 +154,7 @@ func (ks *Kubescape) Scan(ctx context.Context, scanInfo *cautils.ScanInfo) (*res // ===================== policies ===================== ctxPolicies, spanPolicies := otel.Tracer("").Start(ctxInit, "policies") - policyHandler := policyhandler.NewPolicyHandler() + policyHandler := policyhandler.NewPolicyHandler(interfaces.tenantConfig.GetContextName()) scanData, err := policyHandler.CollectPolicies(ctxPolicies, scanInfo.PolicyIdentifier, scanInfo) if err != nil { spanInit.End() @@ -188,8 +177,8 @@ func (ks *Kubescape) Scan(ctx context.Context, scanInfo *cautils.ScanInfo) (*res defer spanOpa.End() deps := resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), interfaces.tenantConfig.GetContextName()) - reportResults := opaprocessor.NewOPAProcessor(scanData, deps) - if err := reportResults.ProcessRulesListener(ctxOpa, cautils.NewProgressHandler(""), scanInfo); err != nil { + reportResults := opaprocessor.NewOPAProcessor(scanData, deps, interfaces.tenantConfig.GetContextName()) + if err = reportResults.ProcessRulesListener(ctxOpa, cautils.NewProgressHandler(""), scanInfo); err != nil { // TODO - do something return resultsHandling, fmt.Errorf("%w", err) } diff --git a/core/core/submit.go b/core/core/submit.go deleted file mode 100644 index 1f5fa708..00000000 --- a/core/core/submit.go +++ /dev/null @@ -1,68 +0,0 @@ -package core - -import ( - "context" - - "github.com/kubescape/kubescape/v2/core/cautils" - "github.com/kubescape/kubescape/v2/core/cautils/getter" - "github.com/kubescape/kubescape/v2/core/meta/cliinterfaces" - - logger "github.com/kubescape/go-logger" - "github.com/kubescape/go-logger/helpers" -) - -func (ks *Kubescape) Submit(ctx context.Context, submitInterfaces cliinterfaces.SubmitInterfaces) error { - - // list resources - report, err := submitInterfaces.SubmitObjects.SetResourcesReport() - if err != nil { - return err - } - allresources, err := submitInterfaces.SubmitObjects.ListAllResources() - if err != nil { - return err - } - // report - o := &cautils.OPASessionObj{ - Report: report, - AllResources: allresources, - Metadata: &report.Metadata, - } - if err := submitInterfaces.Reporter.Submit(ctx, o); err != nil { - return err - } - logger.L().Success("Data has been submitted successfully") - submitInterfaces.Reporter.DisplayReportURL() - - return nil -} - -func (ks *Kubescape) SubmitExceptions(ctx context.Context, credentials *cautils.Credentials, excPath string) error { - logger.L().Info("submitting exceptions", helpers.String("path", excPath)) - - // load cached config - tenantConfig := getTenantConfig(credentials, "", "", getKubernetesApi()) - if err := tenantConfig.SetTenant(); err != nil { - logger.L().Ctx(ctx).Warning("failed setting account ID", helpers.Error(err)) - } - - // load exceptions from file - loader := getter.NewLoadPolicy([]string{excPath}) - exceptions, err := loader.GetExceptions("") - if err != nil { - return err - } - - // login kubescape SaaS - ksCloudAPI := getter.GetKSCloudAPIConnector() - if err := ksCloudAPI.Login(); err != nil { - return err - } - - if err := ksCloudAPI.PostExceptions(exceptions); err != nil { - return err - } - logger.L().Success("Exceptions submitted successfully") - - return nil -} diff --git a/core/meta/datastructures/v1/config.go b/core/meta/datastructures/v1/config.go index 70573b45..0eeaaed7 100644 --- a/core/meta/datastructures/v1/config.go +++ b/core/meta/datastructures/v1/config.go @@ -4,12 +4,8 @@ import "io" type SetConfig struct { Account string - ClientID string - SecretKey string CloudReportURL string CloudAPIURL string - CloudUIURL string - CloudAuthURL string } type ViewConfig struct { diff --git a/core/meta/datastructures/v1/delete.go b/core/meta/datastructures/v1/delete.go deleted file mode 100644 index b3c72d9d..00000000 --- a/core/meta/datastructures/v1/delete.go +++ /dev/null @@ -1,8 +0,0 @@ -package v1 - -import "github.com/kubescape/kubescape/v2/core/cautils" - -type DeleteExceptions struct { - Credentials cautils.Credentials - Exceptions []string -} diff --git a/core/meta/datastructures/v1/download.go b/core/meta/datastructures/v1/download.go index b51a8342..a4680756 100644 --- a/core/meta/datastructures/v1/download.go +++ b/core/meta/datastructures/v1/download.go @@ -1,11 +1,9 @@ package v1 -import "github.com/kubescape/kubescape/v2/core/cautils" - type DownloadInfo struct { - Path string // directory to save artifact. Default is "~/.kubescape/" - FileName string // can be empty - Target string // type of artifact to download - Identifier string // identifier of artifact to download - Credentials cautils.Credentials + Path string // directory to save artifact. Default is "~/.kubescape/" + FileName string // can be empty + Target string // type of artifact to download + Identifier string // identifier of artifact to download + AccountID string } diff --git a/core/meta/datastructures/v1/listpolicies.go b/core/meta/datastructures/v1/listpolicies.go index 4166b46f..79b3471f 100644 --- a/core/meta/datastructures/v1/listpolicies.go +++ b/core/meta/datastructures/v1/listpolicies.go @@ -1,11 +1,9 @@ package v1 -import "github.com/kubescape/kubescape/v2/core/cautils" - type ListPolicies struct { - Target string - Format string - Credentials cautils.Credentials + Target string + Format string + AccountID string } type ListResponse struct { diff --git a/core/meta/datastructures/v1/submit.go b/core/meta/datastructures/v1/submit.go index 20ec27cd..8d8dab7f 100644 --- a/core/meta/datastructures/v1/submit.go +++ b/core/meta/datastructures/v1/submit.go @@ -1,11 +1,9 @@ package v1 -import "github.com/kubescape/kubescape/v2/core/cautils" - type Submit struct { - Credentials cautils.Credentials + AccountID string } type Delete struct { - Credentials cautils.Credentials + AccountID string } diff --git a/core/meta/ksinterface.go b/core/meta/ksinterface.go index da298fb3..792dd788 100644 --- a/core/meta/ksinterface.go +++ b/core/meta/ksinterface.go @@ -4,7 +4,6 @@ import ( "context" "github.com/kubescape/kubescape/v2/core/cautils" - "github.com/kubescape/kubescape/v2/core/meta/cliinterfaces" metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/kubescape/kubescape/v2/core/pkg/resultshandling" ) @@ -16,18 +15,11 @@ type IKubescape interface { List(ctx context.Context, listPolicies *metav1.ListPolicies) error // TODO - return list response Download(ctx context.Context, downloadInfo *metav1.DownloadInfo) error // TODO - return downloaded policies - // submit - Submit(ctx context.Context, submitInterfaces cliinterfaces.SubmitInterfaces) error // TODO - func should receive object - SubmitExceptions(ctx context.Context, credentials *cautils.Credentials, excPath string) error // TODO - remove - // config SetCachedConfig(setConfig *metav1.SetConfig) error ViewCachedConfig(viewConfig *metav1.ViewConfig) error DeleteCachedConfig(ctx context.Context, deleteConfig *metav1.DeleteConfig) error - // delete - DeleteExceptions(deleteexceptions *metav1.DeleteExceptions) error - // fix Fix(ctx context.Context, fixInfo *metav1.FixInfo) error diff --git a/core/pkg/opaprocessor/processorhandler.go b/core/pkg/opaprocessor/processorhandler.go index 5a103e55..a17a4c1a 100644 --- a/core/pkg/opaprocessor/processorhandler.go +++ b/core/pkg/opaprocessor/processorhandler.go @@ -31,19 +31,15 @@ type IJobProgressNotificationClient interface { Stop() } -const ( - heuristicAllocResources = 100 - heuristicAllocControls = 100 -) - // OPAProcessor processes Open Policy Agent rules. type OPAProcessor struct { + clusterName string regoDependenciesData *resources.RegoDependenciesData *cautils.OPASessionObj opaRegisterOnce sync.Once } -func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *resources.RegoDependenciesData) *OPAProcessor { +func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *resources.RegoDependenciesData, clusterName string) *OPAProcessor { if regoDependenciesData != nil && sessionObj != nil { regoDependenciesData.PostureControlInputs = sessionObj.RegoInputData.PostureControlInputs regoDependenciesData.DataControlInputs = sessionObj.RegoInputData.DataControlInputs @@ -52,6 +48,7 @@ func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *re return &OPAProcessor{ OPASessionObj: sessionObj, regoDependenciesData: regoDependenciesData, + clusterName: clusterName, } } @@ -122,7 +119,7 @@ func (opap *OPAProcessor) Process(ctx context.Context, policies *cautils.Policie func (opap *OPAProcessor) loggerStartScanning() { targetScan := opap.OPASessionObj.Metadata.ScanMetadata.ScanningTarget if reporthandlingv2.Cluster == targetScan { - logger.L().Start("Scanning", helpers.String(targetScan.String(), cautils.ClusterName)) + logger.L().Start("Scanning", helpers.String(targetScan.String(), opap.clusterName)) } else { logger.L().Start("Scanning " + targetScan.String()) } @@ -131,7 +128,7 @@ func (opap *OPAProcessor) loggerStartScanning() { func (opap *OPAProcessor) loggerDoneScanning() { targetScan := opap.OPASessionObj.Metadata.ScanMetadata.ScanningTarget if reporthandlingv2.Cluster == targetScan { - logger.L().StopSuccess("Done scanning", helpers.String(targetScan.String(), cautils.ClusterName)) + logger.L().StopSuccess("Done scanning", helpers.String(targetScan.String(), opap.clusterName)) } else { logger.L().StopSuccess("Done scanning " + targetScan.String()) } @@ -241,23 +238,14 @@ func (opap *OPAProcessor) processRule(ctx context.Context, rule *reporthandling. } ruleResult.SetStatus(apis.StatusFailed, nil) - for _, failedPath := range ruleResponse.FailedPaths { - ruleResult.Paths = append(ruleResult.Paths, armotypes.PosturePaths{FailedPath: failedPath}) - } - - for _, fixPath := range ruleResponse.FixPaths { - ruleResult.Paths = append(ruleResult.Paths, armotypes.PosturePaths{FixPath: fixPath}) - } - - if ruleResponse.FixCommand != "" { - ruleResult.Paths = append(ruleResult.Paths, armotypes.PosturePaths{FixCommand: ruleResponse.FixCommand}) - } + ruleResult.Paths = appendPaths(ruleResult.Paths, ruleResponse.FailedPaths, ruleResponse.FixPaths, ruleResponse.FixCommand, failedResource.GetID()) // if ruleResponse has relatedObjects, add it to ruleResult if len(ruleResponse.RelatedObjects) > 0 { for _, relatedObject := range ruleResponse.RelatedObjects { wl := objectsenvelopes.NewObject(relatedObject.Object) if wl != nil { ruleResult.RelatedResourcesIDs = append(ruleResult.RelatedResourcesIDs, wl.GetID()) + ruleResult.Paths = appendPaths(ruleResult.Paths, relatedObject.FailedPaths, relatedObject.FixPaths, relatedObject.FixCommand, wl.GetID()) } } } @@ -269,6 +257,20 @@ func (opap *OPAProcessor) processRule(ctx context.Context, rule *reporthandling. return resources, nil } +// appendPaths appends the failedPaths, fixPaths and fixCommand to the paths slice with the resourceID +func appendPaths(paths []armotypes.PosturePaths, failedPaths []string, fixPaths []armotypes.FixPath, fixCommand string, resourceID string) []armotypes.PosturePaths { + for _, failedPath := range failedPaths { + paths = append(paths, armotypes.PosturePaths{ResourceID: resourceID, FailedPath: failedPath}) + } + for _, fixPath := range fixPaths { + paths = append(paths, armotypes.PosturePaths{ResourceID: resourceID, FixPath: fixPath}) + } + if fixCommand != "" { + paths = append(paths, armotypes.PosturePaths{ResourceID: resourceID, FixCommand: fixCommand}) + } + return paths +} + func (opap *OPAProcessor) runOPAOnSingleRule(ctx context.Context, rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}, getRuleData func(*reporthandling.PolicyRule) string, ruleRegoDependenciesData resources.RegoDependenciesData) ([]reporthandling.RuleResponse, error) { switch rule.RuleLanguage { case reporthandling.RegoLanguage, reporthandling.RegoLanguage2: @@ -374,11 +376,3 @@ func (opap *OPAProcessor) makeRegoDeps(configInputs []string, fixedControlInputs PostureControlInputs: postureControlInputs, } } - -func max(a, b int) int { - if a > b { - return a - } - - return b -} diff --git a/core/pkg/opaprocessor/processorhandler_test.go b/core/pkg/opaprocessor/processorhandler_test.go index cffa0eb3..8e069b5d 100644 --- a/core/pkg/opaprocessor/processorhandler_test.go +++ b/core/pkg/opaprocessor/processorhandler_test.go @@ -8,6 +8,7 @@ import ( "fmt" "io" "os" + "reflect" "runtime" "testing" "time" @@ -192,7 +193,7 @@ func TestProcessResourcesResult(t *testing.T) { opaSessionObj.K8SResources = k8sResources opaSessionObj.AllResources[deployment.GetID()] = deployment - opap := NewOPAProcessor(opaSessionObj, resources.NewRegoDependenciesDataMock()) + opap := NewOPAProcessor(opaSessionObj, resources.NewRegoDependenciesDataMock(), "test") opap.AllPolicies = policies opap.Process(context.TODO(), policies, nil) @@ -306,8 +307,10 @@ func TestProcessRule(t *testing.T) { ControlConfigurations: map[string][]string{}, Status: "failed", SubStatus: "", - Paths: nil, - Exception: nil, + Paths: []armotypes.PosturePaths{ + {ResourceID: "/v1/default/Service/fake-service-1", FailedPath: "spec.type"}, + }, + Exception: nil, RelatedResourcesIDs: []string{ "/v1/default/Service/fake-service-1", }, @@ -333,3 +336,74 @@ func TestProcessRule(t *testing.T) { assert.Equal(t, tc.expectedResult, resources) } } + +func TestAppendPaths(t *testing.T) { + tests := []struct { + name string + paths []armotypes.PosturePaths + failedPaths []string + fixPaths []armotypes.FixPath + fixCommand string + resourceID string + expected []armotypes.PosturePaths + }{ + { + name: "Only FailedPaths", + paths: []armotypes.PosturePaths{{ResourceID: "1", FailedPath: "path1"}}, + failedPaths: []string{"path2", "path3"}, + resourceID: "2", + expected: []armotypes.PosturePaths{ + {ResourceID: "1", FailedPath: "path1"}, + {ResourceID: "2", FailedPath: "path2"}, + {ResourceID: "2", FailedPath: "path3"}, + }, + }, + { + name: "Only FixPaths", + paths: []armotypes.PosturePaths{}, + fixPaths: []armotypes.FixPath{ + {Path: "path2", Value: "command2"}, + {Path: "path3", Value: "command3"}, + }, + resourceID: "2", + expected: []armotypes.PosturePaths{ + {ResourceID: "2", FixPath: armotypes.FixPath{Path: "path2", Value: "command2"}}, + {ResourceID: "2", FixPath: armotypes.FixPath{Path: "path3", Value: "command3"}}, + }, + }, + { + name: "Only FixCommand", + paths: []armotypes.PosturePaths{}, + fixCommand: "fix command", + resourceID: "2", + expected: []armotypes.PosturePaths{ + {ResourceID: "2", FixCommand: "fix command"}, + }, + }, + { + name: "All types of paths", + paths: []armotypes.PosturePaths{{ResourceID: "1", FailedPath: "path1"}}, + failedPaths: []string{"path2"}, + fixPaths: []armotypes.FixPath{ + {Path: "path3", Value: "command3"}, + }, + fixCommand: "fix command", + resourceID: "2", + expected: []armotypes.PosturePaths{ + {ResourceID: "1", FailedPath: "path1"}, + {ResourceID: "2", FailedPath: "path2"}, + {ResourceID: "2", FixPath: armotypes.FixPath{Path: "path3", Value: "command3"}}, + {ResourceID: "2", FixCommand: "fix command"}, + }, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + result := appendPaths(tt.paths, tt.failedPaths, tt.fixPaths, tt.fixCommand, tt.resourceID) + if !reflect.DeepEqual(result, tt.expected) { + t.Errorf("Expected %v, but got %v", tt.expected, result) + } + }) + } +} diff --git a/core/pkg/opaprocessor/processorhandlerutils.go b/core/pkg/opaprocessor/processorhandlerutils.go index f7dd30d0..4f2f183b 100644 --- a/core/pkg/opaprocessor/processorhandlerutils.go +++ b/core/pkg/opaprocessor/processorhandlerutils.go @@ -50,7 +50,7 @@ func (opap *OPAProcessor) updateResults(ctx context.Context) { t.SetExceptions( resource, opap.Exceptions, - cautils.ClusterName, + opap.clusterName, opap.AllPolicies.Controls, // update status depending on action required resourcesresults.WithExceptionsProcessor(processor), ) diff --git a/core/pkg/policyhandler/handlepullpolicies.go b/core/pkg/policyhandler/handlepullpolicies.go index fc55ba7d..d873559b 100644 --- a/core/pkg/policyhandler/handlepullpolicies.go +++ b/core/pkg/policyhandler/handlepullpolicies.go @@ -24,6 +24,7 @@ var policyHandlerInstance *PolicyHandler // PolicyHandler type PolicyHandler struct { + clusterName string getters *cautils.Getters cachedPolicyIdentifiers *TimedCache[[]string] cachedFrameworks *TimedCache[[]reporthandling.Framework] @@ -33,10 +34,11 @@ type PolicyHandler struct { // NewPolicyHandler creates and returns an instance of the `PolicyHandler`. The function initializes the `PolicyHandler` only if it hasn't been previously created. // The PolicyHandler supports caching of downloaded policies and exceptions by setting the `POLICIES_CACHE_TTL` environment variable (default is no caching). -func NewPolicyHandler() *PolicyHandler { +func NewPolicyHandler(clusterName string) *PolicyHandler { if policyHandlerInstance == nil { cacheTtl := getPoliciesCacheTtl() policyHandlerInstance = &PolicyHandler{ + clusterName: clusterName, cachedPolicyIdentifiers: NewTimedCache[[]string](cacheTtl), cachedFrameworks: NewTimedCache[[]reporthandling.Framework](cacheTtl), cachedExceptions: NewTimedCache[[]armotypes.PostureExceptionPolicy](cacheTtl), @@ -194,7 +196,7 @@ func (policyHandler *PolicyHandler) getExceptions() ([]armotypes.PostureExceptio return cachedExceptions, nil } - exceptions, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.ClusterName) + exceptions, err := policyHandler.getters.ExceptionsGetter.GetExceptions(policyHandler.clusterName) if err == nil { policyHandler.cachedExceptions.Set(exceptions) } @@ -208,7 +210,7 @@ func (policyHandler *PolicyHandler) getControlInputs() (map[string][]string, err return cachedControlInputs, nil } - controlInputs, err := policyHandler.getters.ControlsInputsGetter.GetControlsInputs(cautils.ClusterName) + controlInputs, err := policyHandler.getters.ControlsInputsGetter.GetControlsInputs(policyHandler.clusterName) if err == nil { policyHandler.cachedControlInputs.Set(controlInputs) } diff --git a/core/pkg/registryadaptors/README.md b/core/pkg/registryadaptors/README.md deleted file mode 100644 index 7d8eeb10..00000000 --- a/core/pkg/registryadaptors/README.md +++ /dev/null @@ -1,39 +0,0 @@ -# Integrate With Vulnerability Server - -There are some controls that check the relation between the kubernetes manifest and vulnerabilities. -For these controls to work properly, it is necessary to -## Supported Servers -* Armosec - -# Integrate With Armosec Server - -1. Navigate to the [armosec.io](https://cloud.armosec.io?utm_source=github&utm_medium=repository) -2. Click Profile(top right icon)->"User Management"->"API Tokens" and Generate a token -3. Copy the clientID and secretKey and run: -``` -kubescape config set clientID <> -``` -``` -kubescape config set secretKey <> -``` -4. Confirm the keys are set -``` -kubescape config view -``` -Expecting: -``` -{ - "accountID": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "clientID": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "secretKey": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" -} -``` -> **Note** -> If you are missing the `accountID` field, set it by running `kubescape config set accountID <>` - -For CICD, set environments variables as following: -``` -KS_ACCOUNT_ID // account id -KS_CLIENT_ID // client id -KS_SECRET_KEY // access key -``` \ No newline at end of file diff --git a/core/pkg/registryadaptors/armosec/v1/civksadaptor.go b/core/pkg/registryadaptors/armosec/v1/civksadaptor.go deleted file mode 100644 index a72a1a67..00000000 --- a/core/pkg/registryadaptors/armosec/v1/civksadaptor.go +++ /dev/null @@ -1,100 +0,0 @@ -package v1 - -import ( - "encoding/json" - "fmt" - - logger "github.com/kubescape/go-logger" - "github.com/kubescape/go-logger/helpers" - "github.com/kubescape/kubescape/v2/core/cautils/getter" - "github.com/kubescape/kubescape/v2/core/pkg/containerscan" - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" -) - -func NewKSAdaptor(api *getter.KSCloudAPI) *KSCivAdaptor { - return &KSCivAdaptor{ - ksCloudAPI: api, - } -} - -func (ksCivAdaptor *KSCivAdaptor) Login() error { - if ksCivAdaptor.ksCloudAPI.IsLoggedIn() { - return nil - } - return ksCivAdaptor.ksCloudAPI.Login() -} -func (ksCivAdaptor *KSCivAdaptor) GetImagesVulnerabilities(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageVulnerabilityReport, error) { - resultList := make([]registryvulnerabilities.ContainerImageVulnerabilityReport, 0) - for _, toPin := range imageIDs { - imageID := toPin - result, err := ksCivAdaptor.GetImageVulnerability(&imageID) - if err != nil { - logger.L().Debug("failed to get image vulnerabilities", helpers.String("image", imageID.Tag), helpers.Error(err)) - continue - } - - resultList = append(resultList, *result) - } - - return resultList, nil -} - -func (ksCivAdaptor *KSCivAdaptor) GetImageVulnerability(imageID *registryvulnerabilities.ContainerImageIdentifier) (*registryvulnerabilities.ContainerImageVulnerabilityReport, error) { - // First - containerScanId, err := ksCivAdaptor.getImageLastScanId(imageID) - if err != nil { - return nil, err - } - if containerScanId == "" { - return nil, fmt.Errorf("last scan ID is empty") - } - - filter := []map[string]string{{"containersScanID": containerScanId}} - pageSize := 300 - pageNumber := 1 - request := V2ListRequest{PageSize: &pageSize, PageNum: &pageNumber, InnerFilters: filter, OrderBy: "timestamp:desc"} - requestBody, _ := json.Marshal(request) - requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsDetails?customerGUID=%s", ksCivAdaptor.ksCloudAPI.GetCloudAPIURL(), ksCivAdaptor.ksCloudAPI.GetAccountID()) - - resp, err := ksCivAdaptor.ksCloudAPI.Post(requestUrl, map[string]string{"Content-Type": "application/json"}, requestBody) - if err != nil { - return nil, err - } - - scanDetailsResult := struct { - Total struct { - Value int `json:"value"` - Relation string `json:"relation"` - } `json:"total"` - Response containerscan.VulnerabilitiesList `json:"response"` - Cursor string `json:"cursor"` - }{} - - err = json.Unmarshal([]byte(resp), &scanDetailsResult) - if err != nil { - return nil, err - } - - vulnerabilities := responseObjectToVulnerabilities(scanDetailsResult.Response) - - resultImageVulnerabilityReport := registryvulnerabilities.ContainerImageVulnerabilityReport{ - ImageID: *imageID, - Vulnerabilities: vulnerabilities, - } - - return &resultImageVulnerabilityReport, nil -} - -func (ksCivAdaptor *KSCivAdaptor) DescribeAdaptor() string { - return "armo image vulnerabilities scanner, docs: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities" -} - -func (ksCivAdaptor *KSCivAdaptor) GetImagesInformation(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageInformation, error) { - // TODO - return []registryvulnerabilities.ContainerImageInformation{}, nil -} - -func (ksCivAdaptor *KSCivAdaptor) GetImagesScanStatus(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageScanStatus, error) { - // TODO - return []registryvulnerabilities.ContainerImageScanStatus{}, nil -} diff --git a/core/pkg/registryadaptors/armosec/v1/civksadaptor_test.go b/core/pkg/registryadaptors/armosec/v1/civksadaptor_test.go deleted file mode 100644 index cd83a94f..00000000 --- a/core/pkg/registryadaptors/armosec/v1/civksadaptor_test.go +++ /dev/null @@ -1,23 +0,0 @@ -package v1 - -import ( - "testing" - - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" - "github.com/stretchr/testify/assert" -) - -func TestSum(t *testing.T) { - var err error - var adaptor registryvulnerabilities.IContainerImageVulnerabilityAdaptor - - adaptor, err = NewArmoAdaptorMock() - assert.NoError(t, err) - - assert.NoError(t, adaptor.Login()) - - imageVulnerabilityReport, err := adaptor.GetImageVulnerability(®istryvulnerabilities.ContainerImageIdentifier{Tag: "gke.gcr.io/gcp-compute-persistent-disk-csi-driver:v1.3.4-gke.0"}) - assert.NoError(t, err) - - assert.Equal(t, 25, len(imageVulnerabilityReport.Vulnerabilities)) -} diff --git a/core/pkg/registryadaptors/armosec/v1/civksadaptormock.go b/core/pkg/registryadaptors/armosec/v1/civksadaptormock.go deleted file mode 100644 index fcf598c1..00000000 --- a/core/pkg/registryadaptors/armosec/v1/civksadaptormock.go +++ /dev/null @@ -1,67 +0,0 @@ -package v1 - -import ( - "encoding/json" - - "github.com/kubescape/kubescape/v2/core/pkg/containerscan" - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" -) - -type ArmoCivAdaptorMock struct { - resultList *registryvulnerabilities.ContainerImageVulnerabilityReport -} - -func NewArmoAdaptorMock() (*ArmoCivAdaptorMock, error) { - scanDetailsResult := struct { - Total struct { - Value int `json:"value"` - Relation string `json:"relation"` - } `json:"total"` - Response containerscan.VulnerabilitiesList `json:"response"` - Cursor string `json:"cursor"` - }{} - - if err := json.Unmarshal([]byte(minikubeReponseMock), &scanDetailsResult); err != nil { - return nil, err - } - - vulnerabilities := responseObjectToVulnerabilities(scanDetailsResult.Response) - - resultImageVulnerabilityReport := registryvulnerabilities.ContainerImageVulnerabilityReport{ - ImageID: registryvulnerabilities.ContainerImageIdentifier{Tag: vulnerabilities[0].Name}, - Vulnerabilities: vulnerabilities, - } - return &ArmoCivAdaptorMock{resultList: &resultImageVulnerabilityReport}, nil -} - -func (armoCivAdaptorMock *ArmoCivAdaptorMock) Login() error { - return nil -} -func (armoCivAdaptorMock *ArmoCivAdaptorMock) GetImagesVulnerabilities(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageVulnerabilityReport, error) { - return []registryvulnerabilities.ContainerImageVulnerabilityReport{*armoCivAdaptorMock.resultList}, nil -} - -func (armoCivAdaptorMock *ArmoCivAdaptorMock) GetImageVulnerability(imageID *registryvulnerabilities.ContainerImageIdentifier) (*registryvulnerabilities.ContainerImageVulnerabilityReport, error) { - return armoCivAdaptorMock.resultList, nil -} - -func (armoCivAdaptorMock *ArmoCivAdaptorMock) DescribeAdaptor() string { - // TODO - return "" -} - -func (armoCivAdaptorMock *ArmoCivAdaptorMock) GetImagesInformation(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageInformation, error) { - // TODO - return []registryvulnerabilities.ContainerImageInformation{}, nil -} - -func (armoCivAdaptorMock *ArmoCivAdaptorMock) GetImagesScanStatus(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageScanStatus, error) { - // TODO - return []registryvulnerabilities.ContainerImageScanStatus{}, nil -} - -//============================================================================================================================== -//============================================================================================================================== -//============================================================================================================================== - -var minikubeReponseMock = `{"total":{"value":73,"relation":"eq"},"response":[{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2005-2541","https://security-tracker.debian.org/tracker/CVE-2005-2541"],"name":"CVE-2005-2541","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"tar","packageVersion":"1.30+dfsg-6","link":"https://nvd.nist.gov/vuln/detail/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2007-5686","https://security-tracker.debian.org/tracker/CVE-2007-5686"],"name":"CVE-2007-5686","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"login","packageVersion":"1:4.5-1.1","link":"https://nvd.nist.gov/vuln/detail/CVE-2007-5686","description":"initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2007-6755","https://security-tracker.debian.org/tracker/CVE-2007-6755"],"name":"CVE-2007-6755","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libssl1.1","packageVersion":"1.1.1d-0+deb10u6","link":"https://nvd.nist.gov/vuln/detail/CVE-2007-6755","description":"The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2010-0928","https://security-tracker.debian.org/tracker/CVE-2010-0928"],"name":"CVE-2010-0928","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libssl1.1","packageVersion":"1.1.1d-0+deb10u6","link":"https://nvd.nist.gov/vuln/detail/CVE-2010-0928","description":"OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2010-4756","https://security-tracker.debian.org/tracker/CVE-2010-4756"],"name":"CVE-2010-4756","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libc-bin","packageVersion":"2.28-10","link":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2011-3374","https://security-tracker.debian.org/tracker/CVE-2011-3374"],"name":"CVE-2011-3374","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"apt","packageVersion":"1.8.2.3","link":"https://nvd.nist.gov/vuln/detail/CVE-2011-3374","description":"It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2011-3389","https://security-tracker.debian.org/tracker/CVE-2011-3389"],"name":"CVE-2011-3389","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libgnutls30","packageVersion":"3.6.7-4+deb10u7","link":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.","severity":"Medium","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2011-4116","https://security-tracker.debian.org/tracker/CVE-2011-4116"],"name":"CVE-2011-4116","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"perl-base","packageVersion":"5.28.1-6+deb10u1","link":"https://nvd.nist.gov/vuln/detail/CVE-2011-4116","description":"_is_safe in the File::Temp module for Perl does not properly handle symlinks.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2012-2663","https://security-tracker.debian.org/tracker/CVE-2012-2663"],"name":"CVE-2012-2663","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"iptables","packageVersion":"1.8.5-3~bpo10+1","link":"https://nvd.nist.gov/vuln/detail/CVE-2012-2663","description":"extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2013-4235","https://security-tracker.debian.org/tracker/CVE-2013-4235"],"name":"CVE-2013-4235","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"login","packageVersion":"1:4.5-1.1","link":"https://nvd.nist.gov/vuln/detail/CVE-2013-4235","description":"shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2013-4392","https://security-tracker.debian.org/tracker/CVE-2013-4392"],"name":"CVE-2013-4392","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libsystemd0","packageVersion":"241-7~deb10u7","link":"https://nvd.nist.gov/vuln/detail/CVE-2013-4392","description":"systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2016-10228","https://security-tracker.debian.org/tracker/CVE-2016-10228"],"name":"CVE-2016-10228","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libc-bin","packageVersion":"2.28-10","link":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.","severity":"Low","metadata":null,"fixedIn":[{"name":"wont-fix","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2016-2781","https://security-tracker.debian.org/tracker/CVE-2016-2781"],"name":"CVE-2016-2781","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"coreutils","packageVersion":"8.30-3","link":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","severity":"Low","metadata":null,"fixedIn":[{"name":"wont-fix","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2017-11164","https://security-tracker.debian.org/tracker/CVE-2017-11164"],"name":"CVE-2017-11164","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libpcre3","packageVersion":"2:8.39-12","link":"https://nvd.nist.gov/vuln/detail/CVE-2017-11164","description":"In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2017-16231","https://security-tracker.debian.org/tracker/CVE-2017-16231"],"name":"CVE-2017-16231","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libpcre3","packageVersion":"2:8.39-12","link":"https://nvd.nist.gov/vuln/detail/CVE-2017-16231","description":"** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2017-18018","https://security-tracker.debian.org/tracker/CVE-2017-18018"],"name":"CVE-2017-18018","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"coreutils","packageVersion":"8.30-3","link":"https://nvd.nist.gov/vuln/detail/CVE-2017-18018","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2017-7245","https://security-tracker.debian.org/tracker/CVE-2017-7245"],"name":"CVE-2017-7245","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libpcre3","packageVersion":"2:8.39-12","link":"https://nvd.nist.gov/vuln/detail/CVE-2017-7245","description":"Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2017-7246","https://security-tracker.debian.org/tracker/CVE-2017-7246"],"name":"CVE-2017-7246","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libpcre3","packageVersion":"2:8.39-12","link":"https://nvd.nist.gov/vuln/detail/CVE-2017-7246","description":"Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2018-1000654","https://security-tracker.debian.org/tracker/CVE-2018-1000654"],"name":"CVE-2018-1000654","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libtasn1-6","packageVersion":"4.13-3","link":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000654","description":"GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2018-12886","https://security-tracker.debian.org/tracker/CVE-2018-12886"],"name":"CVE-2018-12886","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"gcc-8-base","packageVersion":"8.3.0-6","link":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.","severity":"High","metadata":null,"fixedIn":[{"name":"wont-fix","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2018-20796","https://security-tracker.debian.org/tracker/CVE-2018-20796"],"name":"CVE-2018-20796","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libc-bin","packageVersion":"2.28-10","link":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2018-6829","https://security-tracker.debian.org/tracker/CVE-2018-6829"],"name":"CVE-2018-6829","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libgcrypt20","packageVersion":"1.8.4-5+deb10u1","link":"https://nvd.nist.gov/vuln/detail/CVE-2018-6829","description":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2018-7169","https://security-tracker.debian.org/tracker/CVE-2018-7169"],"name":"CVE-2018-7169","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"login","packageVersion":"1:4.5-1.1","link":"https://nvd.nist.gov/vuln/detail/CVE-2018-7169","description":"An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.","severity":"Low","metadata":null,"fixedIn":[{"name":"wont-fix","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","https://security-tracker.debian.org/tracker/CVE-2019-1010022"],"name":"CVE-2019-1010022","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libc-bin","packageVersion":"2.28-10","link":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}},{"designators":{"designatorType":"Attributes","attributes":{"cluster":"minikube","containerName":"kube-proxy","customerGUID":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","kind":"daemonset","name":"kube-proxy","namespace":"kube-system"}},"context":[{"attribute":"customerGUID","value":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","source":"designators.attributes"},{"attribute":"cluster","value":"minikube","source":"designators.attributes"},{"attribute":"namespace","value":"kube-system","source":"designators.attributes"},{"attribute":"kind","value":"daemonset","source":"designators.attributes"},{"attribute":"name","value":"kube-proxy","source":"designators.attributes"},{"attribute":"containerName","value":"kube-proxy","source":"designators.attributes"}],"wlid":"wlid://cluster-minikube/namespace-kube-system/daemonset-kube-proxy","containersScanID":"XXXXXXXXXXXXXXXXXX","layers":[{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""},{"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","parentLayerHash":""}],"timestamp":1643522422,"isFixed":0,"layerHash":"sha256:48b90c7688a2c85d7081a437ecba5cb706fbaa98b09def0b206dbbe39e3af558","links":["https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","https://security-tracker.debian.org/tracker/CVE-2019-1010023"],"name":"CVE-2019-1010023","imageHash":"sha256:132b7fc61d18b3ec4a35348f6c915b429f4757d92196e2ea8cd937aea3db41df","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","packageName":"libc-bin","packageVersion":"2.28-10","link":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"","severity":"Negligible","metadata":null,"fixedIn":[{"name":"not-fixed","imageTag":"k8s.gcr.io/kube-proxy@sha256:561d6cb95c32333db13ea847396167e903d97cf6e08dd937906c3dd0108580b7","version":""}],"relevant":"No signature profile to compare","urgent":0,"neglected":0,"healthStatus":"","categories":{"isRce":false}}],"cursor":""}` diff --git a/core/pkg/registryadaptors/armosec/v1/civksadaptorutils.go b/core/pkg/registryadaptors/armosec/v1/civksadaptorutils.go deleted file mode 100644 index f93ac7be..00000000 --- a/core/pkg/registryadaptors/armosec/v1/civksadaptorutils.go +++ /dev/null @@ -1,68 +0,0 @@ -package v1 - -import ( - "encoding/json" - "fmt" - - "github.com/kubescape/kubescape/v2/core/pkg/containerscan" - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" -) - -func (armoCivAdaptor *KSCivAdaptor) getImageLastScanId(imageID *registryvulnerabilities.ContainerImageIdentifier) (string, error) { - filter := []map[string]string{{"imageTag": imageID.Tag, "status": "Success"}} - pageSize := 1 - pageNumber := 1 - request := V2ListRequest{PageSize: &pageSize, PageNum: &pageNumber, InnerFilters: filter, OrderBy: "timestamp:desc"} - requestBody, _ := json.Marshal(request) - requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsSumSummary?customerGUID=%s", armoCivAdaptor.ksCloudAPI.GetCloudAPIURL(), armoCivAdaptor.ksCloudAPI.GetAccountID()) - - resp, err := armoCivAdaptor.ksCloudAPI.Post(requestUrl, map[string]string{"Content-Type": "application/json"}, requestBody) - if err != nil { - return "", err - } - - scanSummartResult := struct { - Total struct { - Value int `json:"value"` - Relation string `json:"relation"` - } `json:"total"` - Response []containerscan.ElasticContainerScanSummaryResult `json:"response"` - Cursor string `json:"cursor"` - }{} - err = json.Unmarshal([]byte(resp), &scanSummartResult) - if err != nil { - return "", err - } - - if len(scanSummartResult.Response) < pageSize { - return "", fmt.Errorf("did not get response for image %s", imageID.Tag) - } - - return scanSummartResult.Response[0].ContainerScanID, nil -} - -func responseObjectToVulnerabilities(vulnerabilitiesList containerscan.VulnerabilitiesList) []registryvulnerabilities.Vulnerability { - vulnerabilities := make([]registryvulnerabilities.Vulnerability, len(vulnerabilitiesList)) - for i, vulnerabilityEntry := range vulnerabilitiesList { - vulnerabilities[i].Description = vulnerabilityEntry.Description - vulnerabilities[i].Fixes = make([]registryvulnerabilities.FixedIn, len(vulnerabilityEntry.Fixes)) - for j, fix := range vulnerabilityEntry.Fixes { - vulnerabilities[i].Fixes[j].ImgTag = fix.ImgTag - vulnerabilities[i].Fixes[j].Name = fix.Name - vulnerabilities[i].Fixes[j].Version = fix.Version - } - vulnerabilities[i].HealthStatus = vulnerabilityEntry.HealthStatus - vulnerabilities[i].Link = vulnerabilityEntry.Link - vulnerabilities[i].Metadata = vulnerabilityEntry.Metadata - vulnerabilities[i].Name = vulnerabilityEntry.Name - vulnerabilities[i].PackageVersion = vulnerabilityEntry.PackageVersion - vulnerabilities[i].RelatedPackageName = vulnerabilityEntry.RelatedPackageName - vulnerabilities[i].Relevancy = vulnerabilityEntry.Relevancy - vulnerabilities[i].Severity = vulnerabilityEntry.Severity - vulnerabilities[i].UrgentCount = vulnerabilityEntry.UrgentCount - vulnerabilities[i].Categories = registryvulnerabilities.Categories{ - IsRCE: vulnerabilityEntry.Categories.IsRCE, - } - } - return vulnerabilities -} diff --git a/core/pkg/registryadaptors/armosec/v1/datastructures.go b/core/pkg/registryadaptors/armosec/v1/datastructures.go deleted file mode 100644 index 2780b306..00000000 --- a/core/pkg/registryadaptors/armosec/v1/datastructures.go +++ /dev/null @@ -1,36 +0,0 @@ -package v1 - -import ( - "time" - - "github.com/kubescape/kubescape/v2/core/cautils/getter" -) - -type V2ListRequest struct { - // properties of the requested next page - // Use ValidatePageProperties to set PageSize field - PageSize *int `json:"pageSize,omitempty"` - // One can leave it empty for 0, then call ValidatePageProperties - PageNum *int `json:"pageNum,omitempty"` - // The time window of the list to return. Default: since - beginning of the time, until - now. - Since *time.Time `json:"since,omitempty"` - Until *time.Time `json:"until,omitempty"` - // Which elements of the list to return, each field can hold multiple values separated by comma - // Example: ": {"severity": "High,Medium", "type": "61539,30303"} - // An empty map means "return the complete list" - InnerFilters []map[string]string `json:"innerFilters,omitempty"` - // How to order (sort) the list, field name + sort order (asc/desc), like https://www.w3schools.com/sql/sql_orderby.asp - // Example: "timestamp:asc,severity:desc" - OrderBy string `json:"orderBy,omitempty"` - // Cursor to the next page of former request. Not supported yet - // Cursor cannot be used with another parameters of this struct - Cursor string `json:"cursor,omitempty"` - // FieldsList allow us to return only subset of the source document fields - // Don't expose FieldsList outside without well designed decision - FieldsList []string `json:"includeFields,omitempty"` - FieldsReverseKeywordMap map[string]string `json:"-,omitempty"` -} - -type KSCivAdaptor struct { - ksCloudAPI *getter.KSCloudAPI -} diff --git a/core/pkg/registryadaptors/contribute.md b/core/pkg/registryadaptors/contribute.md deleted file mode 100644 index fbef3c8f..00000000 --- a/core/pkg/registryadaptors/contribute.md +++ /dev/null @@ -1,164 +0,0 @@ -# Container image vulnerability adaptor interface - -## High level design of Kubescape - -### Layers - -* Controls and Rules: that actual control logic implementation, the "tests" themselves. Implemented in rego. -* OPA engine: the [OPA](https://github.com/open-policy-agent/opa) rego interpreter. -* Rules processor: Kubescape component, it enumerates and runs the controls while preparing all of the input data that the controls need for running. -* Data sources: set of different modules providing data to the Rules processor so it can run the controls with them. Examples: Kubernetes objects, cloud vendor API objects and adding in this proposal the vulnerability information. -* Cloud Image Vulnerability adaption interface: the subject of this proposal, it gives a common interface for different registry/vulnerability vendors to adapt to. -* CIV adaptors: specific implementation of the CIV interface, example Harbor adaption. -``` - ----------------------- -| Controls/Rules (rego) | - ----------------------- - | - ----------------------- -| OPA engine | - ----------------------- - | - ----------------------- -| Rules processor | - ----------------------- - | - ----------------------- -| Data sources | - ----------------------- - | - ======================= -| CIV adaption interface| <- Adding this layer in this proposal - ======================= - | - ----------------------- -| Specific CIV adaptors | <- Will be implemented based on this proposal - ----------------------- - - - -``` - -## Functionalities to cover - -The interface needs to cover the following functionalities: - -* Authentication against the information source (abstracted login) -* Triggering image scan (if applicable, the source might store vulnerabilities for images but cannot scan alone) -* Reading image scan status (with last scan date and etc.) -* Getting vulnerability information for a given image -* Getting image information - * Image manifests - * Image BOMs (bill of material) - -## Go API proposal - -```go - -/*type ContainerImageRegistryCredentials struct { - Password string - Tag string - Hash string -}*/ - -type ContainerImageIdentifier struct { - Registry string - Repository string - Tag string - Hash string -} - -type ContainerImageScanStatus struct { - ImageID ContainerImageIdentifier - IsScanAvailable bool - IsBomAvailable bool - LastScanDate time.Time -} - -type ContainerImageVulnerabilityReport struct { - ImageID ContainerImageIdentifier - // TBD -} - -type ContainerImageInformation struct { - ImageID ContainerImageIdentifier - Bom []string - ImageManifest Manifest // will use here Docker package definition -} - -type IContainerImageVulnerabilityAdaptor interface { - // Credentials are coming from user input (CLI or configuration file) and they are abstracted at string to string map level - // so an example use would be like registry: "simpledockerregistry:80" and credentials like {"username":"joedoe","password":"abcd1234"} - Login(registry string, credentials map[string]string) error - - // For "help" purposes - DescribeAdaptor() string - - GetImagesScanStatus(imageIDs []ContainerImageIdentifier) ([]ContainerImageScanStatus, error) - - GetImagesVulnerabilties(imageIDs []ContainerImageIdentifier) ([]ContainerImageVulnerabilityReport, error) - - GetImagesInformation(imageIDs []ContainerImageIdentifier) ([]ContainerImageInformation, error) -} -``` - - - -# Integration - -# Input - -The objects received from the interface will be converted to an IMetadata compatible objects as following - -```json -{ - "apiVersion": "armo.vuln.images/v1", - "kind": "ImageVulnerabilities", - "metadata": { - "name": "nginx:latest" - }, - "data": { - // list of vulnerabilities - } -} -``` - - -# Output - -The rego results will be a combination of the k8s artifact and the list of relevant CVEs for the control - -```json -{ - "apiVersion": "armo.vuln/v1", - "kind": "Pod", - "metadata": { - "name": "nginx" - "namespace": "default" - - }, - "relatedObjects": [ - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "name": "nginx" - "namespace": "default" - }, - "spec": { - // podSpec - }, - }, - { - "apiVersion": "image.vulnscan.com/v1", - "kind": "ImageVulnerabilities", - "metadata": { - "name": "nginx:latest", - }, - "data": { - // list of vulnerabilities - } - } - ] -} -``` diff --git a/core/pkg/registryadaptors/gcp/v1/Readme.md b/core/pkg/registryadaptors/gcp/v1/Readme.md deleted file mode 100644 index b60f6dac..00000000 --- a/core/pkg/registryadaptors/gcp/v1/Readme.md +++ /dev/null @@ -1,33 +0,0 @@ -# GCP Adaptor - -### How we add gcp adaptor - -As there can be possiblities of use of multiple registries we check for each adaptor if we have required credentias. For every adaptor having credentials we append the adaptor to the adaptors slice. - -Particularly for gcp, we frstly bring the `gcpCloudAPI` from the connector. We still haven't created a proper function that initiats the gcpCloudAPI with projectId, credentialsPath, credentialsCheck fields. We check for `credentialsCheck` bool which is set true when we have credentials(to be set when initializing the gcpCloudAPI) - -### How we fetch vulnerabilities for images - -Step 1: - Get container analysis client - For this we needs credentials of the service account. Out of few approaches here we are using [JSON key file](https://cloud.google.com/container-registry/docs/advanced-authentication#json-key) for credentials and path to this file should be stored in `credentialsPath` - -Step 2: - Do ListOccurrenceRequest - For this we need the `projectID` and the `resourceUrl`. ProjectID should be provided by the users and resourceUrl is processed imageTag that we get from kubescape resources - -Step 3: - Get Occurrence iterator - We use context and the request from the ListOccurenceRequest to get the iterators - - -### How we convert the response to Vulnerabilities - -Response from the iterator has two type of kinds i.e. Discovery and Vulnerabilties and both has differnent struct - -### How can this adaptor be used by the user - -To know about GCR service accounts follow https://cloud.google.com/container-registry/docs/gcr-service-account -export variables - `export KS_GCP_CREDENTIALS_PATH=` - `export KS_GCP_PROJECT_ID=` diff --git a/core/pkg/registryadaptors/gcp/v1/datastructure.go b/core/pkg/registryadaptors/gcp/v1/datastructure.go deleted file mode 100644 index b39be566..00000000 --- a/core/pkg/registryadaptors/gcp/v1/datastructure.go +++ /dev/null @@ -1,24 +0,0 @@ -package v1 - -import ( - "github.com/kubescape/kubescape/v2/core/cautils/getter" -) - -type GCPAdaptor struct { - GCPCloudAPI *getter.GCPCloudAPI -} - -type Mock struct { - Name string - Notename string - CvssScore float32 - CreatedTime int64 - UpdatedTime int64 - Type string - ShortDescription string - AffectedCPEURI string - AffectedPackage string - FixAvailable bool - AffectedVersion string - FixedVersion string -} diff --git a/core/pkg/registryadaptors/gcp/v1/gcpadaptor.go b/core/pkg/registryadaptors/gcp/v1/gcpadaptor.go deleted file mode 100644 index cd8a99db..00000000 --- a/core/pkg/registryadaptors/gcp/v1/gcpadaptor.go +++ /dev/null @@ -1,91 +0,0 @@ -package v1 - -import ( - "fmt" - - containeranalysis "cloud.google.com/go/containeranalysis/apiv1" - "github.com/kubescape/go-logger" - "github.com/kubescape/go-logger/helpers" - "github.com/kubescape/kubescape/v2/core/cautils/getter" - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" - "google.golang.org/api/iterator" - "google.golang.org/api/option" - grafeaspb "google.golang.org/genproto/googleapis/grafeas/v1" -) - -func NewGCPAdaptor(GCPCloudAPI *getter.GCPCloudAPI) *GCPAdaptor { - return &GCPAdaptor{ - GCPCloudAPI: GCPCloudAPI, - } -} - -func (GCPAdaptor *GCPAdaptor) Login() error { - client, err := containeranalysis.NewClient(GCPAdaptor.GCPCloudAPI.GetContext(), option.WithCredentialsFile(GCPAdaptor.GCPCloudAPI.GetCredentialsPath())) - if err != nil { - return err - } - GCPAdaptor.GCPCloudAPI.SetClient(client) - return nil -} - -func (GCPAdaptor *GCPAdaptor) GetImagesVulnerabilities(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageVulnerabilityReport, error) { - resultList := make([]registryvulnerabilities.ContainerImageVulnerabilityReport, 0) - for _, toPin := range imageIDs { - imageID := toPin - result, err := GCPAdaptor.GetImageVulnerability(&imageID) - if err != nil { - logger.L().Debug("failed to get image vulnerabilities", helpers.String("image", imageID.Tag), helpers.Error(err)) - continue - } - - resultList = append(resultList, *result) - } - - return resultList, nil -} - -func (GCPAdaptor *GCPAdaptor) GetImageVulnerability(imageID *registryvulnerabilities.ContainerImageIdentifier) (*registryvulnerabilities.ContainerImageVulnerabilityReport, error) { - - resourceUrl := fmt.Sprintf("https://%s", imageID.Tag) - - req := &grafeaspb.ListOccurrencesRequest{ - Parent: fmt.Sprintf("projects/%s", GCPAdaptor.GCPCloudAPI.GetProjectID()), - Filter: fmt.Sprintf(`resourceUrl=%q`, resourceUrl), - } - - it := GCPAdaptor.GCPCloudAPI.GetClient().GetGrafeasClient().ListOccurrences(GCPAdaptor.GCPCloudAPI.GetContext(), req) - occs := []*grafeaspb.Occurrence{} - var count int - for { - occ, err := it.Next() - if err == iterator.Done { - break - } - if err != nil { - return nil, err - } - occs = append(occs, occ) - count++ - } - vulnerabilities := responseObjectToVulnerabilities(occs, count) - - resultImageVulnerabilityReport := registryvulnerabilities.ContainerImageVulnerabilityReport{ - ImageID: *imageID, - Vulnerabilities: vulnerabilities, - } - return &resultImageVulnerabilityReport, nil -} - -func (GCPAdaptor *GCPAdaptor) DescribeAdaptor() string { - return "GCP image vulnerabilities scanner, docs: https://cloud.google.com/container-analysis/docs/container-analysis" -} - -func (GCPAdaptor *GCPAdaptor) GetImagesInformation(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageInformation, error) { - // TODO - return []registryvulnerabilities.ContainerImageInformation{}, nil -} - -func (GCPAdaptor *GCPAdaptor) GetImagesScanStatus(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageScanStatus, error) { - // TODO - return []registryvulnerabilities.ContainerImageScanStatus{}, nil -} diff --git a/core/pkg/registryadaptors/gcp/v1/gcpadaptor_test.go b/core/pkg/registryadaptors/gcp/v1/gcpadaptor_test.go deleted file mode 100644 index 9f46f57f..00000000 --- a/core/pkg/registryadaptors/gcp/v1/gcpadaptor_test.go +++ /dev/null @@ -1,31 +0,0 @@ -package v1 - -import ( - "testing" - - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" - "github.com/stretchr/testify/assert" -) - -func TestSum(t *testing.T) { - var err error - var adaptor registryvulnerabilities.IContainerImageVulnerabilityAdaptor - - adaptor, err = NewGCPAdaptorMock() - assert.NoError(t, err) - - assert.NoError(t, adaptor.Login()) - - imageVulnerabilityReports, err := adaptor.GetImagesVulnerabilities([]registryvulnerabilities.ContainerImageIdentifier{{Tag: "gcr.io/myproject/nginx@sha256:1XXXXX"}, {Tag: "gcr.io/myproject/nginx@sha256:2XXXXX"}}) - assert.NoError(t, err) - - for i := range imageVulnerabilityReports { - var length int - if i == 0 { - length = 5 - } else if i == 1 { - length = 3 - } - assert.Equal(t, length, len(imageVulnerabilityReports[i].Vulnerabilities)) - } -} diff --git a/core/pkg/registryadaptors/gcp/v1/gcpadaptormock.go b/core/pkg/registryadaptors/gcp/v1/gcpadaptormock.go deleted file mode 100644 index f0c496d4..00000000 --- a/core/pkg/registryadaptors/gcp/v1/gcpadaptormock.go +++ /dev/null @@ -1,186 +0,0 @@ -package v1 - -import ( - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" - grafeaspb "google.golang.org/genproto/googleapis/grafeas/v1" - "google.golang.org/protobuf/types/known/timestamppb" -) - -type GCPAdaptorMock struct { - resultList []registryvulnerabilities.ContainerImageVulnerabilityReport -} - -func NewGCPAdaptorMock() (*GCPAdaptorMock, error) { - return &GCPAdaptorMock{}, nil -} - -func (GCPAdaptorMock *GCPAdaptorMock) Login() error { - return nil -} - -func (GCPAdaptorMock *GCPAdaptorMock) GetImagesVulnerabilities(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageVulnerabilityReport, error) { - resultList := make([]registryvulnerabilities.ContainerImageVulnerabilityReport, 0) - for _, toPin := range imageIDs { - imageID := toPin - result, err := GCPAdaptorMock.GetImageVulnerability(&imageID) - if err != nil { - return nil, err - } - - resultList = append(resultList, *result) - - return resultList, nil //nolint:staticcheck // we return at once and shorten the mocked result - } - - GCPAdaptorMock.resultList = resultList - return GCPAdaptorMock.resultList, nil -} - -func (GCPAdaptorMock *GCPAdaptorMock) GetImageVulnerability(imageID *registryvulnerabilities.ContainerImageIdentifier) (*registryvulnerabilities.ContainerImageVulnerabilityReport, error) { - vulnerability := []*grafeaspb.Occurrence_Vulnerability{} - occurrence := []*grafeaspb.Occurrence{} - arr := GetMockData() - - for i := range arr { - if imageID.Tag == "gcr.io/myproject/nginx@sha256:2XXXXX" && i == 4 { - break - } - vulnerability = append(vulnerability, &grafeaspb.Occurrence_Vulnerability{ - Vulnerability: &grafeaspb.VulnerabilityOccurrence{ - Type: arr[i].Type, - CvssScore: arr[i].CvssScore, - ShortDescription: arr[i].ShortDescription, - PackageIssue: []*grafeaspb.VulnerabilityOccurrence_PackageIssue{ - { - FixedVersion: &grafeaspb.Version{ - FullName: arr[i].FixedVersion, - }, - AffectedVersion: &grafeaspb.Version{ - FullName: arr[i].AffectedVersion, - }, - AffectedCpeUri: arr[i].AffectedCPEURI, - AffectedPackage: arr[i].AffectedPackage, - }, - }, - FixAvailable: arr[i].FixAvailable, - }, - }) - - occurrence = append(occurrence, &grafeaspb.Occurrence{ - Name: arr[i].Name, - Kind: grafeaspb.NoteKind_ATTESTATION, - NoteName: arr[i].Notename, - CreateTime: ×tamppb.Timestamp{ - Seconds: arr[i].CreatedTime, - }, - UpdateTime: ×tamppb.Timestamp{ - Seconds: arr[i].UpdatedTime, - }, - Details: vulnerability[i], - }) - } - - vulnerabilities := responseObjectToVulnerabilities(occurrence, 5) - - resultImageVulnerabilityReport := registryvulnerabilities.ContainerImageVulnerabilityReport{ - ImageID: *imageID, - Vulnerabilities: vulnerabilities, - } - return &resultImageVulnerabilityReport, nil -} - -func (GCPAdaptorMock *GCPAdaptorMock) DescribeAdaptor() string { - // TODO - return "" -} - -func (GCPAdaptorMock *GCPAdaptorMock) GetImagesInformation(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageInformation, error) { - // TODO - return []registryvulnerabilities.ContainerImageInformation{}, nil -} - -func (GCPAdaptorMock *GCPAdaptorMock) GetImagesScanStatus(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageScanStatus, error) { - // TODO - return []registryvulnerabilities.ContainerImageScanStatus{}, nil -} - -//============================================================================================================================== -//============================================================================================================================== -//============================================================================================================================== - -func GetMockData() []Mock { - arr := []Mock{ - { - Name: "projects/stable-furnace-356005/occurrences/41fd9fec-6fab-4531-a4ee-e7b97d518554", - Notename: "projects/goog-vulnz/notes/CVE-2009-4487", - CvssScore: 6.8, - CreatedTime: 1661061853, - UpdatedTime: 1661061853, - Type: "OS", - ShortDescription: "CVE-2009-4487", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "nginx", - FixAvailable: true, - AffectedVersion: "1.23.1-1~bullseye", - FixedVersion: "", - }, - { - Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", - Notename: "projects/goog-vulnz/notes/CVE-2017-17740", - CvssScore: 2.3, - CreatedTime: 3237628, - UpdatedTime: 5989893, - Type: "OS", - ShortDescription: "CVE-2017-17740", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "openldap", - FixAvailable: false, - AffectedVersion: "1.3.5", - FixedVersion: "1.3.5", - }, - { - Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", - Notename: "projects/goog-vulnz/notes/CVE-2017-17740", - CvssScore: 2.3, - CreatedTime: 3237628, - UpdatedTime: 5989893, - Type: "OS", - ShortDescription: "CVE-2017-17740", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "openldap", - FixAvailable: false, - AffectedVersion: "1.3.5", - FixedVersion: "1.3.5", - }, - { - Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", - Notename: "projects/goog-vulnz/notes/CVE-2017-17740", - CvssScore: 2.3, - CreatedTime: 3237628, - UpdatedTime: 5989893, - Type: "OS", - ShortDescription: "CVE-2017-17740", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "openldap", - FixAvailable: false, - AffectedVersion: "1.3.5", - FixedVersion: "1.3.5", - }, - { - Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", - Notename: "projects/goog-vulnz/notes/CVE-2017-17740", - CvssScore: 2.3, - CreatedTime: 3237628, - UpdatedTime: 5989893, - Type: "OS", - ShortDescription: "CVE-2017-17740", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "openldap", - FixAvailable: false, - AffectedVersion: "1.3.5", - FixedVersion: "1.3.5", - }, - } - - return arr -} diff --git a/core/pkg/registryadaptors/gcp/v1/gcpadaptorutils.go b/core/pkg/registryadaptors/gcp/v1/gcpadaptorutils.go deleted file mode 100644 index eeba5121..00000000 --- a/core/pkg/registryadaptors/gcp/v1/gcpadaptorutils.go +++ /dev/null @@ -1,36 +0,0 @@ -package v1 - -import ( - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" - grafeaspb "google.golang.org/genproto/googleapis/grafeas/v1" -) - -func responseObjectToVulnerabilities(vulnerabilityList []*grafeaspb.Occurrence, count int) []registryvulnerabilities.Vulnerability { - vulnerabilities := make([]registryvulnerabilities.Vulnerability, count) - for i, vulnerabilityEntry := range vulnerabilityList { - if vulnerabilityEntry.GetKind().String() != "DISCOVERY" { - vulnerabilities[i].Name = vulnerabilityEntry.Name - vulnerabilities[i].NoteName = vulnerabilityEntry.NoteName - vulnerabilities[i].CreateTime = vulnerabilityEntry.CreateTime.AsTime() - vulnerabilities[i].UpdateTime = vulnerabilityEntry.UpdateTime.AsTime() - vulnerabilities[i].CVSS = vulnerabilityEntry.GetVulnerability().CvssScore - vulnerabilities[i].AffectedCPEURI = vulnerabilityEntry.GetVulnerability().PackageIssue[0].AffectedCpeUri - vulnerabilities[i].AffectedPackage = vulnerabilityEntry.GetVulnerability().PackageIssue[0].AffectedPackage - vulnerabilities[i].AffectedVersion = vulnerabilityEntry.GetVulnerability().PackageIssue[0].AffectedVersion.FullName - vulnerabilities[i].FixedVersion = vulnerabilityEntry.GetVulnerability().PackageIssue[0].FixedVersion.FullName - vulnerabilities[i].FixedCPEURI = vulnerabilityEntry.GetVulnerability().PackageIssue[0].FixedCpeUri - vulnerabilities[i].FixedPackege = vulnerabilityEntry.GetVulnerability().PackageIssue[0].FixedPackage - vulnerabilities[i].FixAvailablePackage = vulnerabilityEntry.GetVulnerability().PackageIssue[0].GetFixAvailable() - vulnerabilities[i].PackageType = vulnerabilityEntry.GetVulnerability().PackageIssue[0].PackageType - vulnerabilities[i].EffectiveSeverityPackage = vulnerabilityEntry.GetVulnerability().PackageIssue[0].EffectiveSeverity.String() - vulnerabilities[i].AffectedPackage = vulnerabilityEntry.GetVulnerability().PackageIssue[0].AffectedPackage - vulnerabilities[i].Severity = vulnerabilityEntry.GetVulnerability().Severity.Enum().String() - vulnerabilities[i].ShortDescription = vulnerabilityEntry.GetVulnerability().ShortDescription - vulnerabilities[i].LongDescription = vulnerabilityEntry.GetVulnerability().LongDescription - } else { - vulnerabilities[i].Description = vulnerabilityEntry.GetDiscovery().String() - } - } - - return vulnerabilities -} diff --git a/core/pkg/registryadaptors/registryvulnerabilities/datastructures.go b/core/pkg/registryadaptors/registryvulnerabilities/datastructures.go deleted file mode 100644 index 081ff8dc..00000000 --- a/core/pkg/registryadaptors/registryvulnerabilities/datastructures.go +++ /dev/null @@ -1,72 +0,0 @@ -package registryvulnerabilities - -import ( - "time" -) - -type ContainerImageIdentifier struct { - Registry string - Repository string - Tag string - Hash string -} - -type ContainerImageScanStatus struct { - ImageID ContainerImageIdentifier - IsScanAvailable bool - IsBomAvailable bool - LastScanDate time.Time -} - -type FixedIn struct { - Name string `json:"name"` - ImgTag string `json:"imageTag"` - Version string `json:"version"` -} -type Categories struct { - IsRCE bool `json:"isRce"` -} - -type Vulnerability struct { - Name string `json:"name"` - RelatedPackageName string `json:"packageName"` - PackageVersion string `json:"packageVersion"` - Link string `json:"link"` - Description string `json:"description"` - Severity string `json:"severity"` - Metadata interface{} `json:"metadata"` - Fixes []FixedIn `json:"fixedIn"` - Relevancy string `json:"relevant"` // use the related enum - UrgentCount int `json:"urgent"` - NeglectedCount int `json:"neglected"` - HealthStatus string `json:"healthStatus"` - Categories Categories `json:"categories"` - NoteName string `json:",omitempty"` - CreateTime time.Time `json:",omitempty"` - UpdateTime time.Time `json:",omitempty"` // Vulnerablity started - CVSS float32 `json:",omitempty"` // other cvss versions are available - AffectedCPEURI string `json:",omitempty"` // Package issue - AffectedPackage string `json:",omitempty"` - AffectedVersion string `json:",omitempty"` - FixedVersion string `json:",omitempty"` - FixedCPEURI string `json:",omitempty"` - FixedPackege string `json:",omitempty"` - FixAvailablePackage bool `json:",omitempty"` - PackageType string `json:",omitempty"` - EffectiveSeverityPackage string `json:",omitempty"` - ShortDescription string `json:",omitempty"` // Package issue ends - LongDescription string `json:",omitempty"` - EffectiveSeverity string `json:",omitempty"` - FixAvailable bool `json:",omitempty"` -} - -type ContainerImageVulnerabilityReport struct { - ImageID ContainerImageIdentifier - Vulnerabilities []Vulnerability -} - -type ContainerImageInformation struct { - ImageID ContainerImageIdentifier - Bom []string - //ImageManifest Manifest // will use here Docker package definition -} diff --git a/core/pkg/registryadaptors/registryvulnerabilities/interfaces.go b/core/pkg/registryadaptors/registryvulnerabilities/interfaces.go deleted file mode 100644 index 6f506734..00000000 --- a/core/pkg/registryadaptors/registryvulnerabilities/interfaces.go +++ /dev/null @@ -1,17 +0,0 @@ -package registryvulnerabilities - -type IContainerImageVulnerabilityAdaptor interface { - // Login Credentials are coming from user input (CLI or configuration file) and they are abstracted at string to string map level - // so and example use would be like registry: "simpledockerregistry:80" and credentials like {"username":"joedoe","password":"abcd1234"} - Login() error - - // DescribeAdaptor For "help" purposes - DescribeAdaptor() string - - GetImagesScanStatus(imageIDs []ContainerImageIdentifier) ([]ContainerImageScanStatus, error) - - GetImagesVulnerabilities(imageIDs []ContainerImageIdentifier) ([]ContainerImageVulnerabilityReport, error) - GetImageVulnerability(imageID *ContainerImageIdentifier) (*ContainerImageVulnerabilityReport, error) - - GetImagesInformation(imageIDs []ContainerImageIdentifier) ([]ContainerImageInformation, error) -} diff --git a/core/pkg/resourcehandler/handlepullresources_test.go b/core/pkg/resourcehandler/handlepullresources_test.go index 52839781..e1789628 100644 --- a/core/pkg/resourcehandler/handlepullresources_test.go +++ b/core/pkg/resourcehandler/handlepullresources_test.go @@ -11,13 +11,13 @@ import ( "github.com/kubescape/opa-utils/reporthandling/apis" helpersv1 "github.com/kubescape/opa-utils/reporthandling/helpers/v1" - reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" reportv2 "github.com/kubescape/opa-utils/reporthandling/v2" "github.com/stretchr/testify/assert" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/version" "k8s.io/client-go/dynamic/fake" fakeclientset "k8s.io/client-go/kubernetes/fake" + "k8s.io/client-go/rest" clientcmdapi "k8s.io/client-go/tools/clientcmd/api" ) @@ -49,7 +49,7 @@ func Test_getCloudMetadata(t *testing.T) { name: "Test_getCloudMetadata - GitVersion: GKE", args: args{ opaSessionObj: &cautils.OPASessionObj{ - Report: &reporthandlingv2.PostureReport{ + Report: &reportv2.PostureReport{ ClusterAPIServerInfo: &version.Info{ GitVersion: "v1.25.4-gke.1600", }, @@ -60,25 +60,14 @@ func Test_getCloudMetadata(t *testing.T) { }, want: helpersv1.NewGKEMetadata(""), }, - { - name: "Test_getCloudMetadata_context_GKE", - args: args{ - opaSessionObj: &cautils.OPASessionObj{ - Report: &reporthandlingv2.PostureReport{ - ClusterAPIServerInfo: nil, - }, - }, - kubeConfig: kubeConfig, - context: "gke_xxx-xx-0000_us-central1-c_xxxx-1", - }, - want: helpersv1.NewGKEMetadata(""), - }, { name: "Test_getCloudMetadata_context_EKS", args: args{ opaSessionObj: &cautils.OPASessionObj{ - Report: &reporthandlingv2.PostureReport{ - ClusterAPIServerInfo: nil, + Report: &reportv2.PostureReport{ + ClusterAPIServerInfo: &version.Info{ + GitVersion: "v1.25.4-eks.1600", + }, }, }, kubeConfig: kubeConfig, @@ -90,8 +79,10 @@ func Test_getCloudMetadata(t *testing.T) { name: "Test_getCloudMetadata_context_AKS", args: args{ opaSessionObj: &cautils.OPASessionObj{ - Report: &reporthandlingv2.PostureReport{ - ClusterAPIServerInfo: nil, + Report: &reportv2.PostureReport{ + ClusterAPIServerInfo: &version.Info{ + GitVersion: "v1", + }, }, }, kubeConfig: kubeConfig, @@ -100,10 +91,15 @@ func Test_getCloudMetadata(t *testing.T) { want: helpersv1.NewAKSMetadata(""), }, } + k8sinterface.K8SConfig = &rest.Config{} for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { k8sinterface.SetClusterContextName(tt.args.context) - got := getCloudMetadata(tt.args.opaSessionObj, tt.args.kubeConfig) + k8sinterface.SetClientConfigAPI(tt.args.kubeConfig) + k8sinterface.SetK8SGitServerVersion(tt.args.opaSessionObj.Report.ClusterAPIServerInfo.GitVersion) + k8sinterface.SetConnectedToCluster(true) + + got := getCloudMetadata(tt.args.opaSessionObj) if got == nil { t.Errorf("getCloudMetadata() = %v, want %v", got, tt.want.Provider()) return @@ -113,112 +109,10 @@ func Test_getCloudMetadata(t *testing.T) { } }) } + k8sinterface.SetClusterContextName("") + k8sinterface.SetClientConfigAPI(nil) } -func Test_isGKE(t *testing.T) { - type args struct { - config *clientcmdapi.Config - context string - } - tests := []struct { - name string - args args - want bool - }{ - { - name: "Test_isGKE", - args: args{ - config: getKubeConfigMock(), - context: "gke_xxx-xx-0000_us-central1-c_xxxx-1", - }, - want: true, - }, - } - for _, tt := range tests { - - t.Run(tt.name, func(t *testing.T) { - // set context - k8sinterface.SetClusterContextName(tt.args.context) - if got := isGKE(tt.args.config); got != tt.want { - t.Errorf("isGKE() = %v, want %v", got, tt.want) - } - }) - } -} - -func Test_isEKS(t *testing.T) { - type args struct { - config *clientcmdapi.Config - context string - } - tests := []struct { - name string - args args - want bool - }{ - { - name: "Test_isEKS", - args: args{ - config: getKubeConfigMock(), - context: "arn:aws:eks:eu-west-1:xxx:cluster/xxxx", - }, - want: true, - }, - } - for _, tt := range tests { - - t.Run(tt.name, func(t *testing.T) { - // set context - k8sinterface.SetClusterContextName(tt.args.context) - if got := isEKS(tt.args.config); got != tt.want { - t.Errorf("isEKS() = %v, want %v", got, tt.want) - } - }) - } -} - -func Test_isAKS(t *testing.T) { - type args struct { - config *clientcmdapi.Config - context string - } - tests := []struct { - name string - args args - want bool - }{ - { - name: "Test_isAKS", - args: args{ - config: getKubeConfigMock(), - context: "xxxx-2", - }, - want: true, - }, - } - for _, tt := range tests { - - t.Run(tt.name, func(t *testing.T) { - // set context - k8sinterface.SetClusterContextName(tt.args.context) - if got := isAKS(tt.args.config); got != tt.want { - t.Errorf("isAKS() = %v, want %v", got, tt.want) - } - }) - } -} - -/* unused for now. -type iResourceHandlerMock struct{} - -func (*iResourceHandlerMock) GetResources(*cautils.OPASessionObj, *identifiers.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, *cautils.KSResources, error) { - return nil, nil, nil, nil -} -func (*iResourceHandlerMock) GetClusterAPIServerInfo() *version.Info { - return nil -} -*/ - // https://github.com/kubescape/kubescape/pull/1004 // Cluster named .*eks.* config without a cloudconfig panics whereas we just want to scan a file func getResourceHandlerMock() *K8sResourceHandler { @@ -232,17 +126,17 @@ func getResourceHandlerMock() *K8sResourceHandler { Context: context.Background(), } - return NewK8sResourceHandler(k8s, nil, nil, nil) + return NewK8sResourceHandler(k8s, nil, nil, "test") } func Test_CollectResources(t *testing.T) { resourceHandler := getResourceHandlerMock() objSession := &cautils.OPASessionObj{ - Metadata: &reporthandlingv2.Metadata{ - ScanMetadata: reporthandlingv2.ScanMetadata{ + Metadata: &reportv2.Metadata{ + ScanMetadata: reportv2.ScanMetadata{ ScanningTarget: reportv2.Cluster, }, }, - Report: &reporthandlingv2.PostureReport{ + Report: &reportv2.PostureReport{ ClusterAPIServerInfo: nil, }, } diff --git a/core/pkg/resourcehandler/handlerpullresources.go b/core/pkg/resourcehandler/handlerpullresources.go index 0de09fd9..df13b4ea 100644 --- a/core/pkg/resourcehandler/handlerpullresources.go +++ b/core/pkg/resourcehandler/handlerpullresources.go @@ -3,11 +3,9 @@ package resourcehandler import ( "context" "fmt" - "strings" logger "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" - "github.com/kubescape/k8s-interface/cloudsupport" cloudsupportv1 "github.com/kubescape/k8s-interface/cloudsupport/v1" "github.com/kubescape/k8s-interface/k8sinterface" "github.com/kubescape/kubescape/v2/core/cautils" @@ -16,7 +14,6 @@ import ( helpersv1 "github.com/kubescape/opa-utils/reporthandling/helpers/v1" reportv2 "github.com/kubescape/opa-utils/reporthandling/v2" "go.opentelemetry.io/otel" - clientcmdapi "k8s.io/client-go/tools/clientcmd/api" ) func CollectResources(ctx context.Context, rsrcHandler IResourceHandler, policyIdentifier []cautils.PolicyIdentifier, opaSessionObj *cautils.OPASessionObj, progressListener opaprocessor.IJobProgressNotificationClient, scanInfo *cautils.ScanInfo) error { @@ -47,7 +44,7 @@ func CollectResources(ctx context.Context, rsrcHandler IResourceHandler, policyI } func setCloudMetadata(opaSessionObj *cautils.OPASessionObj) { - iCloudMetadata := getCloudMetadata(opaSessionObj, k8sinterface.GetConfig()) + iCloudMetadata := getCloudMetadata(opaSessionObj) if iCloudMetadata == nil { return } @@ -67,53 +64,15 @@ func setCloudMetadata(opaSessionObj *cautils.OPASessionObj) { // 1. Get cloud provider from API server git version (EKS, GKE) // 2. Get cloud provider from kubeconfig by parsing the cluster context (EKS, GKE) // 3. Get cloud provider from kubeconfig by parsing the server URL (AKS) -func getCloudMetadata(opaSessionObj *cautils.OPASessionObj, config *clientcmdapi.Config) apis.ICloudParser { - - if config == nil { +func getCloudMetadata(opaSessionObj *cautils.OPASessionObj) apis.ICloudParser { + switch cloudsupportv1.GetCloudProvider() { + case cloudsupportv1.AKS: + return helpersv1.NewAKSMetadata(k8sinterface.GetContextName()) + case cloudsupportv1.EKS: + return helpersv1.NewEKSMetadata(k8sinterface.GetContextName()) + case cloudsupportv1.GKE: + return helpersv1.NewGKEMetadata(k8sinterface.GetContextName()) + default: return nil } - - var provider string - - // attempting to get cloud provider from API server git version - if opaSessionObj.Report.ClusterAPIServerInfo != nil { - provider = cloudsupport.GetCloudProvider(opaSessionObj.Report.ClusterAPIServerInfo.GitVersion) - } - - if provider == cloudsupportv1.AKS || isAKS(config) { - return helpersv1.NewAKSMetadata(k8sinterface.GetContextName()) - } - if provider == cloudsupportv1.EKS || isEKS(config) { - return helpersv1.NewEKSMetadata(k8sinterface.GetContextName()) - } - if provider == cloudsupportv1.GKE || isGKE(config) { - return helpersv1.NewGKEMetadata(k8sinterface.GetContextName()) - } - - return nil -} - -// check if the server is AKS. e.g. https://XXX.XX.XXX.azmk8s.io:443 -func isAKS(config *clientcmdapi.Config) bool { - const serverIdentifierAKS = "azmk8s.io" - if cluster, ok := config.Clusters[k8sinterface.GetContextName()]; ok { - return strings.Contains(cluster.Server, serverIdentifierAKS) - } - return false -} - -// check if the server is EKS. e.g. arn:aws:eks:eu-west-1:xxx:cluster/xxxx -func isEKS(config *clientcmdapi.Config) bool { - if context, ok := config.Contexts[k8sinterface.GetContextName()]; ok { - return strings.Contains(context.Cluster, cloudsupportv1.EKS) - } - return false -} - -// check if the server is GKE. e.g. gke_xxx-xx-0000_us-central1-c_xxxx-1 -func isGKE(config *clientcmdapi.Config) bool { - if context, ok := config.Contexts[k8sinterface.GetContextName()]; ok { - return strings.Contains(context.Cluster, cloudsupportv1.GKE) - } - return false } diff --git a/core/pkg/resourcehandler/k8sresources.go b/core/pkg/resourcehandler/k8sresources.go index 14f3bbf2..11db788a 100644 --- a/core/pkg/resourcehandler/k8sresources.go +++ b/core/pkg/resourcehandler/k8sresources.go @@ -38,18 +38,18 @@ var cloudResourceGetterMapping = map[string]cloudResourceGetter{ } type K8sResourceHandler struct { + clusterName string k8s *k8sinterface.KubernetesApi hostSensorHandler hostsensorutils.IHostSensor rbacObjectsAPI *cautils.RBACObjects - registryAdaptors *RegistryAdaptors } -func NewK8sResourceHandler(k8s *k8sinterface.KubernetesApi, hostSensorHandler hostsensorutils.IHostSensor, rbacObjects *cautils.RBACObjects, registryAdaptors *RegistryAdaptors) *K8sResourceHandler { +func NewK8sResourceHandler(k8s *k8sinterface.KubernetesApi, hostSensorHandler hostsensorutils.IHostSensor, rbacObjects *cautils.RBACObjects, clusterName string) *K8sResourceHandler { return &K8sResourceHandler{ + clusterName: clusterName, k8s: k8s, hostSensorHandler: hostSensorHandler, rbacObjectsAPI: rbacObjects, - registryAdaptors: registryAdaptors, } } @@ -94,21 +94,6 @@ func (k8sHandler *K8sResourceHandler) GetResources(ctx context.Context, sessionO logger.L().StopSuccess("Accessed Kubernetes objects") - // backswords compatibility - get image vulnerability resources - if k8sHandler.registryAdaptors != nil { - imgVulnResources := cautils.MapImageVulnResources(ksResourceMap) - // check that controls use image vulnerability resources - if len(imgVulnResources) > 0 { - logger.L().Info("Requesting images vulnerabilities results") - cautils.StartSpinner() - if err := k8sHandler.registryAdaptors.collectImagesVulnerabilities(k8sResourcesMap, allResources, ksResourceMap); err != nil { - cautils.SetInfoMapForResources(fmt.Sprintf("failed to pull image scanning data: %s. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities", err.Error()), imgVulnResources, sessionObj.InfoMap) - } - cautils.StopSpinner() - logger.L().Success("Requested images vulnerabilities results") - } - } - hostResources := cautils.MapHostResources(ksResourceMap) // check that controls use host sensor resources if len(hostResources) > 0 { @@ -204,10 +189,9 @@ func (k8sHandler *K8sResourceHandler) findScanObjectResource(resource *objectsen } func (k8sHandler *K8sResourceHandler) collectCloudResources(ctx context.Context, sessionObj *cautils.OPASessionObj, allResources map[string]workloadinterface.IMetadata, externalResourceMap cautils.ExternalResources, cloudResources []string, progressListener opaprocessor.IJobProgressNotificationClient) error { - clusterName := cautils.ClusterName - provider := cloudsupport.GetCloudProvider(clusterName) + provider := cloudsupport.GetCloudProvider() if provider == "" { - return fmt.Errorf("failed to get cloud provider, cluster: %s", clusterName) + return fmt.Errorf("failed to get cloud provider, cluster: %s", k8sHandler.clusterName) } logger.L().Start("Downloading cloud resources") @@ -215,7 +199,7 @@ func (k8sHandler *K8sResourceHandler) collectCloudResources(ctx context.Context, if sessionObj.Metadata != nil && sessionObj.Metadata.ContextMetadata.ClusterContextMetadata != nil { sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.CloudProvider = provider } - logger.L().Debug("cloud", helpers.String("cluster", clusterName), helpers.String("clusterName", clusterName), helpers.String("provider", provider)) + logger.L().Debug("cloud", helpers.String("clusterName", k8sHandler.clusterName), helpers.String("provider", provider)) for resourceKind, resourceGetter := range cloudResourceGetterMapping { if !cloudResourceRequired(cloudResources, resourceKind) { @@ -223,7 +207,7 @@ func (k8sHandler *K8sResourceHandler) collectCloudResources(ctx context.Context, } logger.L().Debug("Collecting cloud data ", helpers.String("resourceKind", resourceKind)) - wl, err := resourceGetter(clusterName, provider) + wl, err := resourceGetter(k8sHandler.clusterName, provider) if err != nil { if !strings.Contains(err.Error(), cloudv1.NotSupportedMsg) { // Return error with useful info on how to configure credentials for getting cloud provider info @@ -416,11 +400,11 @@ func (k8sHandler *K8sResourceHandler) collectHostResources(ctx context.Context, } func (k8sHandler *K8sResourceHandler) collectRbacResources(allResources map[string]workloadinterface.IMetadata) error { - logger.L().Start("Collecting RBAC resources") - if k8sHandler.rbacObjectsAPI == nil { return nil } + + logger.L().Start("Collecting RBAC resources") allRbacResources, err := k8sHandler.rbacObjectsAPI.ListAllResources() if err != nil { return err diff --git a/core/pkg/resourcehandler/registrydata.go b/core/pkg/resourcehandler/registrydata.go deleted file mode 100644 index 4e6c6d79..00000000 --- a/core/pkg/resourcehandler/registrydata.go +++ /dev/null @@ -1,174 +0,0 @@ -package resourcehandler - -import ( - "fmt" - - logger "github.com/kubescape/go-logger" - "github.com/kubescape/k8s-interface/k8sinterface" - "github.com/kubescape/k8s-interface/workloadinterface" - "github.com/kubescape/kubescape/v2/core/cautils" - "github.com/kubescape/kubescape/v2/core/cautils/getter" - armosecadaptorv1 "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/armosec/v1" - gcpadaptorv1 "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/gcp/v1" - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" - - "github.com/kubescape/opa-utils/shared" -) - -const ( - ImagevulnerabilitiesObjectGroup = "armo.vuln.images" - ImagevulnerabilitiesObjectVersion = "v1" - ImagevulnerabilitiesObjectKind = "ImageVulnerabilities" -) - -type RegistryAdaptors struct { - adaptors []registryvulnerabilities.IContainerImageVulnerabilityAdaptor -} - -func NewRegistryAdaptors() (*RegistryAdaptors, error) { - // list supported adaptors - registryAdaptors := &RegistryAdaptors{} - adaptors, err := listAdaptors() - if err != nil { - return registryAdaptors, err - } - if len(adaptors) == 0 { - return nil, nil - } - - registryAdaptors.adaptors = adaptors - return registryAdaptors, nil -} - -func (registryAdaptors *RegistryAdaptors) collectImagesVulnerabilities(k8sResourcesMap cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, externalResourceMap cautils.ExternalResources) error { - logger.L().Debug("Collecting images vulnerabilities") - - if len(registryAdaptors.adaptors) == 0 { - return fmt.Errorf("credentials are not configured for any registry adaptor") - } - - for i := range registryAdaptors.adaptors { // login and and get vulnerabilities - if err := registryAdaptors.adaptors[i].Login(); err != nil { - return fmt.Errorf("failed to login, adaptor: '%s', reason: '%s'", registryAdaptors.adaptors[i].DescribeAdaptor(), err.Error()) - } - } - - // list cluster images - images := listImagesTags(k8sResourcesMap, allResources) - imagesIdentifiers := imageTagsToContainerImageIdentifier(images) - - imagesVulnerability := map[string][]registryvulnerabilities.Vulnerability{} - for i := range registryAdaptors.adaptors { // login and and get vulnerabilities - - vulnerabilities, err := registryAdaptors.adaptors[i].GetImagesVulnerabilities(imagesIdentifiers) - if err != nil { - return err - } - for j := range vulnerabilities { - imagesVulnerability[vulnerabilities[j].ImageID.Tag] = vulnerabilities[j].Vulnerabilities - } - } - - // convert result to IMetadata object - metaObjs := vulnerabilitiesToIMetadata(imagesVulnerability) - - if len(metaObjs) == 0 { - return fmt.Errorf("no vulnerabilities found for any of the images") - } - - // save in resources map - for i := range metaObjs { - allResources[metaObjs[i].GetID()] = metaObjs[i] - } - externalResourceMap[k8sinterface.JoinResourceTriplets(ImagevulnerabilitiesObjectGroup, ImagevulnerabilitiesObjectVersion, ImagevulnerabilitiesObjectKind)] = workloadinterface.ListMetaIDs(metaObjs) - - return nil -} - -func vulnerabilitiesToIMetadata(vulnerabilities map[string][]registryvulnerabilities.Vulnerability) []workloadinterface.IMetadata { - objs := []workloadinterface.IMetadata{} - for i := range vulnerabilities { - objs = append(objs, vulnerabilityToIMetadata(i, vulnerabilities[i])) - } - return objs -} - -func vulnerabilityToIMetadata(imageTag string, vulnerabilities []registryvulnerabilities.Vulnerability) workloadinterface.IMetadata { - obj := map[string]interface{}{} - metadata := map[string]interface{}{} - metadata["name"] = imageTag // store image tag as object name - obj["kind"] = ImagevulnerabilitiesObjectKind - obj["apiVersion"] = k8sinterface.JoinGroupVersion(ImagevulnerabilitiesObjectGroup, ImagevulnerabilitiesObjectVersion) - obj["data"] = vulnerabilities - obj["metadata"] = metadata - - return workloadinterface.NewWorkloadObj(obj) -} - -// list all images tags -func listImagesTags(k8sResourcesMap cautils.K8SResources, allResources map[string]workloadinterface.IMetadata) []string { - images := []string{} - for _, resources := range k8sResourcesMap { - for j := range resources { - if resource, ok := allResources[resources[j]]; ok { - if resource.GetObjectType() == workloadinterface.TypeWorkloadObject { - workload := workloadinterface.NewWorkloadObj(resource.GetObject()) - if containers, err := workload.GetContainers(); err == nil { - for i := range containers { - images = append(images, containers[i].Image) - } - } - if containers, err := workload.GetInitContainers(); err == nil { - for i := range containers { - images = append(images, containers[i].Image) - } - } - } - } - } - } - - return shared.SliceStringToUnique(images) -} - -func imageTagsToContainerImageIdentifier(images []string) []registryvulnerabilities.ContainerImageIdentifier { - imagesIdentifiers := make([]registryvulnerabilities.ContainerImageIdentifier, len(images)) - for i := range images { - imageIdentifier := registryvulnerabilities.ContainerImageIdentifier{ - Tag: images[i], - } - // splitted := strings.Split(images[i], "/") - // if len(splitted) == 1 { - // imageIdentifier.Tag = splitted[0] - // } else if len(splitted) == 2 { - // imageIdentifier.Registry = splitted[0] - // imageIdentifier.Tag = splitted[1] - // } else if len(splitted) >= 3 { - // imageIdentifier.Registry = splitted[0] - // imageIdentifier.Repository = strings.Join(splitted[1:len(splitted)-1], "/") - // imageIdentifier.Tag = splitted[len(splitted)-1] - // } - imagesIdentifiers[i] = imageIdentifier - } - return imagesIdentifiers -} -func listAdaptors() ([]registryvulnerabilities.IContainerImageVulnerabilityAdaptor, error) { - - adaptors := []registryvulnerabilities.IContainerImageVulnerabilityAdaptor{} - - ksCloudAPI := getter.GetKSCloudAPIConnector() - if ksCloudAPI != nil { - if ksCloudAPI.GetSecretKey() != "" && ksCloudAPI.GetClientID() != "" && ksCloudAPI.GetAccountID() != "" { - adaptors = append(adaptors, armosecadaptorv1.NewKSAdaptor(getter.GetKSCloudAPIConnector())) - } - } - - gcpCloudAPI := getter.GetGlobalGCPCloudAPIConnector() - if gcpCloudAPI != nil { - if gcpCloudAPI.GetCredentialsCheck() { - adaptors = append(adaptors, gcpadaptorv1.NewGCPAdaptor(getter.GetGlobalGCPCloudAPIConnector())) - } - } - - return adaptors, nil -} diff --git a/core/pkg/resultshandling/printer/v2/htmlprinter.go b/core/pkg/resultshandling/printer/v2/htmlprinter.go index 285a419f..f90a3b35 100644 --- a/core/pkg/resultshandling/printer/v2/htmlprinter.go +++ b/core/pkg/resultshandling/printer/v2/htmlprinter.go @@ -56,6 +56,11 @@ func (hp *HtmlPrinter) PrintNextSteps() { } func (hp *HtmlPrinter) ActionPrint(ctx context.Context, opaSessionObj *cautils.OPASessionObj, imageScanData []cautils.ImageScanData) { + if opaSessionObj == nil { + logger.L().Ctx(ctx).Error("failed to print results, missing data") + return + } + tplFuncMap := template.FuncMap{ "sum": func(nums ...int) int { total := 0 diff --git a/core/pkg/resultshandling/printer/v2/jsonprinter.go b/core/pkg/resultshandling/printer/v2/jsonprinter.go index ee629026..8d6ba324 100644 --- a/core/pkg/resultshandling/printer/v2/jsonprinter.go +++ b/core/pkg/resultshandling/printer/v2/jsonprinter.go @@ -53,11 +53,11 @@ func (jp *JsonPrinter) ActionPrint(ctx context.Context, opaSessionObj *cautils.O } else if imageScanData != nil { err = jp.PrintImageScan(ctx, imageScanData[0].PresenterConfig) } else { - err = fmt.Errorf("failed to write results, no data provided") + err = fmt.Errorf("no data provided") } if err != nil { - logger.L().Ctx(ctx).Error("failed to write results", helpers.Error(err)) + logger.L().Ctx(ctx).Error("failed to write results in json format", helpers.Error(err)) return } @@ -75,8 +75,10 @@ func printConfigurationsScanning(opaSessionObj *cautils.OPASessionObj, ctx conte } func (jp *JsonPrinter) PrintImageScan(ctx context.Context, scanResults *models.PresenterConfig) error { + if scanResults == nil { + return fmt.Errorf("no image vulnerability data provided") + } pres := presenter.GetPresenter("json", "", false, *scanResults) - return pres.Present(jp.writer) } diff --git a/core/pkg/resultshandling/printer/v2/junit.go b/core/pkg/resultshandling/printer/v2/junit.go index 59a26bb7..fd01bb11 100644 --- a/core/pkg/resultshandling/printer/v2/junit.go +++ b/core/pkg/resultshandling/printer/v2/junit.go @@ -117,6 +117,11 @@ func (jp *JunitPrinter) PrintNextSteps() { } func (jp *JunitPrinter) ActionPrint(ctx context.Context, opaSessionObj *cautils.OPASessionObj, imageScanData []cautils.ImageScanData) { + if opaSessionObj == nil { + logger.L().Ctx(ctx).Error("failed to print results, missing data") + return + } + junitResult := testsSuites(opaSessionObj) postureReportStr, err := xml.Marshal(junitResult) if err != nil { diff --git a/core/pkg/resultshandling/printer/v2/pdf.go b/core/pkg/resultshandling/printer/v2/pdf.go index 8906c1ed..509c4d41 100644 --- a/core/pkg/resultshandling/printer/v2/pdf.go +++ b/core/pkg/resultshandling/printer/v2/pdf.go @@ -90,6 +90,11 @@ func (pp *PdfPrinter) PrintNextSteps() { } func (pp *PdfPrinter) ActionPrint(ctx context.Context, opaSessionObj *cautils.OPASessionObj, imageScanData []cautils.ImageScanData) { + if opaSessionObj == nil { + logger.L().Ctx(ctx).Error("failed to print results, missing data") + return + } + sortedControlIDs := getSortedControlsIDs(opaSessionObj.Report.SummaryDetails.Controls) infoToPrintInfo := mapInfoToPrintInfo(opaSessionObj.Report.SummaryDetails.Controls) diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter.go b/core/pkg/resultshandling/printer/v2/prettyprinter.go index df2da442..959f4571 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter.go @@ -40,9 +40,10 @@ type PrettyPrinter struct { scanType cautils.ScanTypes inputPatterns []string mainPrinter prettyprinter.MainPrinter + clusterName string } -func NewPrettyPrinter(verboseMode bool, formatVersion string, attackTree bool, viewType cautils.ViewTypes, scanType cautils.ScanTypes, inputPatterns []string) *PrettyPrinter { +func NewPrettyPrinter(verboseMode bool, formatVersion string, attackTree bool, viewType cautils.ViewTypes, scanType cautils.ScanTypes, inputPatterns []string, clusterName string) *PrettyPrinter { prettyPrinter := &PrettyPrinter{ verboseMode: verboseMode, formatVersion: formatVersion, @@ -50,6 +51,7 @@ func NewPrettyPrinter(verboseMode bool, formatVersion string, attackTree bool, v printAttackTree: attackTree, scanType: scanType, inputPatterns: inputPatterns, + clusterName: clusterName, } return prettyPrinter @@ -116,7 +118,11 @@ func (pp *PrettyPrinter) PrintImageScan(imageScanData []cautils.ImageScanData) { func (pp *PrettyPrinter) ActionPrint(_ context.Context, opaSessionObj *cautils.OPASessionObj, imageScanData []cautils.ImageScanData) { if opaSessionObj != nil { - fmt.Fprintf(pp.writer, "\n"+getSeparator("^")+"\n") + if isPrintSeparatorType(pp.scanType) { + fmt.Fprintf(pp.writer, "\n"+getSeparator("^")+"\n") + } else { + fmt.Fprintf(pp.writer, "\n") + } sortedControlIDs := getSortedControlsIDs(opaSessionObj.Report.SummaryDetails.Controls) // ListControls().All()) @@ -131,7 +137,7 @@ func (pp *PrettyPrinter) ActionPrint(_ context.Context, opaSessionObj *cautils.O pp.printOverview(opaSessionObj, pp.verboseMode) - pp.mainPrinter.PrintConfigurationsScanning(&opaSessionObj.Report.SummaryDetails, sortedControlIDs) + pp.mainPrinter.PrintConfigurationsScanning(&opaSessionObj.Report.SummaryDetails, sortedControlIDs, opaSessionObj.TopWorkloadsByScore) // When writing to Stdout, we aren’t really writing to an output file, // so no need to print that we are @@ -157,7 +163,8 @@ func (pp *PrettyPrinter) printOverview(opaSessionObj *cautils.OPASessionObj, pri func (pp *PrettyPrinter) printHeader(opaSessionObj *cautils.OPASessionObj) { if pp.scanType == cautils.ScanTypeCluster || pp.scanType == cautils.ScanTypeRepo { - cautils.InfoDisplay(pp.writer, "\nSecurity Overview\n\n") + cautils.InfoDisplay(pp.writer, fmt.Sprintf("\nKubescape security posture overview for cluster: %s\n\n", pp.clusterName)) + cautils.SimpleDisplay(pp.writer, "In this overview, Kubescape shows you a summary of your cluster security posture, including the number of users who can perform administrative actions. For each result greater than 0, you should evaluate its need, and then define an exception to allow it. This baseline can be used to detect drift in future.\n\n") } else if pp.scanType == cautils.ScanTypeWorkload { ns := opaSessionObj.SingleResourceScan.GetNamespace() if ns == "" { @@ -330,3 +337,12 @@ func getSeparator(sep string) string { } return s } + +func isPrintSeparatorType(scanType cautils.ScanTypes) bool { + switch scanType { + case cautils.ScanTypeCluster, cautils.ScanTypeRepo, cautils.ScanTypeImage, cautils.ScanTypeWorkload: + return false + default: + return true + } +} diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/clusterscan.go b/core/pkg/resultshandling/printer/v2/prettyprinter/clusterscan.go index ae3cc1ec..629212ae 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/clusterscan.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/clusterscan.go @@ -3,10 +3,12 @@ package prettyprinter import ( "fmt" "os" + "strings" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter" "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter" + "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" ) @@ -29,16 +31,15 @@ func (cp *ClusterPrinter) PrintImageScanning(summary *imageprinter.ImageScanSumm printImagesCommands(cp.writer, *summary) } -func (cp *ClusterPrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string) { +func (cp *ClusterPrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string, topWorkloadsByScore []reporthandling.IResource) { cp.categoriesTablePrinter.PrintCategoriesTables(cp.writer, summaryDetails, sortedControlIDs) - printComplianceScore(cp.writer, filterComplianceFrameworks(summaryDetails.ListFrameworks())) - - if len(summaryDetails.TopWorkloadsByScore) > 0 { - cp.printTopWorkloads(summaryDetails) + if len(topWorkloadsByScore) > 0 { + cp.printTopWorkloads(topWorkloadsByScore) } + printComplianceScore(cp.writer, filterComplianceFrameworks(summaryDetails.ListFrameworks())) } func (cp *ClusterPrinter) PrintNextSteps() { @@ -47,20 +48,27 @@ func (cp *ClusterPrinter) PrintNextSteps() { func (cp *ClusterPrinter) getNextSteps() []string { return []string{ - configScanVerboseRunText, - installHelmText, - CICDSetupText, + runCommandsText, + scanWorkloadText, + installKubescapeText, } } -func (cp *ClusterPrinter) printTopWorkloads(summaryDetails *reportsummary.SummaryDetails) { - cautils.InfoTextDisplay(cp.writer, getTopWorkloadsTitle(len(summaryDetails.TopWorkloadsByScore))) +func (cp *ClusterPrinter) printTopWorkloads(topWorkloadsByScore []reporthandling.IResource) { + txt := getTopWorkloadsTitle(len(topWorkloadsByScore)) - for i, wl := range summaryDetails.TopWorkloadsByScore { + cautils.InfoTextDisplay(cp.writer, txt) + + cautils.SimpleDisplay(cp.writer, fmt.Sprintf("%s\n", strings.Repeat("─", len(txt)))) + + cautils.SimpleDisplay(cp.writer, highStakesWlsText) + + for i, wl := range topWorkloadsByScore { ns := wl.GetNamespace() name := wl.GetName() kind := wl.GetKind() - cautils.SimpleDisplay(cp.writer, fmt.Sprintf("%d. namespace: %s, name: %s, kind: %s - '%s'\n", i+1, ns, name, kind, getCallToActionString(cp.getWorkloadScanCommand(ns, kind, name)))) + cautils.SimpleDisplay(cp.writer, fmt.Sprintf("%d. namespace: %s, name: %s, kind: %s\n", i+1, ns, name, kind)) + cautils.SimpleDisplay(cp.writer, fmt.Sprintf(" '%s'\n", getCallToActionString(cp.getWorkloadScanCommand(ns, kind, name)))) } cautils.InfoTextDisplay(cp.writer, "\n") diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/clusterscan_test.go b/core/pkg/resultshandling/printer/v2/prettyprinter/clusterscan_test.go index 6f45c22d..ad596fb9 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/clusterscan_test.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/clusterscan_test.go @@ -11,16 +11,16 @@ func TestClusterScan_getNextSteps(t *testing.T) { t.Errorf("Expected 3 next steps, got %d", len(nextSteps)) } - if nextSteps[0] != configScanVerboseRunText { + if nextSteps[0] != runCommandsText { t.Errorf("Expected %s, got %s", configScanVerboseRunText, nextSteps[0]) } - if nextSteps[1] != installHelmText { - t.Errorf("Expected %s, got %s", installHelmText, nextSteps[1]) + if nextSteps[1] != scanWorkloadText { + t.Errorf("Expected %s, got %s", scanWorkloadText, nextSteps[1]) } - if nextSteps[2] != CICDSetupText { - t.Errorf("Expected %s, got %s", CICDSetupText, nextSteps[2]) + if nextSteps[2] != installKubescapeText { + t.Errorf("Expected %s, got %s", installKubescapeText, nextSteps[2]) } } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/frameworkscan.go b/core/pkg/resultshandling/printer/v2/prettyprinter/frameworkscan.go index 11d4f748..beb25e60 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/frameworkscan.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/frameworkscan.go @@ -5,6 +5,7 @@ import ( "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter" "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter" + "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" ) @@ -34,6 +35,6 @@ func (sp *SummaryPrinter) getVerboseMode() bool { return sp.verboseMode } -func (sp *SummaryPrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string) { +func (sp *SummaryPrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string, topWorkloadsByScore []reporthandling.IResource) { sp.summaryTablePrinter.PrintSummaryTable(sp.writer, summaryDetails, sortedControlIDs) } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/imagescan.go b/core/pkg/resultshandling/printer/v2/prettyprinter/imagescan.go index 8adbb32d..edffbda8 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/imagescan.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/imagescan.go @@ -5,6 +5,7 @@ import ( "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter" + "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" ) @@ -43,13 +44,13 @@ func (ip *ImagePrinter) PrintImageScanningTable(summary imageprinter.ImageScanSu cautils.InfoTextDisplay(ip.writer, "\n") } -func (ip *ImagePrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string) { +func (ip *ImagePrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string, topWorkloadsByScore []reporthandling.IResource) { } func (ip *ImagePrinter) PrintNextSteps() { if ip.verboseMode { - printNextSteps(ip.writer, []string{CICDSetupText, installHelmText}, true) + printNextSteps(ip.writer, []string{installKubescapeText}, true) return } - printNextSteps(ip.writer, []string{imageScanVerboseRunText, CICDSetupText, installHelmText}, true) + printNextSteps(ip.writer, []string{imageScanVerboseRunText, installKubescapeText}, true) } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/interface.go b/core/pkg/resultshandling/printer/v2/prettyprinter/interface.go index ece953d3..218c8cb4 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/interface.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/interface.go @@ -2,11 +2,12 @@ package prettyprinter import ( "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter" + "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" ) type MainPrinter interface { - PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControls [][]string) + PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControls [][]string, topWorkloadsByScore []reporthandling.IResource) PrintImageScanning(imageScanSummary *imageprinter.ImageScanSummary) PrintNextSteps() } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/reposcan.go b/core/pkg/resultshandling/printer/v2/prettyprinter/reposcan.go index 8711555f..dacaadc8 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/reposcan.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/reposcan.go @@ -3,6 +3,7 @@ package prettyprinter import ( "fmt" "os" + "strings" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter" @@ -13,7 +14,6 @@ import ( type RepoPrinter struct { writer *os.File - inputPatterns []string categoriesTablePrinter configurationprinter.TablePrinter } @@ -32,11 +32,11 @@ func (rp *RepoPrinter) PrintImageScanning(summary *imageprinter.ImageScanSummary printTopComponents(rp.writer, *summary) } -func (rp *RepoPrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string) { +func (rp *RepoPrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string, topWorkloadsByScore []reporthandling.IResource) { rp.categoriesTablePrinter.PrintCategoriesTables(rp.writer, summaryDetails, sortedControlIDs) - if len(summaryDetails.TopWorkloadsByScore) > 1 { - rp.printTopWorkloads(summaryDetails) + if len(topWorkloadsByScore) > 1 { + rp.printTopWorkloads(topWorkloadsByScore) } } @@ -47,22 +47,28 @@ func (rp *RepoPrinter) PrintNextSteps() { func (rp *RepoPrinter) getNextSteps() []string { return []string{ - configScanVerboseRunText, + runCommandsText, clusterScanRunText, - CICDSetupText, - installHelmText, + scanWorkloadText, + installKubescapeText, } } -func (rp *RepoPrinter) printTopWorkloads(summaryDetails *reportsummary.SummaryDetails) { - cautils.InfoTextDisplay(rp.writer, getTopWorkloadsTitle(len(summaryDetails.TopWorkloadsByScore))) +func (rp *RepoPrinter) printTopWorkloads(topWorkloadsByScore []reporthandling.IResource) { + txt := getTopWorkloadsTitle(len(topWorkloadsByScore)) + cautils.InfoTextDisplay(rp.writer, txt) - for i, wl := range summaryDetails.TopWorkloadsByScore { + cautils.SimpleDisplay(rp.writer, fmt.Sprintf("%s\n", strings.Repeat("─", len(txt)))) + + cautils.SimpleDisplay(rp.writer, highStakesWlsText) + + for i, wl := range topWorkloadsByScore { ns := wl.GetNamespace() name := wl.GetName() kind := wl.GetKind() cmdPrefix := getWorkloadPrefixForCmd(ns, kind, name) - cautils.SimpleDisplay(rp.writer, fmt.Sprintf("%d. %s - '%s'\n", i+1, cmdPrefix, getCallToActionString(rp.getWorkloadScanCommand(ns, kind, name, *wl.GetSource())))) + cautils.SimpleDisplay(rp.writer, fmt.Sprintf("%d. %s\n", i+1, cmdPrefix)) + cautils.SimpleDisplay(rp.writer, fmt.Sprintf(" %s\n", getCallToActionString(rp.getWorkloadScanCommand(ns, kind, name, *wl.GetSource())))) } cautils.InfoTextDisplay(rp.writer, "\n") diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/reposcan_test.go b/core/pkg/resultshandling/printer/v2/prettyprinter/reposcan_test.go index 82c7d0ea..8b49ec64 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/reposcan_test.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/reposcan_test.go @@ -15,20 +15,20 @@ func TestRepoScan_getNextSteps(t *testing.T) { t.Errorf("Expected 4 next steps, got %d", len(nextSteps)) } - if nextSteps[0] != configScanVerboseRunText { - t.Errorf("Expected %s, got %s", configScanVerboseRunText, nextSteps[0]) + if nextSteps[0] != runCommandsText { + t.Errorf("Expected %s, got %s", clusterScanRunText, nextSteps[0]) } if nextSteps[1] != clusterScanRunText { - t.Errorf("Expected %s, got %s", clusterScanRunText, nextSteps[1]) + t.Errorf("Expected %s, got %s", runCommandsText, nextSteps[1]) } - if nextSteps[2] != CICDSetupText { - t.Errorf("Expected %s, got %s", CICDSetupText, nextSteps[2]) + if nextSteps[2] != scanWorkloadText { + t.Errorf("Expected %s, got %s", scanWorkloadText, nextSteps[2]) } - if nextSteps[3] != installHelmText { - t.Errorf("Expected %s, got %s", installHelmText, nextSteps[3]) + if nextSteps[3] != installKubescapeText { + t.Errorf("Expected %s, got %s", installKubescapeText, nextSteps[3]) } } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/categorytable.go b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/categorytable.go index 4c37e323..9ded6a5e 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/categorytable.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/categorytable.go @@ -1,12 +1,10 @@ package configurationprinter import ( - "fmt" "io" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/utils" - "github.com/kubescape/opa-utils/reporthandling/apis" "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" "github.com/olekukonko/tablewriter" ) @@ -15,10 +13,10 @@ const ( docsPrefix = "https://hub.armosec.io/docs" scanControlPrefix = "$ kubescape scan control" controlNameHeader = "CONTROL NAME" - statusHeader = "STATUS" + statusHeader = "" docsHeader = "DOCS" resourcesHeader = "RESOURCES" - runHeader = "RUN" + runHeader = "VIEW DETAILS" ) // initializes the table headers and column alignments based on the category type @@ -31,8 +29,8 @@ func initCategoryTableData(categoryType CategoryType) ([]string, []int) { func getCategoryStatusTypeHeaders() []string { headers := make([]string, 3) - headers[0] = controlNameHeader - headers[1] = statusHeader + headers[0] = statusHeader + headers[1] = controlNameHeader headers[2] = docsHeader return headers @@ -48,7 +46,7 @@ func getCategoryCountingTypeHeaders() []string { } func getStatusTypeAlignments() []int { - return []int{tablewriter.ALIGN_LEFT, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER} + return []int{tablewriter.ALIGN_CENTER, tablewriter.ALIGN_LEFT, tablewriter.ALIGN_CENTER} } func getCountingTypeAlignments() []int { @@ -66,14 +64,14 @@ func generateCategoryStatusRow(controlSummary reportsummary.IControlSummary, inf rows := make([]string, 3) - rows[0] = controlSummary.GetName() - if len(controlSummary.GetName()) > 50 { - rows[0] = controlSummary.GetName()[:50] + "..." - } else { - rows[0] = controlSummary.GetName() - } + rows[0] = utils.GetStatusIcon(controlSummary.GetStatus().Status()) - rows[1] = utils.GetStatusColor(controlSummary.GetStatus().Status())(getStatus(status, controlSummary, infoToPrintInfo)) + rows[1] = controlSummary.GetName() + if len(controlSummary.GetName()) > 50 { + rows[1] = controlSummary.GetName()[:50] + "..." + } else { + rows[1] = controlSummary.GetName() + } rows[2] = getDocsForControl(controlSummary) @@ -81,14 +79,6 @@ func generateCategoryStatusRow(controlSummary reportsummary.IControlSummary, inf } -func getStatus(status apis.IStatus, controlSummary reportsummary.IControlSummary, infoToPrintInfo []utils.InfoStars) string { - // skipped is shown as action required - if status.IsSkipped() { - return fmt.Sprintf("%s %s", "action required", GetInfoColumn(controlSummary, infoToPrintInfo)) - } - return string(controlSummary.GetStatus().Status()) -} - func getCategoryTableWriter(writer io.Writer, headers []string, columnAligments []int) *tablewriter.Table { table := tablewriter.NewWriter(writer) table.SetHeader(headers) diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/categorytable_test.go b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/categorytable_test.go index df88bacb..6d4b69df 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/categorytable_test.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/categorytable_test.go @@ -21,14 +21,14 @@ func TestInitCategoryTableData(t *testing.T) { { name: "Test1", categoryType: TypeCounting, - expectedHeaders: []string{"CONTROL NAME", "RESOURCES", "RUN"}, + expectedHeaders: []string{"CONTROL NAME", "RESOURCES", "VIEW DETAILS"}, expectedAlignments: []int{tablewriter.ALIGN_LEFT, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_LEFT}, }, { name: "Test2", categoryType: TypeStatus, - expectedHeaders: []string{"CONTROL NAME", "STATUS", "DOCS"}, - expectedAlignments: []int{tablewriter.ALIGN_LEFT, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER}, + expectedHeaders: []string{"", "CONTROL NAME", "DOCS"}, + expectedAlignments: []int{tablewriter.ALIGN_CENTER, tablewriter.ALIGN_LEFT, tablewriter.ALIGN_CENTER}, }, } for _, tt := range tests { @@ -53,12 +53,12 @@ func TestGetCategoryStatusTypeHeaders(t *testing.T) { t.Errorf("Expected 3 headers, got %d", len(headers)) } - if headers[0] != controlNameHeader { - t.Errorf("Expected %s, got %s", controlNameHeader, headers[0]) + if headers[0] != statusHeader { + t.Errorf("Expected %s, got %s", statusHeader, headers[0]) } - if headers[1] != statusHeader { - t.Errorf("Expected %s, got %s", statusHeader, headers[1]) + if headers[1] != controlNameHeader { + t.Errorf("Expected %s, got %s", controlNameHeader, headers[1]) } if headers[2] != docsHeader { @@ -93,12 +93,12 @@ func TestGetStatusTypeAlignments(t *testing.T) { t.Errorf("Expected 3 alignments, got %d", len(alignments)) } - if alignments[0] != tablewriter.ALIGN_LEFT { - t.Errorf("Expected %d, got %d", tablewriter.ALIGN_LEFT, alignments[0]) + if alignments[0] != tablewriter.ALIGN_CENTER { + t.Errorf("Expected %d, got %d", tablewriter.ALIGN_CENTER, alignments[0]) } - if alignments[1] != tablewriter.ALIGN_CENTER { - t.Errorf("Expected %d, got %d", tablewriter.ALIGN_CENTER, alignments[1]) + if alignments[1] != tablewriter.ALIGN_LEFT { + t.Errorf("Expected %d, got %d", tablewriter.ALIGN_LEFT, alignments[1]) } if alignments[2] != tablewriter.ALIGN_CENTER { @@ -140,7 +140,7 @@ func TestGenerateCategoryStatusRow(t *testing.T) { Status: apis.StatusFailed, ControlID: "ctrlID", }, - expectedRows: []string{"test", "failed", "https://hub.armosec.io/docs/ctrlid"}, + expectedRows: []string{"❌", "test", "https://hub.armosec.io/docs/ctrlid"}, }, { name: "skipped control", @@ -152,7 +152,7 @@ func TestGenerateCategoryStatusRow(t *testing.T) { }, ControlID: "ctrlID", }, - expectedRows: []string{"test", "action required *", "https://hub.armosec.io/docs/ctrlid"}, + expectedRows: []string{"⚠️", "test", "https://hub.armosec.io/docs/ctrlid"}, infoToPrintInfo: []utils.InfoStars{ { Info: "testInfo", @@ -167,7 +167,7 @@ func TestGenerateCategoryStatusRow(t *testing.T) { Status: apis.StatusPassed, ControlID: "ctrlID", }, - expectedRows: []string{"test", "passed", "https://hub.armosec.io/docs/ctrlid"}, + expectedRows: []string{"✅", "test", "https://hub.armosec.io/docs/ctrlid"}, }, { name: "big name", @@ -176,7 +176,7 @@ func TestGenerateCategoryStatusRow(t *testing.T) { Status: apis.StatusFailed, ControlID: "ctrlID", }, - expectedRows: []string{"testtesttesttesttesttesttesttesttesttesttesttestte...", "failed", "https://hub.armosec.io/docs/ctrlid"}, + expectedRows: []string{"❌", "testtesttesttesttesttesttesttesttesttesttesttestte...", "https://hub.armosec.io/docs/ctrlid"}, }, } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/workloadscan.go b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/workloadscan.go index fe6596e0..35cee54b 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/workloadscan.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/workloadscan.go @@ -60,16 +60,3 @@ func (wp *WorkloadPrinter) renderSingleCategoryTable(categoryName string, catego func (wp *WorkloadPrinter) initCategoryTableData() ([]string, []int) { return getCategoryStatusTypeHeaders(), getStatusTypeAlignments() } - -func (wp *WorkloadPrinter) generateCountingCategoryRow(controlSummary reportsummary.IControlSummary, infoToPrintInfo []utils.InfoStars) []string { - - row := make([]string, 3) - - row[0] = controlSummary.GetName() - - row[1] = getStatus(controlSummary.GetStatus(), controlSummary, infoToPrintInfo) - - row[2] = getDocsForControl(controlSummary) - - return row -} diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/workloadscan_test.go b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/workloadscan_test.go index 37d99304..ccf10deb 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/workloadscan_test.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter/workloadscan_test.go @@ -1,20 +1,15 @@ package configurationprinter import ( - "reflect" "testing" - "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/utils" - "github.com/kubescape/opa-utils/reporthandling/apis" - "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" "github.com/olekukonko/tablewriter" - "github.com/stretchr/testify/assert" ) func TestWorkloadScan_InitCategoryTableData(t *testing.T) { - expectedHeader := []string{"CONTROL NAME", "STATUS", "DOCS"} - expectedAlign := []int{tablewriter.ALIGN_LEFT, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER} + expectedHeader := []string{"", "CONTROL NAME", "DOCS"} + expectedAlign := []int{tablewriter.ALIGN_CENTER, tablewriter.ALIGN_LEFT, tablewriter.ALIGN_CENTER} workloadPrinter := NewWorkloadPrinter() @@ -33,85 +28,3 @@ func TestWorkloadScan_InitCategoryTableData(t *testing.T) { } } - -func TestWorkloadScan_GenerateCountingCategoryRow(t *testing.T) { - tests := []struct { - name string - controlSummary reportsummary.IControlSummary - infoToPrint []utils.InfoStars - expectedRows []string - }{ - { - name: "1 failed control", - controlSummary: &reportsummary.ControlSummary{ - StatusInfo: apis.StatusInfo{ - InnerStatus: apis.StatusFailed, - }, - ControlID: "ctrl1", - Name: "ctrl1", - StatusCounters: reportsummary.StatusCounters{ - FailedResources: 1, - }, - }, - expectedRows: []string{"ctrl1", "failed", "https://hub.armosec.io/docs/ctrl1"}, - }, - { - name: "multiple failed controls", - controlSummary: &reportsummary.ControlSummary{ - StatusInfo: apis.StatusInfo{ - InnerStatus: apis.StatusFailed, - }, - ControlID: "ctrl1", - Name: "ctrl1", - StatusCounters: reportsummary.StatusCounters{ - FailedResources: 5, - }, - }, - expectedRows: []string{"ctrl1", "failed", "https://hub.armosec.io/docs/ctrl1"}, - }, - { - name: "no failed controls", - controlSummary: &reportsummary.ControlSummary{ - StatusInfo: apis.StatusInfo{ - InnerStatus: apis.StatusPassed, - }, - ControlID: "ctrl1", - Name: "ctrl1", - StatusCounters: reportsummary.StatusCounters{ - FailedResources: 0, - }, - }, - expectedRows: []string{"ctrl1", "passed", "https://hub.armosec.io/docs/ctrl1"}, - }, - { - name: "action required", - infoToPrint: []utils.InfoStars{ - { - Info: "action required", - Stars: "*", - }, - }, - controlSummary: &reportsummary.ControlSummary{ - ControlID: "ctrl1", - StatusInfo: apis.StatusInfo{ - InnerStatus: apis.StatusSkipped, - InnerInfo: "action required", - }, - Name: "ctrl1", - StatusCounters: reportsummary.StatusCounters{ - SkippedResources: 1, - }, - }, - expectedRows: []string{"ctrl1", "action required *", "https://hub.armosec.io/docs/ctrl1"}, - }, - } - - workloadPrinter := NewWorkloadPrinter() - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - row := workloadPrinter.generateCountingCategoryRow(tt.controlSummary, tt.infoToPrint) - assert.True(t, reflect.DeepEqual(row, tt.expectedRows)) - }) - } -} diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter/utils.go b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter/utils.go index 201d3bdf..e9fed4aa 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter/utils.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter/utils.go @@ -6,9 +6,7 @@ import ( "strings" v5 "github.com/anchore/grype/grype/db/v5" - "github.com/jwalton/gchalk" "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/utils" - "github.com/kubescape/opa-utils/reporthandling/apis" "github.com/olekukonko/tablewriter" ) @@ -47,7 +45,7 @@ func generateRows(summary ImageScanSummary) [][]string { func generateRow(cve CVE) []string { row := make([]string, 5) - row[imageColumnSeverity] = getColor(cve.Severity)(cve.Severity) + row[imageColumnSeverity] = utils.GetColorForVulnerabilitySeverity(cve.Severity)(cve.Severity) row[imageColumnName] = cve.ID row[imageColumnComponent] = cve.Package row[imageColumnVersion] = cve.Version @@ -66,7 +64,7 @@ func generateRow(cve CVE) []string { func getImageScanningHeaders() []string { headers := make([]string, 5) headers[imageColumnSeverity] = "SEVERITY" - headers[imageColumnName] = "NAME" + headers[imageColumnName] = "VULNERABILITY" headers[imageColumnComponent] = "COMPONENT" headers[imageColumnVersion] = "VERSION" headers[imageColumnFixedIn] = "FIXED IN" @@ -76,20 +74,3 @@ func getImageScanningHeaders() []string { func getImageScanningColumnsAlignments() []int { return []int{tablewriter.ALIGN_CENTER, tablewriter.ALIGN_LEFT, tablewriter.ALIGN_LEFT, tablewriter.ALIGN_LEFT, tablewriter.ALIGN_LEFT} } - -func getColor(severity string) func(...string) string { - switch severity { - case apis.SeverityCriticalString: - return gchalk.WithAnsi256(1).Bold - case apis.SeverityHighString: - return gchalk.WithAnsi256(196).Bold - case apis.SeverityMediumString: - return gchalk.WithAnsi256(166).Bold - case apis.SeverityLowString: - return gchalk.WithAnsi256(220).Bold - case apis.SeverityNegligibleString: - return gchalk.WithAnsi256(39).Bold - default: - return gchalk.WithAnsi256(30).Bold - } -} diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter/utils_test.go b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter/utils_test.go index ecb92e0c..c23b9424 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter/utils_test.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter/utils_test.go @@ -140,7 +140,7 @@ func TestGenerateRow(t *testing.T) { func TestGetImageScanningHeaders(t *testing.T) { headers := getImageScanningHeaders() - expectedHeaders := []string{"SEVERITY", "NAME", "COMPONENT", "VERSION", "FIXED IN"} + expectedHeaders := []string{"SEVERITY", "VULNERABILITY", "COMPONENT", "VERSION", "FIXED IN"} for i := range headers { if headers[i] != expectedHeaders[i] { diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/utils/utils.go b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/utils/utils.go index 24a0acf2..4d24dc4f 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/utils/utils.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/utils/utils.go @@ -55,7 +55,7 @@ func MapInfoToPrintInfo(controls reportsummary.ControlSummaries) []InfoStars { return infoToPrintInfo } -func GetColor(severity int) (func(...string) string) { +func GetColor(severity int) func(...string) string { switch severity { case apis.SeverityCritical: return gchalk.WithAnsi256(1).Bold @@ -112,7 +112,7 @@ func PrintInfo(writer io.Writer, infoToPrintInfo []InfoStars) { } } -func GetStatusColor(status apis.ScanningStatus) (func(...string) string) { +func GetStatusColor(status apis.ScanningStatus) func(...string) string { switch status { case apis.StatusPassed: return gchalk.WithGreen().Bold @@ -125,18 +125,16 @@ func GetStatusColor(status apis.ScanningStatus) (func(...string) string) { } } -func getColor(controlSeverity int) (func(...string) string) { - switch controlSeverity { - case apis.SeverityCritical: - return gchalk.WithAnsi256(1).Bold - case apis.SeverityHigh: - return gchalk.WithAnsi256(196).Bold - case apis.SeverityMedium: - return gchalk.WithAnsi256(166).Bold - case apis.SeverityLow: - return gchalk.WithAnsi256(220).Bold +func GetStatusIcon(status apis.ScanningStatus) string { + switch status { + case apis.StatusPassed: + return "✅" + case apis.StatusFailed: + return "❌" + case apis.StatusSkipped: + return "⚠️" default: - return gchalk.WithAnsi256(16).Bold + return "⚠️" } } @@ -168,3 +166,22 @@ func CheckShortTerminalWidth(rows [][]string, headers []string) bool { } return termWidth <= maxWidth } + +func GetColorForVulnerabilitySeverity(severity string) func(...string) string { + switch severity { + case apis.SeverityCriticalString: + return gchalk.WithAnsi256(1).Bold + case apis.SeverityHighString: + return gchalk.WithAnsi256(196).Bold + case apis.SeverityMediumString: + return gchalk.WithAnsi256(166).Bold + case apis.SeverityLowString: + return gchalk.WithAnsi256(220).Bold + case apis.SeverityNegligibleString: + return gchalk.WithAnsi256(39).Bold + case apis.SeverityUnknownString: + return gchalk.WithAnsi256(30).Bold + default: + return gchalk.WithAnsi256(7).Bold + } +} diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/utils.go b/core/pkg/resultshandling/printer/v2/prettyprinter/utils.go index fcb262e8..c52adaac 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/utils.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/utils.go @@ -17,16 +17,17 @@ import ( ) const ( - linkToHelm = "https://github.com/kubescape/helm-charts" - linkToCICDSetup = "https://hub.armosec.io/docs/integrations" configScanVerboseRunText = "Run with '--verbose'/'-v' flag for detailed resources view" imageScanVerboseRunText = "Run with '--verbose'/'-v' flag for detailed vulnerabilities view" + runCommandsText = "Run one of the suggested commands to learn more about a failed control failure" + ksHelmChartLink = "https://github.com/kubescape/helm-charts/tree/main/charts/kubescape-cloud-operator" + highStakesWlsText = "High-stakes workloads are defined as those which Kubescape estimates would have the highest impact if they were to be exploited.\n\n" ) var ( + scanWorkloadText = fmt.Sprintf("Scan a workload with %s to see vulnerability information", getCallToActionString("'$ kubescape scan workload'")) + installKubescapeText = fmt.Sprintf("Install Kubescape in your cluster for continuous monitoring and a full vulnerability report: %s", ksHelmChartLink) clusterScanRunText = fmt.Sprintf("Run a cluster scan: %s", getCallToActionString("'$ kubescape scan'")) - installHelmText = fmt.Sprintf("Install Kubescape in your cluster for continuous monitoring: %s", linkToHelm) - CICDSetupText = fmt.Sprintf("Add Kubescape to your CI/CD pipeline: %s", linkToCICDSetup) complianceFrameworks = []string{"nsa", "mitre"} cveSeverities = []string{"Critical", "High", "Medium", "Low", "Negligible", "Unknown"} ) @@ -53,11 +54,8 @@ func getWorkloadPrefixForCmd(namespace, kind, name string) string { } func getTopWorkloadsTitle(topWLsLen int) string { - if topWLsLen > 1 { - return "Your highest stake workloads:\n" - } if topWLsLen > 0 { - return "Your highest stake workload:\n" + return "Highest-stake workloads\n" } return "" } @@ -205,11 +203,15 @@ func printImageScanningSummary(writer *os.File, summary imageprinter.ImageScanSu }) if len(summary.CVEs) == 0 { - cautils.InfoTextDisplay(writer, "Vulnerability summary - no vulnerabilities were found!\n\n") + txt := "Vulnerability summary - no vulnerabilities were found!" + cautils.InfoTextDisplay(writer, txt+"\n") + cautils.SimpleDisplay(writer, strings.Repeat("─", len(txt))+"\n") return } - cautils.InfoTextDisplay(writer, "Vulnerability summary - %d vulnerabilities found:\n", len(summary.CVEs)) + txt := fmt.Sprintf("Vulnerability summary - %d vulnerabilities found:", len(summary.CVEs)) + cautils.InfoTextDisplay(writer, txt+"\n") + cautils.SimpleDisplay(writer, strings.Repeat("─", len(txt))+"\n") if len(summary.Images) == 1 { cautils.SimpleDisplay(writer, "Image: %s\n", summary.Images[0]) @@ -218,28 +220,32 @@ func printImageScanningSummary(writer *os.File, summary imageprinter.ImageScanSu } for _, k := range keys { - if k == "Other" { - cautils.SimpleDisplay(writer, " * %d %s \n", mapSeverityTSummary[k].NumberOfCVEs, k) - } else { - cautils.SimpleDisplay(writer, " * %d %s\n", mapSeverityTSummary[k].NumberOfCVEs, k) - } + cautils.SimpleDisplay(writer, " * %d %s \n", mapSeverityTSummary[k].NumberOfCVEs, utils.GetColorForVulnerabilitySeverity(k)(k)) } } func printImagesCommands(writer *os.File, summary imageprinter.ImageScanSummary) { - for _, img := range summary.Images { - imgWithoutTag := strings.Split(img, ":")[0] - cautils.SimpleDisplay(writer, fmt.Sprintf("Receive full report for %s image by running: %s\n", imgWithoutTag, getCallToActionString(fmt.Sprintf("'$ kubescape scan image %s'", img)))) + if len(summary.Images) > 3 { + cautils.SimpleDisplay(writer, "Receive full report by running: kubescape scan image \n") + } else { + for _, img := range summary.Images { + imgWithoutTag := strings.Split(img, ":")[0] + cautils.SimpleDisplay(writer, fmt.Sprintf("Receive full report for %s image by running: %s\n", imgWithoutTag, getCallToActionString(fmt.Sprintf("'$ kubescape scan image %s'", img)))) + } } cautils.InfoTextDisplay(writer, "\n") } func printNextSteps(writer *os.File, nextSteps []string, addLine bool) { - cautils.InfoTextDisplay(writer, "Follow-up steps:\n") + txt := "What now?" + cautils.InfoTextDisplay(writer, fmt.Sprintf("%s\n", txt)) + + cautils.SimpleDisplay(writer, fmt.Sprintf("%s\n", strings.Repeat("─", len(txt)))) + for _, ns := range nextSteps { - cautils.SimpleDisplay(writer, "- "+ns+"\n") + cautils.SimpleDisplay(writer, "* "+ns+"\n") } if addLine { cautils.SimpleDisplay(writer, "\n") @@ -247,12 +253,18 @@ func printNextSteps(writer *os.File, nextSteps []string, addLine bool) { } func printComplianceScore(writer *os.File, frameworks []reportsummary.IFrameworkSummary) { - cautils.InfoTextDisplay(writer, "Compliance Score:\n") + txt := "Compliance Score" + cautils.InfoTextDisplay(writer, fmt.Sprintf("%s\n", txt)) + + cautils.SimpleDisplay(writer, fmt.Sprintf("%s\n", strings.Repeat("─", len(txt)))) + + cautils.SimpleDisplay(writer, "The compliance score is calculated by multiplying control failures by the number of failures against supported compliance frameworks. Remediate controls, or configure your cluster baseline with exceptions, to improve this score.\n\n") + for _, fw := range frameworks { - cautils.SimpleDisplay(writer, "* %s: %.2f%%\n", fw.GetName(), fw.GetComplianceScore()) + cautils.SimpleDisplay(writer, "* %s: %s", fw.GetName(), gchalk.WithYellow().Bold(fmt.Sprintf("%.2f%%\n", fw.GetComplianceScore()))) } - cautils.SimpleDisplay(writer, fmt.Sprintf("View full compliance report by running: %s\n", getCallToActionString("'$ kubescape scan framework nsa,mitre'"))) + cautils.SimpleDisplay(writer, fmt.Sprintf("\nView a full compliance report by running %s or %s\n", getCallToActionString("'$ kubescape scan framework nsa'"), getCallToActionString("'$ kubescape scan framework mitre'"))) cautils.InfoTextDisplay(writer, "\n") } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/utils_test.go b/core/pkg/resultshandling/printer/v2/prettyprinter/utils_test.go index 60a568f2..e17ca36d 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/utils_test.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/utils_test.go @@ -88,13 +88,13 @@ func TestGetTopWorkloadsTitle(t *testing.T) { assert.Equal(t, "", title) title = getTopWorkloadsTitle(1) - assert.Equal(t, "Your highest stake workload:\n", title) + assert.Equal(t, "Highest-stake workloads\n", title) title = getTopWorkloadsTitle(2) - assert.Equal(t, "Your highest stake workloads:\n", title) + assert.Equal(t, "Highest-stake workloads\n", title) title = getTopWorkloadsTitle(10) - assert.Equal(t, "Your highest stake workloads:\n", title) + assert.Equal(t, "Highest-stake workloads\n", title) } func TestGetSeverityToSummaryMap(t *testing.T) { diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/workloadscan.go b/core/pkg/resultshandling/printer/v2/prettyprinter/workloadscan.go index ab977eab..61f82621 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/workloadscan.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/workloadscan.go @@ -5,6 +5,7 @@ import ( "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/configurationprinter" "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2/prettyprinter/tableprinter/imageprinter" + "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" ) @@ -33,13 +34,13 @@ func (wp *WorkloadPrinter) PrintNextSteps() { func (wp *WorkloadPrinter) getNextSteps() []string { return []string{ + runCommandsText, configScanVerboseRunText, - installHelmText, - CICDSetupText, + installKubescapeText, } } -func (wp *WorkloadPrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string) { +func (wp *WorkloadPrinter) PrintConfigurationsScanning(summaryDetails *reportsummary.SummaryDetails, sortedControlIDs [][]string, topWorkloadsByScore []reporthandling.IResource) { wp.categoriesTablePrinter.PrintCategoriesTables(wp.writer, summaryDetails, sortedControlIDs) } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter/workloadscan_test.go b/core/pkg/resultshandling/printer/v2/prettyprinter/workloadscan_test.go index 50973138..a9823c90 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter/workloadscan_test.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter/workloadscan_test.go @@ -11,15 +11,16 @@ func TestWorkloadScan_getNextSteps(t *testing.T) { t.Errorf("Expected 3 next steps, got %d", len(nextSteps)) } - if nextSteps[0] != configScanVerboseRunText { + if nextSteps[0] != runCommandsText { + t.Errorf("Expected %s, got %s", runCommandsText, nextSteps[0]) + } + + if nextSteps[1] != configScanVerboseRunText { t.Errorf("Expected %s, got %s", configScanVerboseRunText, nextSteps[0]) } - if nextSteps[1] != installHelmText { - t.Errorf("Expected %s, got %s", installHelmText, nextSteps[1]) + if nextSteps[2] != installKubescapeText { + t.Errorf("Expected %s, got %s", installKubescapeText, nextSteps[1]) } - if nextSteps[2] != CICDSetupText { - t.Errorf("Expected %s, got %s", CICDSetupText, nextSteps[2]) - } } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter_test.go b/core/pkg/resultshandling/printer/v2/prettyprinter_test.go index b0c0dd81..63c423b7 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter_test.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter_test.go @@ -1 +1,55 @@ package printer + +import ( + "testing" + + "github.com/kubescape/kubescape/v2/core/cautils" +) + +func TestIsPrintSeparatorType(t *testing.T) { + tests := []struct { + name string + expected bool + scanType cautils.ScanTypes + }{ + { + name: "cluster scan", + scanType: cautils.ScanTypeCluster, + expected: false, + }, + { + name: "repo scan", + scanType: cautils.ScanTypeRepo, + expected: false, + }, + { + name: "workload scan", + scanType: cautils.ScanTypeWorkload, + expected: false, + }, + { + name: "control scan", + scanType: cautils.ScanTypeControl, + expected: true, + }, + { + name: "framework scan", + scanType: cautils.ScanTypeFramework, + expected: true, + }, + { + name: "image scan", + scanType: cautils.ScanTypeImage, + expected: false, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + got := isPrintSeparatorType(test.scanType) + if got != test.expected { + t.Errorf("%s failed - expected %t, got %t", test.name, test.expected, got) + } + }) + } +} diff --git a/core/pkg/resultshandling/printer/v2/prometheus.go b/core/pkg/resultshandling/printer/v2/prometheus.go index 49bb3c58..cc560e6f 100644 --- a/core/pkg/resultshandling/printer/v2/prometheus.go +++ b/core/pkg/resultshandling/printer/v2/prometheus.go @@ -56,6 +56,10 @@ func (pp *PrometheusPrinter) PrintImageScan(context.Context, *models.PresenterCo } func (pp *PrometheusPrinter) ActionPrint(ctx context.Context, opaSessionObj *cautils.OPASessionObj, imageScanData []cautils.ImageScanData) { + if opaSessionObj == nil { + logger.L().Ctx(ctx).Error("failed to print results, missing data") + return + } metrics := pp.generatePrometheusFormat(opaSessionObj.AllResources, opaSessionObj.ResourcesResult, &opaSessionObj.Report.SummaryDetails) diff --git a/core/pkg/resultshandling/printer/v2/sarifprinter.go b/core/pkg/resultshandling/printer/v2/sarifprinter.go index ac5d5bf8..7eba215f 100644 --- a/core/pkg/resultshandling/printer/v2/sarifprinter.go +++ b/core/pkg/resultshandling/printer/v2/sarifprinter.go @@ -10,6 +10,7 @@ import ( "strconv" "strings" + "github.com/anchore/grype/grype/presenter" "github.com/anchore/grype/grype/presenter/models" logger "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" @@ -110,7 +111,14 @@ func (sp *SARIFPrinter) addResult(scanRun *sarif.Run, ctl reportsummary.IControl }) } -func (sp *SARIFPrinter) PrintImageScan(context.Context, *models.PresenterConfig) { +func (sp *SARIFPrinter) printImageScan(scanResults *models.PresenterConfig) error { + if scanResults == nil { + return fmt.Errorf("no no image vulnerability data provided") + } + + pres := presenter.GetPresenter(printer.SARIFFormat, "", false, *scanResults) + + return pres.Present(sp.writer) } func (sp *SARIFPrinter) PrintNextSteps() { @@ -118,9 +126,32 @@ func (sp *SARIFPrinter) PrintNextSteps() { } func (sp *SARIFPrinter) ActionPrint(ctx context.Context, opaSessionObj *cautils.OPASessionObj, imageScanData []cautils.ImageScanData) { + if opaSessionObj == nil { + if len(imageScanData) == 0 { + logger.L().Ctx(ctx).Fatal("failed to write results in sarif format: no data provided") + return + } + + // image scan + if err := sp.printImageScan(imageScanData[0].PresenterConfig); err != nil { + logger.L().Ctx(ctx).Error("failed to write results in sarif format", helpers.Error(err)) + return + } + } else { + // configuration scan + if err := sp.printConfigurationScan(ctx, opaSessionObj); err != nil { + logger.L().Ctx(ctx).Error("failed to write results in sarif format", helpers.Error(err)) + return + } + + } + printer.LogOutputFile(sp.writer.Name()) +} + +func (sp *SARIFPrinter) printConfigurationScan(ctx context.Context, opaSessionObj *cautils.OPASessionObj) error { report, err := sarif.New(sarif.Version210) if err != nil { - panic(err) + return err } run := sarif.NewRunWithInformationURI(toolName, toolInfoURI) @@ -161,7 +192,7 @@ func (sp *SARIFPrinter) ActionPrint(ctx context.Context, opaSessionObj *cautils. report.PrettyWrite(sp.writer) - printer.LogOutputFile(sp.writer.Name()) + return nil } func (sp *SARIFPrinter) resolveFixLocation(opaSessionObj *cautils.OPASessionObj, locationResolver *locationresolver.FixPathLocationResolver, ac *resourcesresults.ResourceAssociatedControl, resourceID string) locationresolver.Location { diff --git a/core/pkg/resultshandling/printer/v2/utils.go b/core/pkg/resultshandling/printer/v2/utils.go index a379f41e..6576797f 100644 --- a/core/pkg/resultshandling/printer/v2/utils.go +++ b/core/pkg/resultshandling/printer/v2/utils.go @@ -14,6 +14,8 @@ import ( reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" ) +const indicator = "†" + // finalizeV2Report finalize the results objects by copying data from map to lists func FinalizeResults(data *cautils.OPASessionObj) *reporthandlingv2.PostureReport { report := reporthandlingv2.PostureReport{ @@ -57,7 +59,7 @@ type infoStars struct { func mapInfoToPrintInfo(controls reportsummary.ControlSummaries) []infoStars { infoToPrintInfo := []infoStars{} infoToPrintInfoMap := map[string]interface{}{} - starCount := "*" + starCount := indicator for _, control := range controls { if control.GetStatus().IsSkipped() && control.GetStatus().Info() != "" { if _, ok := infoToPrintInfoMap[control.GetStatus().Info()]; !ok { @@ -65,7 +67,7 @@ func mapInfoToPrintInfo(controls reportsummary.ControlSummaries) []infoStars { info: control.GetStatus().Info(), stars: starCount, }) - starCount += "*" + starCount += indicator infoToPrintInfoMap[control.GetStatus().Info()] = nil } } diff --git a/core/pkg/resultshandling/reporter/interface.go b/core/pkg/resultshandling/reporter/interface.go index b2d4edbf..4f8399c8 100644 --- a/core/pkg/resultshandling/reporter/interface.go +++ b/core/pkg/resultshandling/reporter/interface.go @@ -8,8 +8,6 @@ import ( type IReport interface { Submit(ctx context.Context, opaSessionObj *cautils.OPASessionObj) error - SetCustomerGUID(customerGUID string) - SetClusterName(clusterName string) - DisplayReportURL() - GetURL() string + SetTenantConfig(tenantConfig cautils.ITenantConfig) + DisplayMessage() } diff --git a/core/pkg/resultshandling/reporter/v2/mockreporter.go b/core/pkg/resultshandling/reporter/v2/mockreporter.go index a4489dab..028aab97 100644 --- a/core/pkg/resultshandling/reporter/v2/mockreporter.go +++ b/core/pkg/resultshandling/reporter/v2/mockreporter.go @@ -27,10 +27,7 @@ func (reportMock *ReportMock) Submit(_ context.Context, opaSessionObj *cautils.O return nil } -func (reportMock *ReportMock) SetCustomerGUID(customerGUID string) { -} - -func (reportMock *ReportMock) SetClusterName(clusterName string) { +func (reportMock *ReportMock) SetTenantConfig(tenantConfig cautils.ITenantConfig) { } func (reportMock *ReportMock) GetURL() string { @@ -42,7 +39,7 @@ func (reportMock *ReportMock) GetURL() string { return u.String() } -func (reportMock *ReportMock) DisplayReportURL() { +func (reportMock *ReportMock) DisplayMessage() { if m := reportMock.strToDisplay(); m != "" { cautils.InfoTextDisplay(os.Stderr, m) } diff --git a/core/pkg/resultshandling/reporter/v2/mockreporter_test.go b/core/pkg/resultshandling/reporter/v2/mockreporter_test.go index f8055a90..24cc7ed4 100644 --- a/core/pkg/resultshandling/reporter/v2/mockreporter_test.go +++ b/core/pkg/resultshandling/reporter/v2/mockreporter_test.go @@ -67,18 +67,11 @@ func TestReportMockGetURL(t *testing.T) { var reportMock reporter.IReport = NewReportMock(tc.fields.query, tc.fields.message) - t.Run("mock reports should support GetURL", func(t *testing.T) { - got := reportMock.GetURL() - require.Equalf(t, tc.want, got, - "ReportMock.GetURL() = %v, want %v", got, tc.want, - ) - }) - - t.Run("mock reports should support DisplayReportURL", func(t *testing.T) { + t.Run("mock reports should support DisplayMessage", func(t *testing.T) { capture, clean := captureStderr(t) defer clean() - reportMock.DisplayReportURL() + reportMock.DisplayMessage() require.NoError(t, capture.Close()) buf, err := os.ReadFile(capture.Name()) diff --git a/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go b/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go index a7823c7f..a17ebbff 100644 --- a/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go +++ b/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go @@ -7,9 +7,12 @@ import ( "net/http" "net/url" "os" + "strings" "time" "github.com/armosec/armoapi-go/apis" + client "github.com/kubescape/backend/pkg/client/v1" + v1 "github.com/kubescape/backend/pkg/server/v1" logger "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" "github.com/kubescape/k8s-interface/workloadinterface" @@ -29,7 +32,6 @@ type SubmitContext string const ( SubmitContextScan SubmitContext = "scan" - SubmitContextRBAC SubmitContext = "rbac" SubmitContextRepository SubmitContext = "repository" ) @@ -38,25 +40,20 @@ var _ reporter.IReport = &ReportEventReceiver{} type ReportEventReceiver struct { reportTime time.Time httpClient *http.Client - clusterName string - customerGUID string + tenantConfig cautils.ITenantConfig eventReceiverURL *url.URL - token string - customerAdminEMail string message string reportID string submitContext SubmitContext + accountIdGenerated bool } -func NewReportEventReceiver(tenantConfig *cautils.ConfigObj, reportID string, submitContext SubmitContext) *ReportEventReceiver { +func NewReportEventReceiver(tenantConfig cautils.ITenantConfig, reportID string, submitContext SubmitContext) *ReportEventReceiver { return &ReportEventReceiver{ - httpClient: &http.Client{}, - clusterName: tenantConfig.ClusterName, - customerGUID: tenantConfig.AccountID, - token: tenantConfig.Token, - customerAdminEMail: tenantConfig.CustomerAdminEMail, - reportID: reportID, - submitContext: submitContext, + httpClient: &http.Client{}, + tenantConfig: tenantConfig, + reportID: reportID, + submitContext: submitContext, } } @@ -64,32 +61,41 @@ func (report *ReportEventReceiver) Submit(ctx context.Context, opaSessionObj *ca ctx, span := otel.Tracer("").Start(ctx, "reportEventReceiver.Submit") defer span.End() report.reportTime = time.Now().UTC() - - if report.customerGUID == "" { - logger.L().Ctx(ctx).Error("failed to publish results. Reason: Unknown account ID. Run kubescape with the '--account ' flag. Contact ARMO team for more details") - return nil + + if report.GetAccountID() == "" { + accountID, err := report.tenantConfig.GenerateAccountID() + if err != nil { + logger.L().Error("failed to generate account ID", helpers.String("reason", err.Error())) + return err + } + report.accountIdGenerated = true + logger.L().Debug("generated account ID", helpers.String("account ID", accountID)) } - if opaSessionObj.Metadata.ScanMetadata.ScanningTarget == reporthandlingv2.Cluster && report.clusterName == "" { + + if opaSessionObj.Metadata.ScanMetadata.ScanningTarget == reporthandlingv2.Cluster && report.GetClusterName() == "" { logger.L().Ctx(ctx).Error("failed to publish results because the cluster name is Unknown. If you are scanning YAML files the results are not submitted to the Kubescape SaaS") return nil } if err := report.prepareReport(opaSessionObj); err != nil { - return fmt.Errorf("failed to submit scan results. url: '%s', reason: %s", report.GetURL(), err.Error()) + return fmt.Errorf("failed to submit scan results. url: '%s', reason: %s", report.eventReceiverURL, err.Error()) } - report.generateMessage() - logger.L().Debug("", helpers.String("account ID", report.customerGUID)) + logger.L().Debug("", helpers.String("account ID", report.GetAccountID())) return nil } -func (report *ReportEventReceiver) SetCustomerGUID(customerGUID string) { - report.customerGUID = customerGUID +func (report *ReportEventReceiver) SetTenantConfig(tenantConfig cautils.ITenantConfig) { + report.tenantConfig = tenantConfig } -func (report *ReportEventReceiver) SetClusterName(clusterName string) { - report.clusterName = cautils.AdoptClusterName(clusterName) // clean cluster name +func (report *ReportEventReceiver) GetAccountID() string { + return report.tenantConfig.GetAccountID() +} + +func (report *ReportEventReceiver) GetClusterName() string { + return cautils.AdoptClusterName(report.tenantConfig.GetContextName()) // clean cluster name } func (report *ReportEventReceiver) prepareReport(opaSessionObj *cautils.OPASessionObj) error { @@ -107,46 +113,36 @@ func (report *ReportEventReceiver) prepareReport(opaSessionObj *cautils.OPASessi }() } - report.initEventReceiverURL() - host := hostToString(report.eventReceiverURL, report.reportID) + var err error + report.eventReceiverURL, err = client.GetPostureReportUrl(getter.GetKSCloudAPIConnector().GetCloudReportURL(), report.GetAccountID(), report.GetClusterName(), report.reportID) + if err != nil { + return err + } cautils.StartSpinner() + defer cautils.StopSpinner() - // send resources - err := report.sendResources(host, opaSessionObj) - - cautils.StopSpinner() - return err + return report.sendResources(opaSessionObj) } -func (report *ReportEventReceiver) GetURL() string { - u := url.URL{} - u.Host = getter.GetKSCloudAPIConnector().GetCloudUIURL() - - parseHost(&u) - report.addPathURL(&u) - - return u.String() - -} -func (report *ReportEventReceiver) sendResources(host string, opaSessionObj *cautils.OPASessionObj) error { +func (report *ReportEventReceiver) sendResources(opaSessionObj *cautils.OPASessionObj) error { splittedPostureReport := report.setSubReport(opaSessionObj) counter := 0 reportCounter := 0 - if err := report.setResources(splittedPostureReport, opaSessionObj.AllResources, opaSessionObj.ResourceSource, opaSessionObj.ResourcesResult, &counter, &reportCounter, host); err != nil { + if err := report.setResources(splittedPostureReport, opaSessionObj.AllResources, opaSessionObj.ResourceSource, opaSessionObj.ResourcesResult, &counter, &reportCounter); err != nil { return err } - if err := report.setResults(splittedPostureReport, opaSessionObj.ResourcesResult, opaSessionObj.AllResources, opaSessionObj.ResourceSource, opaSessionObj.ResourcesPrioritized, &counter, &reportCounter, host); err != nil { + if err := report.setResults(splittedPostureReport, opaSessionObj.ResourcesResult, opaSessionObj.AllResources, opaSessionObj.ResourceSource, opaSessionObj.ResourcesPrioritized, &counter, &reportCounter); err != nil { return err } - return report.sendReport(host, splittedPostureReport, reportCounter, true) + return report.sendReport(splittedPostureReport, reportCounter, true) } -func (report *ReportEventReceiver) setResults(reportObj *reporthandlingv2.PostureReport, results map[string]resourcesresults.Result, allResources map[string]workloadinterface.IMetadata, resourcesSource map[string]reporthandling.Source, prioritizedResources map[string]prioritization.PrioritizedResource, counter, reportCounter *int, host string) error { +func (report *ReportEventReceiver) setResults(reportObj *reporthandlingv2.PostureReport, results map[string]resourcesresults.Result, allResources map[string]workloadinterface.IMetadata, resourcesSource map[string]reporthandling.Source, prioritizedResources map[string]prioritization.PrioritizedResource, counter, reportCounter *int) error { for _, v := range results { // set result.RawResource resourceID := v.GetResourceID() @@ -172,7 +168,7 @@ func (report *ReportEventReceiver) setResults(reportObj *reporthandlingv2.Postur if *counter+len(r) >= MAX_REPORT_SIZE && len(reportObj.Results) > 0 { // send report - if err := report.sendReport(host, reportObj, *reportCounter, false); err != nil { + if err := report.sendReport(reportObj, *reportCounter, false); err != nil { return err } *reportCounter++ @@ -191,7 +187,7 @@ func (report *ReportEventReceiver) setResults(reportObj *reporthandlingv2.Postur return nil } -func (report *ReportEventReceiver) setResources(reportObj *reporthandlingv2.PostureReport, allResources map[string]workloadinterface.IMetadata, resourcesSource map[string]reporthandling.Source, results map[string]resourcesresults.Result, counter, reportCounter *int, host string) error { +func (report *ReportEventReceiver) setResources(reportObj *reporthandlingv2.PostureReport, allResources map[string]workloadinterface.IMetadata, resourcesSource map[string]reporthandling.Source, results map[string]resourcesresults.Result, counter, reportCounter *int) error { for resourceID, v := range allResources { /* @@ -214,7 +210,7 @@ func (report *ReportEventReceiver) setResources(reportObj *reporthandlingv2.Post if *counter+len(r) >= MAX_REPORT_SIZE && len(reportObj.Resources) > 0 { // send report - if err := report.sendReport(host, reportObj, *reportCounter, false); err != nil { + if err := report.sendReport(reportObj, *reportCounter, false); err != nil { return err } *reportCounter++ @@ -232,7 +228,8 @@ func (report *ReportEventReceiver) setResources(reportObj *reporthandlingv2.Post } return nil } -func (report *ReportEventReceiver) sendReport(host string, postureReport *reporthandlingv2.PostureReport, counter int, isLastReport bool) error { + +func (report *ReportEventReceiver) sendReport(postureReport *reporthandlingv2.PostureReport, counter int, isLastReport bool) error { postureReport.PaginationInfo = apis.PaginationMarks{ ReportNumber: counter, IsLastReport: isLastReport, @@ -241,55 +238,43 @@ func (report *ReportEventReceiver) sendReport(host string, postureReport *report if err != nil { return fmt.Errorf("in 'sendReport' failed to json.Marshal, reason: %v", err) } - msg, err := getter.HttpPost(report.httpClient, host, nil, reqBody) + strResponse, err := getter.HttpPost(report.httpClient, report.eventReceiverURL.String(), nil, reqBody) if err != nil { - return fmt.Errorf("%s, %v:%s", host, err, msg) + // in case of error, we need to revert the generated account ID + // otherwise the next run will fail using a non existing account ID + if report.accountIdGenerated { + report.tenantConfig.DeleteAccountID() + } + + return fmt.Errorf("%s, %v:%s", report.eventReceiverURL.String(), err, strResponse) } + + // message is taken only from last report + if strResponse != "" && isLastReport { + response := v1.PostureReportResponse{} + if unmarshalErr := json.Unmarshal([]byte(strResponse), &response); unmarshalErr != nil { + logger.L().Error("failed to unmarshal server response") + } else { + report.setMessage(response.Message) + } + } + return err } -func (report *ReportEventReceiver) generateMessage() { - report.message = "" - - sep := "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n" - report.message = sep - report.message += "Now, take your scan results to the next level with actionable insights on ARMO Platform.\n\n" - report.message += fmt.Sprintf("Sign up for free here - %s\n", report.GetURL()) - report.message += sep - +func (report *ReportEventReceiver) setMessage(message string) { + report.message = message } -func (report *ReportEventReceiver) DisplayReportURL() { +func (report *ReportEventReceiver) DisplayMessage() { // print if logger level is lower than warning (debug/info) if report.message != "" && helpers.ToLevel(logger.L().GetLevel()) < helpers.WarningLevel { - cautils.InfoTextDisplay(os.Stderr, fmt.Sprintf("\n\n%s\n\n", report.message)) + txt := "View results" + cautils.InfoTextDisplay(os.Stderr, fmt.Sprintf("\n%s\n", txt)) + + cautils.SimpleDisplay(os.Stderr, strings.Repeat("─", len(txt))) + + cautils.SimpleDisplay(os.Stderr, fmt.Sprintf("\n%s\n\n", report.message)) } } - -func (report *ReportEventReceiver) addPathURL(urlObj *url.URL) { - if report.customerAdminEMail != "" || report.token == "" { // data has been submitted - switch report.submitContext { - case SubmitContextScan: - urlObj.Path = fmt.Sprintf("compliance/%s", report.clusterName) - case SubmitContextRBAC: - urlObj.Path = "rbac-visualizer" - case SubmitContextRepository: - urlObj.Path = fmt.Sprintf("repository-scanning/%s", report.reportID) - default: - urlObj.Path = "dashboard" - } - return - } - urlObj.Path = "account/sign-up" - - q := urlObj.Query() - q.Add("invitationToken", report.token) - q.Add("customerGUID", report.customerGUID) - - // Adding utm parameters - q.Add("utm_source", "ARMOgithub") - q.Add("utm_medium", "createaccount") - urlObj.RawQuery = q.Encode() - -} diff --git a/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go b/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go index dcfcd7f0..2555f171 100644 --- a/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go +++ b/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go @@ -3,7 +3,6 @@ package reporter import ( "context" "math/rand" - "net/url" "os" "strconv" "sync" @@ -20,282 +19,58 @@ import ( // mxStdio serializes the capture of os.Stderr or os.Stdout var mxStdio sync.Mutex -func TestReportEventReceiver_addPathURL(t *testing.T) { - t.Parallel() - - tests := []struct { - report *ReportEventReceiver - urlObj *url.URL - want *url.URL - name string - }{ - { - name: "URL for submitted data", - report: &ReportEventReceiver{ - clusterName: "test", - customerGUID: "FFFF", - token: "XXXX", - customerAdminEMail: "test@test", - reportID: "1234", - submitContext: SubmitContextScan, - }, - urlObj: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - }, - want: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - Path: "compliance/test", - RawQuery: "", - }, - }, - { - name: "URL for first scan", - report: &ReportEventReceiver{ - clusterName: "test", - customerGUID: "FFFF", - token: "XXXX", - reportID: "1234", - submitContext: SubmitContextScan, - }, - urlObj: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - }, - want: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - Path: "account/sign-up", - RawQuery: "customerGUID=FFFF&invitationToken=XXXX&utm_medium=createaccount&utm_source=ARMOgithub", - }, - }, - { - name: "add rbac path", - report: &ReportEventReceiver{ - clusterName: "test", - customerGUID: "FFFF", - token: "XXXX", - customerAdminEMail: "test@test", - reportID: "1234", - submitContext: SubmitContextRBAC, - }, - urlObj: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - }, - want: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - Path: "rbac-visualizer", - }, - }, - { - name: "add repository path", - report: &ReportEventReceiver{ - clusterName: "test", - customerGUID: "FFFF", - token: "XXXX", - customerAdminEMail: "test@test", - reportID: "1234", - submitContext: SubmitContextRepository, - }, - urlObj: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - }, - want: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - Path: "repository-scanning/1234", - }, - }, - { - name: "add default path", - report: &ReportEventReceiver{ - clusterName: "test", - customerGUID: "FFFF", - token: "XXXX", - customerAdminEMail: "test@test", - reportID: "1234", - submitContext: SubmitContext("invalid"), - }, - urlObj: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - }, - want: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - Path: "dashboard", - }, - }, - { - name: "path when no email and no token", - report: &ReportEventReceiver{ - clusterName: "test", - customerGUID: "FFFF", - token: "", - customerAdminEMail: "", - reportID: "1234", - submitContext: SubmitContextScan, - }, - urlObj: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - }, - want: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - Path: "compliance/test", - }, - }, - { - name: "path when email and no token", - report: &ReportEventReceiver{ - clusterName: "test", - customerGUID: "FFFF", - token: "", - customerAdminEMail: "test@test", - reportID: "1234", - submitContext: SubmitContextScan, - }, - urlObj: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - }, - want: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - Path: "compliance/test", - }, - }, - { - name: "path when no email and token", - report: &ReportEventReceiver{ - clusterName: "test", - customerGUID: "FFFF", - token: "XYZ", - customerAdminEMail: "", - reportID: "1234", - submitContext: SubmitContextScan, - }, - urlObj: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - }, - want: &url.URL{ - Scheme: "https", - Host: "localhost:8080", - Path: "account/sign-up", - RawQuery: "customerGUID=FFFF&invitationToken=XYZ&utm_medium=createaccount&utm_source=ARMOgithub", - }, - }, - } - for _, toPin := range tests { - tc := toPin - - t.Run(tc.name, func(t *testing.T) { - t.Parallel() - - tc.report.addPathURL(tc.urlObj) - require.Equal(t, tc.want.String(), tc.urlObj.String()) - }) - } +type TenantConfigMock struct { + clusterName string + accountID string } -func TestGetURL(t *testing.T) { - t.Parallel() +const testGeneratedAccountIDString = "6a1ff233-5297-4193-bb51-5d67bc841cbf" - t.Run("with scan submit and registered url", func(t *testing.T) { - t.Parallel() - - reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1234", - Token: "token", - CustomerAdminEMail: "my@email", - ClusterName: "test", - }, - "", - SubmitContextScan, - ) - assert.Equal(t, "https://cloud.armosec.io/compliance/test", reporter.GetURL()) - }) - - t.Run("with rbac submit and registered url", func(t *testing.T) { - t.Parallel() - - reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1234", - Token: "token", - CustomerAdminEMail: "my@email", - ClusterName: "test", - }, - "", - SubmitContextRBAC, - ) - assert.Equal(t, "https://cloud.armosec.io/rbac-visualizer", reporter.GetURL()) - }) - - t.Run("with repository submit and registered url", func(t *testing.T) { - t.Parallel() - - reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1234", - Token: "token", - CustomerAdminEMail: "my@email", - ClusterName: "test", - }, - "XXXX", - SubmitContextRepository, - ) - assert.Equal(t, "https://cloud.armosec.io/repository-scanning/XXXX", reporter.GetURL()) - }) - - t.Run("with scan submit and NOT registered url", func(t *testing.T) { - t.Parallel() - - reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1234", - Token: "token", - ClusterName: "test", - }, - "", - SubmitContextScan, - ) - assert.Equal(t, "https://cloud.armosec.io/account/sign-up?customerGUID=1234&invitationToken=token&utm_medium=createaccount&utm_source=ARMOgithub", reporter.GetURL()) - }) - - t.Run("with unknown submit and NOT registered url (default route)", func(t *testing.T) { - t.Parallel() - - reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1234", - ClusterName: "test", - }, - "", - SubmitContext("unknown"), - ) - assert.Equal(t, "https://cloud.armosec.io/dashboard", reporter.GetURL()) - }) +func (tcm *TenantConfigMock) UpdateCachedConfig() error { + return nil +} +func (tcm *TenantConfigMock) DeleteCachedConfig(ctx context.Context) error { + return nil +} +func (tcm *TenantConfigMock) GetContextName() string { + return tcm.clusterName +} +func (tcm *TenantConfigMock) GetAccountID() string { + return tcm.accountID +} +func (tcm *TenantConfigMock) GetConfigObj() *cautils.ConfigObj { + return &cautils.ConfigObj{ + AccountID: tcm.accountID, + ClusterName: tcm.clusterName, + } +} +func (tcm *TenantConfigMock) GetCloudReportURL() string { + return "" +} +func (tcm *TenantConfigMock) GetCloudAPIURL() string { + return "" } -func TestDisplayReportURL(t *testing.T) { +func (tcm *TenantConfigMock) GenerateAccountID() (string, error) { + tcm.accountID = testGeneratedAccountIDString + return testGeneratedAccountIDString, nil +} + +func (tcm *TenantConfigMock) DeleteAccountID() error { + tcm.accountID = "" + return nil +} + +func TestDisplayMessage(t *testing.T) { t.Parallel() t.Run("should display an empty message", func(t *testing.T) { t.Parallel() reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1234", - Token: "token", - ClusterName: "test", + &TenantConfigMock{ + clusterName: "test", + accountID: "1234", }, "", SubmitContextScan, @@ -304,7 +79,7 @@ func TestDisplayReportURL(t *testing.T) { capture, clean := captureStderr(t) defer clean() - reporter.DisplayReportURL() + reporter.DisplayMessage() require.NoError(t, capture.Close()) buf, err := os.ReadFile(capture.Name()) @@ -317,28 +92,26 @@ func TestDisplayReportURL(t *testing.T) { t.Parallel() reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1234", - Token: "token", - ClusterName: "test", + &TenantConfigMock{ + clusterName: "test", + accountID: "1234", }, "", SubmitContextScan, ) - reporter.generateMessage() + reporter.setMessage("message returned from server") capture, clean := captureStderr(t) defer clean() - reporter.DisplayReportURL() + reporter.DisplayMessage() require.NoError(t, capture.Close()) buf, err := os.ReadFile(capture.Name()) require.NoError(t, err) require.NotEmpty(t, buf) - assert.Contains(t, string(buf), "Now") - assert.Contains(t, string(buf), "https://cloud.armosec.io/account/sign-up") + assert.Contains(t, string(buf), "message returned from server") t.Log(string(buf)) }) @@ -360,10 +133,9 @@ func TestPrepareReport(t *testing.T) { } reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1e3ae7c4-a8bb-4d7c-9bdf-eb86bc25e6bb", - Token: "token", - ClusterName: "test", + &TenantConfigMock{ + clusterName: "test", + accountID: "1e3ae7c4-a8bb-4d7c-9bdf-eb86bc25e6bb", }, "", SubmitContextScan, @@ -398,10 +170,9 @@ func TestSubmit(t *testing.T) { t.Run("should submit simple report", func(t *testing.T) { reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1e3ae7c4-a8bb-4d7c-9bdf-eb86bc25e6bb", - Token: "", - ClusterName: "test", + &TenantConfigMock{ + clusterName: "test", + accountID: "1e3ae7c4-a8bb-4d7c-9bdf-eb86bc25e6bb", }, "cbabd56f-bac6-416a-836b-b815ef347647", SubmitContextScan, @@ -415,11 +186,11 @@ func TestSubmit(t *testing.T) { ) }) - t.Run("should warn when no customerGUID", func(t *testing.T) { + t.Run("should generate new customerGUID when no customerGUID", func(t *testing.T) { reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - Token: "", - ClusterName: "test", + &TenantConfigMock{ + clusterName: "test", + accountID: "", }, "cbabd56f-bac6-416a-836b-b815ef347647", SubmitContextScan, @@ -443,20 +214,15 @@ func TestSubmit(t *testing.T) { require.NoError(t, reporter.Submit(ctx, opaSession), ) - require.NoError(t, capture.Close()) - buf, err := os.ReadFile(capture.Name()) - require.NoError(t, err) - - assert.Contains(t, string(buf), "failed to publish result") - assert.Contains(t, string(buf), "Unknown acc") + assert.Equalf(t, testGeneratedAccountIDString, reporter.GetAccountID(), "reporter should have generated a new account ID") }) t.Run("should warn when no cluster name", func(t *testing.T) { reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1e3ae7c4-a8bb-4d7c-9bdf-eb86bc25e6bb", - Token: "", + &TenantConfigMock{ + clusterName: "", + accountID: "1e3ae7c4-a8bb-4d7c-9bdf-eb86bc25e6bb", }, "cbabd56f-bac6-416a-836b-b815ef347647", SubmitContextScan, @@ -500,33 +266,31 @@ func TestSetters(t *testing.T) { } reporter := NewReportEventReceiver( - &cautils.ConfigObj{ - AccountID: "1e3ae7c4-a8bb-4d7c-9bdf-eb86bc25e6bb", - Token: "", + &TenantConfigMock{ + clusterName: "", + accountID: "1e3ae7c4-a8bb-4d7c-9bdf-eb86bc25e6bb", }, "cbabd56f-bac6-416a-836b-b815ef347647", SubmitContextScan, ) - t.Run("should set customerID", func(t *testing.T) { - guid := pickString() - reporter.SetCustomerGUID(guid) + t.Run("should set tenantConfig", func(t *testing.T) { + clusterName := pickString() + accountID := pickString() + reporter.SetTenantConfig(&TenantConfigMock{ + clusterName: clusterName, + accountID: accountID, + }) - require.Equal(t, guid, reporter.customerGUID) - }) - - t.Run("should set cluster name", func(t *testing.T) { - cluster := pickString() - reporter.SetClusterName(cluster) - - require.Equal(t, cluster, reporter.clusterName) + require.Equal(t, accountID, reporter.GetAccountID()) + require.Equal(t, clusterName, reporter.GetClusterName()) }) t.Run("should normalize cluster name", func(t *testing.T) { const cluster = " x y\t\tz" - reporter.SetClusterName(cluster) + reporter.SetTenantConfig(&TenantConfigMock{clusterName: cluster, accountID: ""}) - require.Equal(t, "-x-y-z", reporter.clusterName) + require.Equal(t, "-x-y-z", reporter.GetClusterName()) }) } diff --git a/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils.go b/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils.go index 13b5c971..4d0c1202 100644 --- a/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils.go +++ b/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils.go @@ -1,46 +1,20 @@ package reporter import ( - "net/url" - - "github.com/google/uuid" "github.com/kubescape/kubescape/v2/core/cautils" - "github.com/kubescape/kubescape/v2/core/cautils/getter" reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" ) -func (report *ReportEventReceiver) initEventReceiverURL() { - urlObj := url.URL{} - urlObj.Host = getter.GetKSCloudAPIConnector().GetCloudReportURL() - parseHost(&urlObj) - - urlObj.Path = "/k8s/v2/postureReport" - q := urlObj.Query() - q.Add("customerGUID", uuid.MustParse(report.customerGUID).String()) - q.Add("contextName", report.clusterName) - q.Add("clusterName", report.clusterName) // deprecated - - urlObj.RawQuery = q.Encode() - - report.eventReceiverURL = &urlObj -} - -func hostToString(host *url.URL, reportID string) string { - q := host.Query() - q.Add("reportGUID", reportID) // TODO - do we add the reportID? - host.RawQuery = q.Encode() - return host.String() -} - func (report *ReportEventReceiver) setSubReport(opaSessionObj *cautils.OPASessionObj) *reporthandlingv2.PostureReport { reportObj := &reporthandlingv2.PostureReport{ - CustomerGUID: report.customerGUID, - ClusterName: report.clusterName, - ReportID: report.reportID, - ReportGenerationTime: report.reportTime, - SummaryDetails: opaSessionObj.Report.SummaryDetails, - Attributes: opaSessionObj.Report.Attributes, - ClusterAPIServerInfo: opaSessionObj.Report.ClusterAPIServerInfo, + CustomerGUID: report.GetAccountID(), + ClusterName: report.GetClusterName(), + ReportID: report.reportID, + ReportGenerationTime: report.reportTime, + SummaryDetails: opaSessionObj.Report.SummaryDetails, + Attributes: opaSessionObj.Report.Attributes, + ClusterAPIServerInfo: opaSessionObj.Report.ClusterAPIServerInfo, + CustomerGUIDGenerated: report.accountIdGenerated, } if opaSessionObj.Metadata != nil { reportObj.Metadata = *opaSessionObj.Metadata diff --git a/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils_test.go b/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils_test.go index 321d4a68..19d34e37 100644 --- a/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils_test.go +++ b/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils_test.go @@ -1,20 +1 @@ package reporter - -import ( - "net/url" - "testing" -) - -func TestHostToString(t *testing.T) { - host := url.URL{ - Scheme: "https", - Host: "report.eudev3.cyberarmorsoft.com", - Path: "k8srestapi/v2/postureReport", - RawQuery: "cluster=openrasty_seal-7fvz&customerGUID=5d817063-096f-4d91-b39b-8665240080af", - } - expectedHost := "https://report.eudev3.cyberarmorsoft.com/k8srestapi/v2/postureReport?cluster=openrasty_seal-7fvz&customerGUID=5d817063-096f-4d91-b39b-8665240080af&reportGUID=ffdd2a00-4dc8-4bf3-b97a-a6d4fd198a41" - receivedHost := hostToString(&host, "ffdd2a00-4dc8-4bf3-b97a-a6d4fd198a41") - if receivedHost != expectedHost { - t.Errorf("%s != %s", receivedHost, expectedHost) - } -} diff --git a/core/pkg/resultshandling/results.go b/core/pkg/resultshandling/results.go index 517a56c3..b321e89f 100644 --- a/core/pkg/resultshandling/results.go +++ b/core/pkg/resultshandling/results.go @@ -96,14 +96,14 @@ func (rh *ResultsHandler) HandleResults(ctx context.Context) error { if err := rh.ReporterObj.Submit(ctx, rh.ScanData); err != nil { return err } - rh.ReporterObj.DisplayReportURL() + rh.ReporterObj.DisplayMessage() } return nil } // NewPrinter returns a new printer for a given format and configuration options -func NewPrinter(ctx context.Context, printFormat, formatVersion string, verboseMode, attackTree bool, viewType cautils.ViewTypes) printer.IPrinter { +func NewPrinter(ctx context.Context, printFormat, formatVersion string, verboseMode, attackTree bool, viewType cautils.ViewTypes, clusterName string) printer.IPrinter { switch printFormat { case printer.JsonFormat: @@ -128,6 +128,20 @@ func NewPrinter(ctx context.Context, printFormat, formatVersion string, verboseM if printFormat != printer.PrettyFormat { logger.L().Ctx(ctx).Warning(fmt.Sprintf("Invalid format \"%s\", default format \"pretty-printer\" is applied", printFormat)) } - return printerv2.NewPrettyPrinter(verboseMode, formatVersion, attackTree, viewType, "", nil) + return printerv2.NewPrettyPrinter(verboseMode, formatVersion, attackTree, viewType, "", nil, clusterName) + } +} + +func ValidatePrinter(scanType cautils.ScanTypes, printFormat string) bool { + if scanType != cautils.ScanTypeImage { + return true + } + + // supported types for image scanning + switch printFormat { + case printer.JsonFormat, printer.PrettyFormat, printer.SARIFFormat: + return true + default: + return false } } diff --git a/core/pkg/resultshandling/results_test.go b/core/pkg/resultshandling/results_test.go index 5416c256..b5acbf52 100644 --- a/core/pkg/resultshandling/results_test.go +++ b/core/pkg/resultshandling/results_test.go @@ -15,10 +15,9 @@ type DummyReporter struct{} func (dr *DummyReporter) Submit(_ context.Context, opaSessionObj *cautils.OPASessionObj) error { return nil } -func (dr *DummyReporter) SetCustomerGUID(customerGUID string) {} -func (dr *DummyReporter) SetClusterName(clusterName string) {} -func (dr *DummyReporter) DisplayReportURL() {} -func (dr *DummyReporter) GetURL() string { return "" } +func (dr *DummyReporter) SetTenantConfig(tenantConfig cautils.ITenantConfig) {} +func (dr *DummyReporter) DisplayMessage() {} +func (dr *DummyReporter) GetURL() string { return "" } type SpyPrinter struct { ActionPrintCalls int @@ -57,3 +56,96 @@ func TestResultsHandlerHandleResultsPrintsResultsToUI(t *testing.T) { t.Errorf("UI Printer was not called to print. Got calls: %d, want calls: %d", got, want) } } + +func TestValidatePrinter(t *testing.T) { + tests := []struct { + name string + scanType cautils.ScanTypes + format string + expected bool + }{ + { + name: "json format for cluster scan", + scanType: cautils.ScanTypeCluster, + format: printer.JsonFormat, + expected: true, + }, + { + name: "junit format for cluster scan", + scanType: cautils.ScanTypeCluster, + format: printer.JunitResultFormat, + expected: true, + }, + { + name: "sarif format for cluster scan", + scanType: cautils.ScanTypeCluster, + format: printer.SARIFFormat, + expected: true, + }, + { + name: "pretty format for cluster scan", + scanType: cautils.ScanTypeCluster, + format: printer.PrettyFormat, + expected: true, + }, + { + name: "html format for cluster scan", + scanType: cautils.ScanTypeCluster, + format: printer.HtmlFormat, + expected: true, + }, + { + name: "prometheus format for cluster scan", + scanType: cautils.ScanTypeCluster, + format: printer.PrometheusFormat, + expected: true, + }, + + { + name: "json format for image scan", + scanType: cautils.ScanTypeImage, + format: printer.JsonFormat, + expected: true, + }, + { + name: "junit format for image scan", + scanType: cautils.ScanTypeImage, + format: printer.JunitResultFormat, + expected: false, + }, + { + name: "sarif format for image scan", + scanType: cautils.ScanTypeImage, + format: printer.SARIFFormat, + expected: true, + }, + { + name: "pretty format for image scan", + scanType: cautils.ScanTypeImage, + format: printer.PrettyFormat, + expected: true, + }, + { + name: "html format for image scan", + scanType: cautils.ScanTypeImage, + format: printer.HtmlFormat, + expected: false, + }, + { + name: "prometheus format for image scan", + scanType: cautils.ScanTypeImage, + format: printer.PrometheusFormat, + expected: false, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := ValidatePrinter(tt.scanType, tt.format) + if got != tt.expected { + t.Errorf("%s failed - got = %v, want %v", tt.name, got, tt.expected) + } + }) + } + +} diff --git a/docs/providers/armo.md b/docs/providers/armo.md index a9f31f24..18d910a8 100644 --- a/docs/providers/armo.md +++ b/docs/providers/armo.md @@ -12,9 +12,9 @@ Using ARMO Platform, you will save valuable time and make spot-on hardening deci ``` > Alternatively, you can [install Kubescape using package managers](../installation.md#installation) -2. Scan Kubescape with the `--create-account` flag +2. Scan Kubescape with the `--server` flag ``` - kubescape scan --create-account + kubescape scan --server api.armosec.io ``` The scan results will be submitted to the ARMO Platform. diff --git a/docs/providers/install.ps1 b/docs/providers/install.ps1 index 4bbf6c3c..f1fed7a9 100644 --- a/docs/providers/install.ps1 +++ b/docs/providers/install.ps1 @@ -36,4 +36,4 @@ if (-not $currentPath.Contains($BASE_DIR)) { Write-Host "Finished Installation.`n" -ForegroundColor Green Write-Host "Executing Kubescape.`n" -ForegroundColor Green -kubescape scan --create-account +kubescape scan --server api.armosec.io diff --git a/docs/providers/install.sh b/docs/providers/install.sh old mode 100644 new mode 100755 index dd4fe96f..297e3b0d --- a/docs/providers/install.sh +++ b/docs/providers/install.sh @@ -1,42 +1,50 @@ #!/bin/bash set -e -while getopts v: option -do +BASE_DIR=~/.kubescape +KUBESCAPE_EXEC=kubescape + +# Function to determine OS and architecture +determine_os_and_arch() { + osName=$(uname -s) + case $osName in + *MINGW*) osName=windows ;; + Darwin*) osName=macos ;; + *) osName=ubuntu ;; + esac + + arch=$(uname -m) + case $arch in + *aarch64*|*arm64*) arch="-arm64" ;; + *x86_64*) arch="" ;; + *) + echo -e "\033[33mArchitecture $arch may be unsupported, will try to install the amd64 one anyway." + arch="" + ;; + esac +} + +# Function to remove old installations +remove_old_install() { + local exec_path=$1 + if [ -f "$exec_path" ]; then + rm -f "$exec_path" && echo -e "\033[32mRemoved old installation at $exec_path" || echo -e "\033[31mFailed to remove old installation at $exec_path" + fi +} + +# Parse command-line arguments +while getopts v: option; do case ${option} in v) RELEASE="download/${OPTARG}";; *) ;; esac done -if [ -z "${RELEASE}" ]; then - RELEASE="latest/download" -fi +[ -z "${RELEASE}" ] && RELEASE="latest/download" echo -e "\033[0;36mInstalling Kubescape..." -echo -BASE_DIR=~/.kubescape -KUBESCAPE_EXEC=kubescape - -osName=$(uname -s) -if [[ $osName == *"MINGW"* ]]; then - osName=windows -elif [[ $osName == *"Darwin"* ]]; then - osName=macos -else - osName=ubuntu -fi - -arch=$(uname -m) -if [[ $arch == *"aarch64"* || $arch == *"arm64"* ]]; then - arch="-arm64" -else - if [[ $arch != *"x86_64"* ]]; then - echo -e "\033[33mArchitecture $arch may be unsupported, will try to install the amd64 one anyway." - fi - arch="" -fi +determine_os_and_arch mkdir -p $BASE_DIR @@ -45,77 +53,46 @@ DOWNLOAD_URL="https://github.com/kubescape/kubescape/releases/${RELEASE}/kubesca curl --progress-bar -L $DOWNLOAD_URL -o $OUTPUT -# Find install dir -install_dir=/usr/local/bin # default if running as root -if [ "$(id -u)" -ne 0 ]; then - install_dir=$BASE_DIR/bin # if not running as root, install to user dir - export PATH=$PATH:$BASE_DIR/bin -fi +# Determine install directory +install_dir=/usr/local/bin +[ "$(id -u)" -ne 0 ] && install_dir=$BASE_DIR/bin && export PATH=$PATH:$BASE_DIR/bin # Create install dir if it does not exist -if [ ! -d "$install_dir" ]; then - mkdir -p $install_dir -fi +mkdir -p $install_dir -chmod +x $OUTPUT 2>/dev/null +chmod +x $OUTPUT -# cleaning up old install -SUDO= -if [ "$(id -u)" -ne 0 ] && [ -n "$(which sudo)" ] && [ "$KUBESCAPE_EXEC" != "" ] && [ -f /usr/local/bin/$KUBESCAPE_EXEC ]; then - SUDO=sudo - echo -e "\n\033[33mOld installation as root found, do you want to remove it? [\033[0my\033[33m/n]:" - read -n 1 -r - if [[ ! $REPLY =~ ^[Yy]$ ]] && [[ "$REPLY" != "" ]]; then - echo -e "\n\033[0mSkipping old installation as root removal." - else - echo -e "\n\033[0mWe will need the root access to uninstall the old kubescape CLI." - if $SUDO rm -f /usr/local/bin/$KUBESCAPE_EXEC 2>/dev/null; then - echo -e "\033[32mRemoved old installation as root at /usr/local/bin/$KUBESCAPE_EXEC" - else - echo -e "\033[31mFailed to remove old installation as root at /usr/local/bin/$KUBESCAPE_EXEC, please remove it manually." - fi - fi -fi +# Remove old installations +SUDO="" +[ "$(id -u)" -ne 0 ] && [ -n "$(which sudo)" ] && [ -f /usr/local/bin/$KUBESCAPE_EXEC ] && SUDO=sudo -if [ "$KUBESCAPE_EXEC" != "" ]; then - if [ "${SUDO_USER:-$USER}" != "" ]; then - rm -f /home/"${SUDO_USER:-$USER}"/.kubescape/bin/$KUBESCAPE_EXEC 2>/dev/null || true - fi - if [ "$BASE_DIR" != "" ]; then - rm -f $BASE_DIR/bin/$KUBESCAPE_EXEC 2>/dev/null || true - fi -fi +$SUDO remove_old_install "/usr/local/bin/$KUBESCAPE_EXEC" +remove_old_install "$BASE_DIR/bin/$KUBESCAPE_EXEC" -# Old install location, clean all those things up -for pdir in ${PATH//:/ }; do - edir="${pdir/#\~/$HOME}" - if [[ $edir == $HOME/* ]] && [[ -f $edir/$KUBESCAPE_EXEC ]]; then - echo -e "\n\033[33mOld installation found at $edir/$KUBESCAPE_EXEC, do you want to remove it? [\033[0my\033[33m/n]:" - read -n 1 -r - if [[ ! $REPLY =~ ^[Yy]$ ]] && [[ "$REPLY" != "" ]]; then - continue - fi - if rm -f "$edir"/$KUBESCAPE_EXEC 2>/dev/null; then - echo -e "\n\033[32mRemoved old installation at $edir/$KUBESCAPE_EXEC" - else - echo -e "\n\033[31mFailed to remove old installation as root at $edir/$KUBESCAPE_EXEC, please remove it manually." - fi - fi +# Remove any old installations in user's PATH +IFS=':' read -ra ADDR <<< "$PATH" +for pdir in "${ADDR[@]}"; do + remove_old_install "$pdir/$KUBESCAPE_EXEC" done -cp $OUTPUT $install_dir/$KUBESCAPE_EXEC -rm -f $OUTPUT +# Move the new executable to the install directory +mv $OUTPUT $install_dir/$KUBESCAPE_EXEC -echo echo -e "\033[32mFinished Installation." if [ "$(id -u)" -ne 0 ]; then - echo -e "\nRemember to add the Kubescape CLI to your path with:" - echo -e " export PATH=\$PATH:$BASE_DIR/bin" - export PATH=\$PATH:$BASE_DIR/bin + echo -e "\033[1;35;32m\nRemember to add the Kubescape CLI to your path with:" + echo -e "\033[1;35;40m$ export PATH=\$PATH:$BASE_DIR/bin" fi -echo -e "\033[0m" -echo -e "\033[32mExecuting Kubescape." -echo -$KUBESCAPE_EXEC scan --create-account +# Check cluster access by getting nodes +if ! kubectl get nodes &> /dev/null; then + echo -e "\033[0;37;32m\nRun:" + echo -e "\033[1;35;40m$ $KUBESCAPE_EXEC scan --server api.armosec.io" + echo + exit 0 +fi + +echo -e "\033[0;37;40m" +echo -e "\033[0;37;32mExecuting Kubescape." +$KUBESCAPE_EXEC scan --server api.armosec.io diff --git a/go.mod b/go.mod index ee61036d..79f35c0a 100644 --- a/go.mod +++ b/go.mod @@ -3,14 +3,13 @@ module github.com/kubescape/kubescape/v2 go 1.20 require ( - cloud.google.com/go/containeranalysis v0.10.1 github.com/adrg/xdg v0.4.0 github.com/anchore/grype v0.65.0 github.com/anchore/stereoscope v0.0.0-20230727211946-d1f3d766295e github.com/anchore/syft v0.86.1 - github.com/armosec/armoapi-go v0.0.212 + github.com/armosec/armoapi-go v0.0.220 github.com/armosec/utils-go v0.0.20 - github.com/armosec/utils-k8s-go v0.0.16 + github.com/armosec/utils-k8s-go v0.0.17 github.com/briandowns/spinner v1.23.0 github.com/distribution/distribution v2.8.2+incompatible github.com/docker/distribution v2.8.2+incompatible @@ -22,10 +21,11 @@ require ( github.com/johnfercher/maroto v0.42.0 github.com/json-iterator/go v1.1.12 github.com/jwalton/gchalk v1.3.0 + github.com/kubescape/backend v0.0.2 github.com/kubescape/go-git-url v0.0.25 github.com/kubescape/go-logger v0.0.20 - github.com/kubescape/k8s-interface v0.0.138 - github.com/kubescape/opa-utils v0.0.261 + github.com/kubescape/k8s-interface v0.0.141 + github.com/kubescape/opa-utils v0.0.267 github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520 github.com/kubescape/regolibrary v1.0.291-rc.0 github.com/libgit2/git2go/v33 v33.0.9 @@ -47,9 +47,6 @@ require ( golang.org/x/exp v0.0.0-20230801115018-d63ba01acd4b golang.org/x/mod v0.12.0 golang.org/x/term v0.11.0 - google.golang.org/api v0.128.0 - google.golang.org/genproto v0.0.0-20230807174057-1744710a1577 - google.golang.org/protobuf v1.31.0 gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 gopkg.in/yaml.v3 v3.0.1 helm.sh/helm/v3 v3.12.1 @@ -68,7 +65,6 @@ require ( cloud.google.com/go/compute v1.23.0 // indirect cloud.google.com/go/compute/metadata v0.2.3 // indirect cloud.google.com/go/container v1.24.0 // indirect - cloud.google.com/go/grafeas v0.3.0 // indirect cloud.google.com/go/iam v1.1.1 // indirect cloud.google.com/go/storage v1.30.1 // indirect dario.cat/mergo v1.0.0 // indirect @@ -417,10 +413,13 @@ require ( golang.org/x/tools v0.10.0 // indirect golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect gonum.org/v1/gonum v0.9.1 // indirect + google.golang.org/api v0.128.0 // indirect google.golang.org/appengine v1.6.7 // indirect + google.golang.org/genproto v0.0.0-20230807174057-1744710a1577 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20230803162519-f966b187b2e5 // indirect google.golang.org/grpc v1.57.0 // indirect + google.golang.org/protobuf v1.31.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/ini.v1 v1.67.0 // indirect gopkg.in/square/go-jose.v2 v2.6.0 // indirect diff --git a/go.sum b/go.sum index f95e3faa..8e6d50ff 100644 --- a/go.sum +++ b/go.sum @@ -136,8 +136,6 @@ cloud.google.com/go/container v1.24.0 h1:N51t/cgQJFqDD/W7Mb+IvmAPHrf8AbPx7Bb7aF4 cloud.google.com/go/container v1.24.0/go.mod h1:lTNExE2R7f+DLbAN+rJiKTisauFCaoDq6NURZ83eVH4= cloud.google.com/go/containeranalysis v0.5.1/go.mod h1:1D92jd8gRR/c0fGMlymRgxWD3Qw9C1ff6/T7mLgVL8I= cloud.google.com/go/containeranalysis v0.6.0/go.mod h1:HEJoiEIu+lEXM+k7+qLCci0h33lX3ZqoYFdmPcoO7s4= -cloud.google.com/go/containeranalysis v0.10.1 h1:SM/ibWHWp4TYyJMwrILtcBtYKObyupwOVeceI9pNblw= -cloud.google.com/go/containeranalysis v0.10.1/go.mod h1:Ya2jiILITMY68ZLPaogjmOMNkwsDrWBSTyBubGXO7j0= cloud.google.com/go/datacatalog v1.3.0/go.mod h1:g9svFY6tuR+j+hrTw3J2dNcmI0dzmSiyOzm8kpLq0a0= cloud.google.com/go/datacatalog v1.5.0/go.mod h1:M7GPLNQeLfWqeIm3iuiruhPzkt65+Bx8dAKvScX8jvs= cloud.google.com/go/datacatalog v1.6.0/go.mod h1:+aEyF8JKg+uXcIdAmmaMUmZ3q1b/lKLtXCmXdnc0lbc= @@ -209,8 +207,6 @@ cloud.google.com/go/gkehub v0.10.0/go.mod h1:UIPwxI0DsrpsVoWpLB0stwKCP+WFVG9+y97 cloud.google.com/go/gkemulticloud v0.3.0/go.mod h1:7orzy7O0S+5kq95e4Hpn7RysVA7dPs8W/GgfUtsPbrA= cloud.google.com/go/gkemulticloud v0.4.0/go.mod h1:E9gxVBnseLWCk24ch+P9+B2CoDFJZTyIgLKSalC7tuI= cloud.google.com/go/grafeas v0.2.0/go.mod h1:KhxgtF2hb0P191HlY5besjYm6MqTSTj3LSI+M+ByZHc= -cloud.google.com/go/grafeas v0.3.0 h1:oyTL/KjiUeBs9eYLw/40cpSZglUC+0F7X4iu/8t7NWs= -cloud.google.com/go/grafeas v0.3.0/go.mod h1:P7hgN24EyONOTMyeJH6DxG4zD7fwiYa5Q6GUgyFSOU8= cloud.google.com/go/gsuiteaddons v1.3.0/go.mod h1:EUNK/J1lZEZO8yPtykKxLXI6JSVN2rg9bN8SXOa0bgM= cloud.google.com/go/gsuiteaddons v1.4.0/go.mod h1:rZK5I8hht7u7HxFQcFei0+AtfS9uSushomRlg+3ua1o= cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c= @@ -611,14 +607,14 @@ github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= -github.com/armosec/armoapi-go v0.0.212 h1:QdmCywiA8NRhyynzHJkIYYZBMBb+1pySUhN3jm4b3Fw= -github.com/armosec/armoapi-go v0.0.212/go.mod h1:4AEdwBrbS1YCAn/lZzV+cOOR9BPa0MTHYHiJDlR1uRQ= +github.com/armosec/armoapi-go v0.0.220 h1:gfg2UmcFgcyStjp5ZXfwE8yb0H43eaRX9H/KkqFIv6w= +github.com/armosec/armoapi-go v0.0.220/go.mod h1:Y1ZcqPUTQ+F8JiQzErrToK5ULrPvClxZoshHmV9PIlU= github.com/armosec/gojay v1.2.15 h1:sSB2vnAvacUNkw9nzUYZKcPzhJOyk6/5LK2JCNdmoZY= github.com/armosec/gojay v1.2.15/go.mod h1:vzVAaay2TWJAngOpxu8aqLbye9jMgoKleuAOK+xsOts= github.com/armosec/utils-go v0.0.20 h1:bvr+TMumEYdMsGFGSsaQysST7K02nNROFvuajNuKPlw= github.com/armosec/utils-go v0.0.20/go.mod h1:ZEFiSv8KpTFNT19jHis1IengiF/BGDvg7tHmXo+cwxs= -github.com/armosec/utils-k8s-go v0.0.16 h1:h46PoxAb4OHA2p719PzcAS03lADw4lH4TyRMaZ3ix/g= -github.com/armosec/utils-k8s-go v0.0.16/go.mod h1:QX0QAGlH7KCZq810eO9QjTYqkhjw8cvrr96TZfaUGrk= +github.com/armosec/utils-k8s-go v0.0.17 h1:HUntJGR0/PHt7bp8S0zLhVcJ6sDz061Hc9mAM9ha1lA= +github.com/armosec/utils-k8s-go v0.0.17/go.mod h1:FJRG/MRz7jT4ExSEYHIFsilVsAF11M+GJRhLl4PFZ4s= github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so= github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= @@ -1356,14 +1352,16 @@ github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/kubescape/backend v0.0.2 h1:s/aQ5/U9lLXBcVTuGz9vxGtD/koem6eojRTA3lRiyYo= +github.com/kubescape/backend v0.0.2/go.mod h1:rEkxLNQdOGQNKAZekZBn0z/r8FIymBRSmwLFqkUenAQ= github.com/kubescape/go-git-url v0.0.25 h1:i7SSSC1+1m/Dg+4LV3erp0YklnWj1Z0cVlRxCT3Zy/0= github.com/kubescape/go-git-url v0.0.25/go.mod h1:IbVT7Wsxlghsa+YxI5KOx4k9VQJaa3z0kTaQz5D3nKM= github.com/kubescape/go-logger v0.0.20 h1:ZU3T6Za7maCiChdoTrqpD6TI11DGJwd9xU/TFtRlMOI= github.com/kubescape/go-logger v0.0.20/go.mod h1:BAWhQMYc/gnC5wMtPvc9Z4VXFqykFFMaXaPkq0+txBY= -github.com/kubescape/k8s-interface v0.0.138 h1:JjqLExOQiV1iG6jDLVQ/KpPzH8T9U7jQOtpUe5frF2o= -github.com/kubescape/k8s-interface v0.0.138/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8= -github.com/kubescape/opa-utils v0.0.261 h1:NEASuRRHfbQRf/9wAEdm+7VV+UDg5tr+VgIfsedbdas= -github.com/kubescape/opa-utils v0.0.261/go.mod h1:0Be6E+vHqjavl/JneqgyC+oXOdfs6s+V6YnFvBkIAsA= +github.com/kubescape/k8s-interface v0.0.141 h1:CQcK3PZsSeDFVmlvyHya48NJihGe7Qc+3kEWsmc4KnA= +github.com/kubescape/k8s-interface v0.0.141/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8= +github.com/kubescape/opa-utils v0.0.267 h1:qzINBGsVOTKeLAIj1YfaYdV93FsSRriWdiN0JXJwD/o= +github.com/kubescape/opa-utils v0.0.267/go.mod h1:95JkuIOfClgLc+DyGb2mDvefRW0STkZe4L2z6AaZJlQ= github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520 h1:SqlwF8G+oFazeYmZQKoPczLEflBQpwpHCU8DoLLyfj8= github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520/go.mod h1:wuxMUSDzGUyWd25IJfBzEJ/Udmw2Vy7npj+MV3u3GrU= github.com/kubescape/regolibrary v1.0.291-rc.0 h1:DztPS3NSKfiltO1wZvxRjuu5c99c6+dEgfTs6DcsVa8= diff --git a/httphandler/go.mod b/httphandler/go.mod index 38c4d2fe..ba41eaeb 100644 --- a/httphandler/go.mod +++ b/httphandler/go.mod @@ -10,10 +10,11 @@ require ( github.com/google/uuid v1.3.0 github.com/gorilla/mux v1.8.0 github.com/gorilla/schema v1.2.0 + github.com/kubescape/backend v0.0.2 github.com/kubescape/go-logger v0.0.20 - github.com/kubescape/k8s-interface v0.0.138 + github.com/kubescape/k8s-interface v0.0.141 github.com/kubescape/kubescape/v2 v2.0.0-00010101000000-000000000000 - github.com/kubescape/opa-utils v0.0.261 + github.com/kubescape/opa-utils v0.0.267 github.com/stretchr/testify v1.8.4 go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.38.0 go.opentelemetry.io/otel v1.16.0 @@ -39,8 +40,6 @@ require ( cloud.google.com/go/compute v1.23.0 // indirect cloud.google.com/go/compute/metadata v0.2.3 // indirect cloud.google.com/go/container v1.24.0 // indirect - cloud.google.com/go/containeranalysis v0.10.1 // indirect - cloud.google.com/go/grafeas v0.3.0 // indirect cloud.google.com/go/iam v1.1.1 // indirect cloud.google.com/go/storage v1.30.1 // indirect dario.cat/mergo v1.0.0 // indirect @@ -107,9 +106,9 @@ require ( github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 // indirect github.com/aquasecurity/trivy v0.44.1 // indirect github.com/aquasecurity/trivy-db v0.0.0-20230726112157-167ba4f2faeb // indirect - github.com/armosec/armoapi-go v0.0.212 // indirect + github.com/armosec/armoapi-go v0.0.220 // indirect github.com/armosec/gojay v1.2.15 // indirect - github.com/armosec/utils-k8s-go v0.0.16 // indirect + github.com/armosec/utils-k8s-go v0.0.17 // indirect github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect github.com/aws/aws-sdk-go v1.44.312 // indirect github.com/aws/aws-sdk-go-v2 v1.20.0 // indirect diff --git a/httphandler/go.sum b/httphandler/go.sum index d388ea85..5fe8f02c 100644 --- a/httphandler/go.sum +++ b/httphandler/go.sum @@ -136,8 +136,6 @@ cloud.google.com/go/container v1.24.0 h1:N51t/cgQJFqDD/W7Mb+IvmAPHrf8AbPx7Bb7aF4 cloud.google.com/go/container v1.24.0/go.mod h1:lTNExE2R7f+DLbAN+rJiKTisauFCaoDq6NURZ83eVH4= cloud.google.com/go/containeranalysis v0.5.1/go.mod h1:1D92jd8gRR/c0fGMlymRgxWD3Qw9C1ff6/T7mLgVL8I= cloud.google.com/go/containeranalysis v0.6.0/go.mod h1:HEJoiEIu+lEXM+k7+qLCci0h33lX3ZqoYFdmPcoO7s4= -cloud.google.com/go/containeranalysis v0.10.1 h1:SM/ibWHWp4TYyJMwrILtcBtYKObyupwOVeceI9pNblw= -cloud.google.com/go/containeranalysis v0.10.1/go.mod h1:Ya2jiILITMY68ZLPaogjmOMNkwsDrWBSTyBubGXO7j0= cloud.google.com/go/datacatalog v1.3.0/go.mod h1:g9svFY6tuR+j+hrTw3J2dNcmI0dzmSiyOzm8kpLq0a0= cloud.google.com/go/datacatalog v1.5.0/go.mod h1:M7GPLNQeLfWqeIm3iuiruhPzkt65+Bx8dAKvScX8jvs= cloud.google.com/go/datacatalog v1.6.0/go.mod h1:+aEyF8JKg+uXcIdAmmaMUmZ3q1b/lKLtXCmXdnc0lbc= @@ -209,8 +207,6 @@ cloud.google.com/go/gkehub v0.10.0/go.mod h1:UIPwxI0DsrpsVoWpLB0stwKCP+WFVG9+y97 cloud.google.com/go/gkemulticloud v0.3.0/go.mod h1:7orzy7O0S+5kq95e4Hpn7RysVA7dPs8W/GgfUtsPbrA= cloud.google.com/go/gkemulticloud v0.4.0/go.mod h1:E9gxVBnseLWCk24ch+P9+B2CoDFJZTyIgLKSalC7tuI= cloud.google.com/go/grafeas v0.2.0/go.mod h1:KhxgtF2hb0P191HlY5besjYm6MqTSTj3LSI+M+ByZHc= -cloud.google.com/go/grafeas v0.3.0 h1:oyTL/KjiUeBs9eYLw/40cpSZglUC+0F7X4iu/8t7NWs= -cloud.google.com/go/grafeas v0.3.0/go.mod h1:P7hgN24EyONOTMyeJH6DxG4zD7fwiYa5Q6GUgyFSOU8= cloud.google.com/go/gsuiteaddons v1.3.0/go.mod h1:EUNK/J1lZEZO8yPtykKxLXI6JSVN2rg9bN8SXOa0bgM= cloud.google.com/go/gsuiteaddons v1.4.0/go.mod h1:rZK5I8hht7u7HxFQcFei0+AtfS9uSushomRlg+3ua1o= cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c= @@ -611,14 +607,14 @@ github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= -github.com/armosec/armoapi-go v0.0.212 h1:QdmCywiA8NRhyynzHJkIYYZBMBb+1pySUhN3jm4b3Fw= -github.com/armosec/armoapi-go v0.0.212/go.mod h1:4AEdwBrbS1YCAn/lZzV+cOOR9BPa0MTHYHiJDlR1uRQ= +github.com/armosec/armoapi-go v0.0.220 h1:gfg2UmcFgcyStjp5ZXfwE8yb0H43eaRX9H/KkqFIv6w= +github.com/armosec/armoapi-go v0.0.220/go.mod h1:Y1ZcqPUTQ+F8JiQzErrToK5ULrPvClxZoshHmV9PIlU= github.com/armosec/gojay v1.2.15 h1:sSB2vnAvacUNkw9nzUYZKcPzhJOyk6/5LK2JCNdmoZY= github.com/armosec/gojay v1.2.15/go.mod h1:vzVAaay2TWJAngOpxu8aqLbye9jMgoKleuAOK+xsOts= github.com/armosec/utils-go v0.0.20 h1:bvr+TMumEYdMsGFGSsaQysST7K02nNROFvuajNuKPlw= github.com/armosec/utils-go v0.0.20/go.mod h1:ZEFiSv8KpTFNT19jHis1IengiF/BGDvg7tHmXo+cwxs= -github.com/armosec/utils-k8s-go v0.0.16 h1:h46PoxAb4OHA2p719PzcAS03lADw4lH4TyRMaZ3ix/g= -github.com/armosec/utils-k8s-go v0.0.16/go.mod h1:QX0QAGlH7KCZq810eO9QjTYqkhjw8cvrr96TZfaUGrk= +github.com/armosec/utils-k8s-go v0.0.17 h1:HUntJGR0/PHt7bp8S0zLhVcJ6sDz061Hc9mAM9ha1lA= +github.com/armosec/utils-k8s-go v0.0.17/go.mod h1:FJRG/MRz7jT4ExSEYHIFsilVsAF11M+GJRhLl4PFZ4s= github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so= github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= @@ -1358,14 +1354,16 @@ github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/kubescape/backend v0.0.2 h1:s/aQ5/U9lLXBcVTuGz9vxGtD/koem6eojRTA3lRiyYo= +github.com/kubescape/backend v0.0.2/go.mod h1:rEkxLNQdOGQNKAZekZBn0z/r8FIymBRSmwLFqkUenAQ= github.com/kubescape/go-git-url v0.0.25 h1:i7SSSC1+1m/Dg+4LV3erp0YklnWj1Z0cVlRxCT3Zy/0= github.com/kubescape/go-git-url v0.0.25/go.mod h1:IbVT7Wsxlghsa+YxI5KOx4k9VQJaa3z0kTaQz5D3nKM= github.com/kubescape/go-logger v0.0.20 h1:ZU3T6Za7maCiChdoTrqpD6TI11DGJwd9xU/TFtRlMOI= github.com/kubescape/go-logger v0.0.20/go.mod h1:BAWhQMYc/gnC5wMtPvc9Z4VXFqykFFMaXaPkq0+txBY= -github.com/kubescape/k8s-interface v0.0.138 h1:JjqLExOQiV1iG6jDLVQ/KpPzH8T9U7jQOtpUe5frF2o= -github.com/kubescape/k8s-interface v0.0.138/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8= -github.com/kubescape/opa-utils v0.0.261 h1:NEASuRRHfbQRf/9wAEdm+7VV+UDg5tr+VgIfsedbdas= -github.com/kubescape/opa-utils v0.0.261/go.mod h1:0Be6E+vHqjavl/JneqgyC+oXOdfs6s+V6YnFvBkIAsA= +github.com/kubescape/k8s-interface v0.0.141 h1:CQcK3PZsSeDFVmlvyHya48NJihGe7Qc+3kEWsmc4KnA= +github.com/kubescape/k8s-interface v0.0.141/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8= +github.com/kubescape/opa-utils v0.0.267 h1:qzINBGsVOTKeLAIj1YfaYdV93FsSRriWdiN0JXJwD/o= +github.com/kubescape/opa-utils v0.0.267/go.mod h1:95JkuIOfClgLc+DyGb2mDvefRW0STkZe4L2z6AaZJlQ= github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520 h1:SqlwF8G+oFazeYmZQKoPczLEflBQpwpHCU8DoLLyfj8= github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520/go.mod h1:wuxMUSDzGUyWd25IJfBzEJ/Udmw2Vy7npj+MV3u3GrU= github.com/kubescape/regolibrary v1.0.291-rc.0 h1:DztPS3NSKfiltO1wZvxRjuu5c99c6+dEgfTs6DcsVa8= diff --git a/httphandler/handlerequests/v1/datastructuremethods.go b/httphandler/handlerequests/v1/datastructuremethods.go index 5fac2c79..0ab5677a 100644 --- a/httphandler/handlerequests/v1/datastructuremethods.go +++ b/httphandler/handlerequests/v1/datastructuremethods.go @@ -17,7 +17,7 @@ func ToScanInfo(scanRequest *utilsmetav1.PostScanRequest) *cautils.ScanInfo { setTargetInScanInfo(scanRequest, scanInfo) if scanRequest.Account != "" { - scanInfo.Credentials.Account = scanRequest.Account + scanInfo.AccountID = scanRequest.Account } if len(scanRequest.ExcludedNamespaces) > 0 { scanInfo.ExcludedNamespaces = strings.Join(scanRequest.ExcludedNamespaces, ",") diff --git a/httphandler/handlerequests/v1/datastructuremethods_test.go b/httphandler/handlerequests/v1/datastructuremethods_test.go index 4fb4bfa9..5a74fa8c 100644 --- a/httphandler/handlerequests/v1/datastructuremethods_test.go +++ b/httphandler/handlerequests/v1/datastructuremethods_test.go @@ -22,7 +22,7 @@ func TestToScanInfo(t *testing.T) { TargetNames: []string{"nsa", "mitre"}, } s := ToScanInfo(req) - assert.Equal(t, "abc", s.Credentials.Account) + assert.Equal(t, "abc", s.AccountID) assert.Equal(t, "v2", s.FormatVersion) assert.Equal(t, "pdf", s.Format) assert.Equal(t, 2, len(s.PolicyIdentifier)) diff --git a/httphandler/handlerequests/v1/requestparser_test.go b/httphandler/handlerequests/v1/requestparser_test.go index d448dc42..24935b04 100644 --- a/httphandler/handlerequests/v1/requestparser_test.go +++ b/httphandler/handlerequests/v1/requestparser_test.go @@ -41,7 +41,7 @@ func TestGetScanParamsFromRequest(t *testing.T) { assert.True(t, req.scanQueryParams.ReturnResults) assert.True(t, req.scanInfo.HostSensorEnabled.GetBool()) assert.True(t, req.scanInfo.Submit) - assert.Equal(t, "aaaaaaaaaa", req.scanInfo.Credentials.Account) + assert.Equal(t, "aaaaaaaaaa", req.scanInfo.AccountID) } { @@ -71,6 +71,6 @@ func TestGetScanParamsFromRequest(t *testing.T) { assert.False(t, req.scanQueryParams.ReturnResults) assert.False(t, req.scanInfo.HostSensorEnabled.GetBool()) assert.False(t, req.scanInfo.Submit) - assert.Equal(t, "aaaaaaaaaa", req.scanInfo.Credentials.Account) + assert.Equal(t, "aaaaaaaaaa", req.scanInfo.AccountID) } } diff --git a/httphandler/handlerequests/v1/requestshandlerutil_test.go b/httphandler/handlerequests/v1/requestshandlerutil_test.go index 7212ef42..cdc419ed 100644 --- a/httphandler/handlerequests/v1/requestshandlerutil_test.go +++ b/httphandler/handlerequests/v1/requestshandlerutil_test.go @@ -11,7 +11,7 @@ import ( func TestDefaultScanInfo(t *testing.T) { s := defaultScanInfo() - assert.Equal(t, "", s.Credentials.Account) + assert.Equal(t, "", s.AccountID) assert.Equal(t, "v2", s.FormatVersion) assert.Equal(t, "json", s.Format) assert.False(t, s.HostSensorEnabled.GetBool()) @@ -24,7 +24,7 @@ func TestGetScanCommand(t *testing.T) { TargetType: apisv1.KindFramework, } s := getScanCommand(&req, "abc") - assert.Equal(t, "", s.Credentials.Account) + assert.Equal(t, "", s.AccountID) assert.Equal(t, "abc", s.ScanID) assert.Equal(t, "v2", s.FormatVersion) assert.Equal(t, "json", s.Format) diff --git a/httphandler/handlerequests/v1/requestshandlerutils.go b/httphandler/handlerequests/v1/requestshandlerutils.go index 982a1902..d9447546 100644 --- a/httphandler/handlerequests/v1/requestshandlerutils.go +++ b/httphandler/handlerequests/v1/requestshandlerutils.go @@ -161,7 +161,7 @@ func defaultScanInfo() *cautils.ScanInfo { scanInfo := &cautils.ScanInfo{} scanInfo.FailThreshold = 100 scanInfo.ComplianceThreshold = 0 - scanInfo.Credentials.Account = envToString("KS_ACCOUNT", "") // publish results to Kubescape SaaS + scanInfo.AccountID = envToString("KS_ACCOUNT", "") // publish results to Kubescape SaaS scanInfo.ExcludedNamespaces = envToString("KS_EXCLUDE_NAMESPACES", "") // namespaces to exclude scanInfo.IncludeNamespaces = envToString("KS_INCLUDE_NAMESPACES", "") // namespaces to include scanInfo.HostSensorYamlPath = envToString("KS_HOST_SCAN_YAML", "") // path to host scan YAML diff --git a/httphandler/listener/init.go b/httphandler/listener/init.go index 172338ea..d6847177 100644 --- a/httphandler/listener/init.go +++ b/httphandler/listener/init.go @@ -3,6 +3,9 @@ package listener import ( "os" + v1 "github.com/kubescape/backend/pkg/client/v1" + "github.com/kubescape/backend/pkg/servicediscovery" + servicediscoveryv1 "github.com/kubescape/backend/pkg/servicediscovery/v1" logger "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" "github.com/kubescape/go-logger/zaplogger" @@ -39,17 +42,29 @@ func initializeLoggerLevel() { // SetupHTTPListener set up listening http servers func initializeSaaSEnv() { - - saasEnv := os.Getenv("KS_SAAS_ENV") - switch saasEnv { - case "dev", "development": - logger.L().Debug("setting dev env") - getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIDev()) - case "stage", "staging": - logger.L().Debug("setting staging env") - getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIStaging()) - default: - logger.L().Debug("setting prod env") - getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIProd()) + serviceDiscoveryFilePath := "/etc/config/services.json" + if envVar := os.Getenv("KS_SERVICE_DISCOVERY_FILE_PATH"); envVar != "" { + logger.L().Debug("service discovery file path updated from env var", helpers.String("path", envVar)) + serviceDiscoveryFilePath = envVar } + + if _, err := os.Stat(serviceDiscoveryFilePath); err != nil { + logger.L().Info("service discovery file not found - skipping", helpers.String("path", serviceDiscoveryFilePath)) + return + } + + backendServices, err := servicediscovery.GetServices( + servicediscoveryv1.NewServiceDiscoveryFileV1(serviceDiscoveryFilePath), + ) + if err != nil { + logger.L().Fatal("failed to get backend services", helpers.Error(err)) + return + } + + if ksCloud, err := v1.NewKSCloudAPI(backendServices.GetReportReceiverHttpUrl(), backendServices.GetApiServerUrl(), ""); err != nil { + logger.L().Fatal("failed to initialize cloud api", helpers.Error(err)) + } else { + getter.SetKSCloudAPIConnector(ksCloud) + } + } diff --git a/install.sh b/install.sh index db3a06e0..6a3a8552 100755 --- a/install.sh +++ b/install.sh @@ -1,42 +1,50 @@ #!/bin/bash set -e -while getopts v: option -do +BASE_DIR=~/.kubescape +KUBESCAPE_EXEC=kubescape + +# Function to determine OS and architecture +determine_os_and_arch() { + osName=$(uname -s) + case $osName in + *MINGW*) osName=windows ;; + Darwin*) osName=macos ;; + *) osName=ubuntu ;; + esac + + arch=$(uname -m) + case $arch in + *aarch64*|*arm64*) arch="-arm64" ;; + *x86_64*) arch="" ;; + *) + echo -e "\033[33mArchitecture $arch may be unsupported, will try to install the amd64 one anyway." + arch="" + ;; + esac +} + +# Function to remove old installations +remove_old_install() { + local exec_path=$1 + if [ -f "$exec_path" ]; then + rm -f "$exec_path" && echo -e "\033[32mRemoved old installation at $exec_path" || echo -e "\033[31mFailed to remove old installation at $exec_path" + fi +} + +# Parse command-line arguments +while getopts v: option; do case ${option} in v) RELEASE="download/${OPTARG}";; *) ;; esac done -if [ -z "${RELEASE}" ]; then - RELEASE="latest/download" -fi +[ -z "${RELEASE}" ] && RELEASE="latest/download" echo -e "\033[0;36mInstalling Kubescape..." -echo -BASE_DIR=~/.kubescape -KUBESCAPE_EXEC=kubescape - -osName=$(uname -s) -if [[ $osName == *"MINGW"* ]]; then - osName=windows -elif [[ $osName == *"Darwin"* ]]; then - osName=macos -else - osName=ubuntu -fi - -arch=$(uname -m) -if [[ $arch == *"aarch64"* || $arch == *"arm64"* ]]; then - arch="-arm64" -else - if [[ $arch != *"x86_64"* ]]; then - echo -e "\033[33mArchitecture $arch may be unsupported, will try to install the amd64 one anyway." - fi - arch="" -fi +determine_os_and_arch mkdir -p $BASE_DIR @@ -45,80 +53,46 @@ DOWNLOAD_URL="https://github.com/kubescape/kubescape/releases/${RELEASE}/kubesca curl --progress-bar -L $DOWNLOAD_URL -o $OUTPUT -# Find install dir -install_dir=/usr/local/bin # default if running as root -if [ "$(id -u)" -ne 0 ]; then - install_dir=$BASE_DIR/bin # if not running as root, install to user dir - export PATH=$PATH:$BASE_DIR/bin -fi +# Determine install directory +install_dir=/usr/local/bin +[ "$(id -u)" -ne 0 ] && install_dir=$BASE_DIR/bin && export PATH=$PATH:$BASE_DIR/bin # Create install dir if it does not exist -if [ ! -d "$install_dir" ]; then - mkdir -p $install_dir -fi +mkdir -p $install_dir -chmod +x $OUTPUT 2>/dev/null +chmod +x $OUTPUT -# cleaning up old install -SUDO= -if [ "$(id -u)" -ne 0 ] && [ -n "$(which sudo)" ] && [ "$KUBESCAPE_EXEC" != "" ] && [ -f /usr/local/bin/$KUBESCAPE_EXEC ]; then - SUDO=sudo - echo -e "\n\033[33mOld installation as root found, do you want to remove it? [\033[0my\033[33m/n]:" - read -n 1 -r - if [[ ! $REPLY =~ ^[Yy]$ ]] && [[ "$REPLY" != "" ]]; then - echo -e "\n\033[0mSkipping old installation as root removal." - else - echo -e "\n\033[0mWe will need the root access to uninstall the old kubescape CLI." - if $SUDO rm -f /usr/local/bin/$KUBESCAPE_EXEC 2>/dev/null; then - echo -e "\033[32mRemoved old installation as root at /usr/local/bin/$KUBESCAPE_EXEC" - else - echo -e "\033[31mFailed to remove old installation as root at /usr/local/bin/$KUBESCAPE_EXEC, please remove it manually." - fi - fi -fi +# Remove old installations +SUDO="" +[ "$(id -u)" -ne 0 ] && [ -n "$(which sudo)" ] && [ -f /usr/local/bin/$KUBESCAPE_EXEC ] && SUDO=sudo -if [ "$KUBESCAPE_EXEC" != "" ]; then - if [ "${SUDO_USER:-$USER}" != "" ]; then - rm -f /home/"${SUDO_USER:-$USER}"/.kubescape/bin/$KUBESCAPE_EXEC 2>/dev/null || true - fi - if [ "$BASE_DIR" != "" ]; then - rm -f $BASE_DIR/bin/$KUBESCAPE_EXEC 2>/dev/null || true - fi -fi +$SUDO remove_old_install "/usr/local/bin/$KUBESCAPE_EXEC" +remove_old_install "$BASE_DIR/bin/$KUBESCAPE_EXEC" -# Old install location, clean all those things up -for pdir in ${PATH//:/ }; do - edir="${pdir/#\~/$HOME}" - if [[ $edir == $HOME/* ]] && [[ -f $edir/$KUBESCAPE_EXEC ]]; then - echo -e "\n\033[33mOld installation found at $edir/$KUBESCAPE_EXEC, do you want to remove it? [\033[0my\033[33m/n]:" - read -n 1 -r - if [[ ! $REPLY =~ ^[Yy]$ ]] && [[ "$REPLY" != "" ]]; then - continue - fi - if rm -f "$edir"/$KUBESCAPE_EXEC 2>/dev/null; then - echo -e "\n\033[32mRemoved old installation at $edir/$KUBESCAPE_EXEC" - else - echo -e "\n\033[31mFailed to remove old installation as root at $edir/$KUBESCAPE_EXEC, please remove it manually." - fi - fi +# Remove any old installations in user's PATH +IFS=':' read -ra ADDR <<< "$PATH" +for pdir in "${ADDR[@]}"; do + remove_old_install "$pdir/$KUBESCAPE_EXEC" done -cp $OUTPUT $install_dir/$KUBESCAPE_EXEC -rm -f $OUTPUT +# Move the new executable to the install directory +mv $OUTPUT $install_dir/$KUBESCAPE_EXEC -echo echo -e "\033[32mFinished Installation." -echo -e "\033[0m" -$KUBESCAPE_EXEC version -echo - -echo -e "\033[35mUsage: $ $KUBESCAPE_EXEC scan" - if [ "$(id -u)" -ne 0 ]; then - echo -e "\nRemember to add the Kubescape CLI to your path with:" - echo -e " export PATH=\$PATH:$BASE_DIR/bin" - export PATH=\$PATH:$BASE_DIR/bin + echo -e "\033[1;35;32m\nRemember to add the Kubescape CLI to your path with:" + echo -e "\033[1;35;40m$ export PATH=\$PATH:$BASE_DIR/bin" fi -echo -e "\033[0m" +# Check cluster access by getting nodes +if ! kubectl get nodes &> /dev/null; then + echo -e "\033[0;37;32m\nRun:" + echo -e "\033[1;35;40m$ $KUBESCAPE_EXEC scan" + echo + exit 0 +fi + +echo -e "\033[0;37;40m" +echo -e "\033[0;37;32mExecuting Kubescape." +$KUBESCAPE_EXEC scan diff --git a/nginx:latest.json b/nginx:latest.json new file mode 100644 index 00000000..c5146a94 --- /dev/null +++ b/nginx:latest.json @@ -0,0 +1,19048 @@ +{ + "matches": [ + { + "vulnerability": { + "id": "CVE-2011-3374", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2011-3374", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2011-3374" + ], + "description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2011-3374", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2011-3374", + "namespace": "nvd:cpe", + "severity": "Low", + "urls": [ + "https://access.redhat.com/security/cve/cve-2011-3374", + "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480", + "https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html", + "https://seclists.org/fulldisclosure/2011/Sep/221", + "https://security-tracker.debian.org/tracker/CVE-2011-3374", + "https://snyk.io/vuln/SNYK-LINUX-APT-116518", + "https://ubuntu.com/security/CVE-2011-3374" + ], + "description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 4.3, + "exploitabilityScore": 8.6, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 3.7, + "exploitabilityScore": 2.2, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "apt", + "version": "2.2.4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2011-3374" + } + } + ], + "artifact": { + "id": "35d8a2a477e2fc2f", + "name": "apt", + "version": "2.2.4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/apt/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/apt.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/apt.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2", + "GPLv2+" + ], + "cpes": [ + "cpe:2.3:a:apt:apt:2.2.4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/apt@2.2.4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2022-3715", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-3715", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-3715" + ], + "description": "A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-3715", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-3715", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://bugzilla.redhat.com/show_bug.cgi?id=2126720" + ], + "description": "A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "bash", + "version": "5.1-2+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-3715" + } + } + ], + "artifact": { + "id": "e32e410796716c30", + "name": "bash", + "version": "5.1-2+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/bash/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/bash.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/bash.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-3" + ], + "cpes": [ + "cpe:2.3:a:bash:bash:5.1-2+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/bash@5.1-2+deb11u1?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2022-0563", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-0563", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-0563" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-0563", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", + "https://security.netapp.com/advisory/ntap-20220331-0002/" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", + "metrics": { + "baseScore": 1.9, + "exploitabilityScore": 3.4, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "util-linux", + "version": "2.36.1-8+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-0563" + } + } + ], + "artifact": { + "id": "4d5fea29af890d85", + "name": "bsdutils", + "version": "1:2.36.1-8+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/bsdutils/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/bsdutils.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-2-clause", + "BSD-3-clause", + "BSD-4-clause", + "GPL-2", + "GPL-2+", + "GPL-3", + "GPL-3+", + "LGPL", + "LGPL-2", + "LGPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "LGPL-3", + "LGPL-3+", + "MIT", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:bsdutils:bsdutils:1:2.36.1-8+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/bsdutils@1:2.36.1-8+deb11u1?arch=amd64&upstream=util-linux%402.36.1-8+deb11u1&distro=debian-11", + "upstreams": [ + { + "name": "util-linux", + "version": "2.36.1-8+deb11u1" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2016-2781", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2016-2781", + "namespace": "debian:distro:debian:11", + "severity": "Low", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2016-2781" + ], + "description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2016-2781", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2016-2781", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.openwall.com/lists/oss-security/2016/02/28/2", + "http://www.openwall.com/lists/oss-security/2016/02/28/3", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" + ], + "description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 2.1, + "exploitabilityScore": 3.9, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2, + "impactScore": 4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "coreutils", + "version": "8.32-4+b1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2016-2781" + } + }, + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "coreutils", + "version": "8.32-4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2016-2781" + } + } + ], + "artifact": { + "id": "daeac3deb7976b32", + "name": "coreutils", + "version": "8.32-4+b1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/coreutils/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/coreutils.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-3" + ], + "cpes": [ + "cpe:2.3:a:coreutils:coreutils:8.32-4+b1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/coreutils@8.32-4+b1?arch=amd64&upstream=coreutils%408.32-4&distro=debian-11", + "upstreams": [ + { + "name": "coreutils", + "version": "8.32-4" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-18018", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-18018", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-18018" + ], + "description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-18018", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-18018", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html" + ], + "description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 1.9, + "exploitabilityScore": 3.4, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", + "metrics": { + "baseScore": 4.7, + "exploitabilityScore": 1, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "coreutils", + "version": "8.32-4+b1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-18018" + } + }, + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "coreutils", + "version": "8.32-4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-18018" + } + } + ], + "artifact": { + "id": "daeac3deb7976b32", + "name": "coreutils", + "version": "8.32-4+b1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/coreutils/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/coreutils.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-3" + ], + "cpes": [ + "cpe:2.3:a:coreutils:coreutils:8.32-4+b1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/coreutils@8.32-4+b1?arch=amd64&upstream=coreutils%408.32-4&distro=debian-11", + "upstreams": [ + { + "name": "coreutils", + "version": "8.32-4" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-23914", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-23914", + "namespace": "debian:distro:debian:11", + "severity": "Critical", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-23914" + ], + "description": "A cleartext transmission of sensitive information vulnerability exists in curl n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2018-5709", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2018-5709", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" + ], + "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "krb5", + "version": "1.18.3-6+deb11u3" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2018-5709" + } + } + ], + "artifact": { + "id": "b78525f3ebdfdfd8", + "name": "libgssapi-krb5-2", + "version": "1.18.3-6+deb11u3", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libgssapi-krb5-2/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.18.3-6+deb11u3:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libgssapi-krb5-2@1.18.3-6+deb11u3?arch=amd64&upstream=krb5&distro=debian-11", + "upstreams": [ + { + "name": "krb5" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-9937", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-9937", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-9937" + ], + "description": "In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-9937", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-9937", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://bugzilla.maptools.org/show_bug.cgi?id=2707", + "http://www.securityfocus.com/bid/99304", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" + ], + "description": "In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 4.3, + "exploitabilityScore": 8.6, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "jbigkit", + "version": "2.1-3.1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-9937" + } + } + ], + "artifact": { + "id": "1fdc95f53bdaa2e3", + "name": "libjbig0", + "version": "2.1-3.1+b2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libjbig0/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libjbig0:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2", + "GPL-2+" + ], + "cpes": [ + "cpe:2.3:a:libjbig0:libjbig0:2.1-3.1+b2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libjbig0@2.1-3.1+b2?arch=amd64&upstream=jbigkit%402.1-3.1&distro=debian-11", + "upstreams": [ + { + "name": "jbigkit", + "version": "2.1-3.1" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2021-46822", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2021-46822", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2021-46822" + ], + "description": "The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2021-46822", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2021-46822", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://exchange.xforce.ibmcloud.com/vulnerabilities/221567", + "https://github.com/libjpeg-turbo/libjpeg-turbo/commit/f35fd27ec641c42d6b115bfa595e483ec58188d2" + ], + "description": "The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 4.3, + "exploitabilityScore": 8.6, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libjpeg-turbo", + "version": "1:2.0.6-4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2021-46822" + } + } + ], + "artifact": { + "id": "20514b4ebbedb12b", + "name": "libjpeg62-turbo", + "version": "1:2.0.6-4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libjpeg62-turbo/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-3", + "BSD-BY-LC-NE", + "Expat", + "NTP", + "zlib" + ], + "cpes": [ + "cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo:1:2.0.6-4:*:*:*:*:*:*:*", + "cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo:1:2.0.6-4:*:*:*:*:*:*:*", + "cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo:1:2.0.6-4:*:*:*:*:*:*:*", + "cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo:1:2.0.6-4:*:*:*:*:*:*:*", + "cpe:2.3:a:libjpeg62:libjpeg62-turbo:1:2.0.6-4:*:*:*:*:*:*:*", + "cpe:2.3:a:libjpeg62:libjpeg62_turbo:1:2.0.6-4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libjpeg62-turbo@1:2.0.6-4?arch=amd64&upstream=libjpeg-turbo&distro=debian-11", + "upstreams": [ + { + "name": "libjpeg-turbo" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-36054", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-36054", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-36054" + ], + "description": "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-36054", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-36054", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", + "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", + "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", + "https://web.mit.edu/kerberos/www/advisories/" + ], + "description": "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "krb5", + "version": "1.18.3-6+deb11u3" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-36054" + } + } + ], + "artifact": { + "id": "eee18a8d6a6e2c05", + "name": "libk5crypto3", + "version": "1.18.3-6+deb11u3", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libk5crypto3/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libk5crypto3:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:libk5crypto3:libk5crypto3:1.18.3-6+deb11u3:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libk5crypto3@1.18.3-6+deb11u3?arch=amd64&upstream=krb5&distro=debian-11", + "upstreams": [ + { + "name": "krb5" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2018-5709", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2018-5709", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2018-5709" + ], + "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2018-5709", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2018-5709", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" + ], + "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "krb5", + "version": "1.18.3-6+deb11u3" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2018-5709" + } + } + ], + "artifact": { + "id": "eee18a8d6a6e2c05", + "name": "libk5crypto3", + "version": "1.18.3-6+deb11u3", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libk5crypto3/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libk5crypto3:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:libk5crypto3:libk5crypto3:1.18.3-6+deb11u3:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libk5crypto3@1.18.3-6+deb11u3?arch=amd64&upstream=krb5&distro=debian-11", + "upstreams": [ + { + "name": "krb5" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-36054", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-36054", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-36054" + ], + "description": "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-36054", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-36054", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", + "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", + "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", + "https://web.mit.edu/kerberos/www/advisories/" + ], + "description": "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "krb5", + "version": "1.18.3-6+deb11u3" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-36054" + } + } + ], + "artifact": { + "id": "d8d66570c5b54080", + "name": "libkrb5-3", + "version": "1.18.3-6+deb11u3", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libkrb5-3/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libkrb5-3:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:libkrb5-3:libkrb5-3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5-3:libkrb5_3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5_3:libkrb5-3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5_3:libkrb5_3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5:libkrb5-3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5:libkrb5_3:1.18.3-6+deb11u3:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libkrb5-3@1.18.3-6+deb11u3?arch=amd64&upstream=krb5&distro=debian-11", + "upstreams": [ + { + "name": "krb5" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2018-5709", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2018-5709", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2018-5709" + ], + "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2018-5709", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2018-5709", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" + ], + "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "krb5", + "version": "1.18.3-6+deb11u3" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2018-5709" + } + } + ], + "artifact": { + "id": "d8d66570c5b54080", + "name": "libkrb5-3", + "version": "1.18.3-6+deb11u3", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libkrb5-3/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libkrb5-3:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:libkrb5-3:libkrb5-3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5-3:libkrb5_3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5_3:libkrb5-3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5_3:libkrb5_3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5:libkrb5-3:1.18.3-6+deb11u3:*:*:*:*:*:*:*", + "cpe:2.3:a:libkrb5:libkrb5_3:1.18.3-6+deb11u3:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libkrb5-3@1.18.3-6+deb11u3?arch=amd64&upstream=krb5&distro=debian-11", + "upstreams": [ + { + "name": "krb5" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-36054", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-36054", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-36054" + ], + "description": "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-36054", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-36054", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", + "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", + "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", + "https://web.mit.edu/kerberos/www/advisories/" + ], + "description": "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "krb5", + "version": "1.18.3-6+deb11u3" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-36054" + } + } + ], + "artifact": { + "id": "b7f88754be28592f", + "name": "libkrb5support0", + "version": "1.18.3-6+deb11u3", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libkrb5support0/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libkrb5support0:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:libkrb5support0:libkrb5support0:1.18.3-6+deb11u3:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libkrb5support0@1.18.3-6+deb11u3?arch=amd64&upstream=krb5&distro=debian-11", + "upstreams": [ + { + "name": "krb5" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2018-5709", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2018-5709", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2018-5709" + ], + "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2018-5709", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2018-5709", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" + ], + "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "krb5", + "version": "1.18.3-6+deb11u3" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2018-5709" + } + } + ], + "artifact": { + "id": "b7f88754be28592f", + "name": "libkrb5support0", + "version": "1.18.3-6+deb11u3", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libkrb5support0/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libkrb5support0:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:libkrb5support0:libkrb5support0:1.18.3-6+deb11u3:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libkrb5support0@1.18.3-6+deb11u3?arch=amd64&upstream=krb5&distro=debian-11", + "upstreams": [ + { + "name": "krb5" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-2953", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-2953", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-2953" + ], + "description": "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-2953", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-2953", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://seclists.org/fulldisclosure/2023/Jul/47", + "http://seclists.org/fulldisclosure/2023/Jul/48", + "http://seclists.org/fulldisclosure/2023/Jul/52", + "https://access.redhat.com/security/cve/CVE-2023-2953", + "https://bugs.openldap.org/show_bug.cgi?id=9904", + "https://security.netapp.com/advisory/ntap-20230703-0005/", + "https://support.apple.com/kb/HT213843", + "https://support.apple.com/kb/HT213844", + "https://support.apple.com/kb/HT213845" + ], + "description": "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openldap", + "version": "2.4.57+dfsg-3+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-2953" + } + } + ], + "artifact": { + "id": "796a192b709a2a2b", + "name": "libldap-2.4-2", + "version": "2.4.57+dfsg-3+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libldap-2.4-2/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libldap-2.4-2@2.4.57+dfsg-3+deb11u1?arch=amd64&upstream=openldap&distro=debian-11", + "upstreams": [ + { + "name": "openldap" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2020-15719", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2020-15719", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2020-15719" + ], + "description": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2020-15719", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2020-15719", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html", + "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html", + "https://access.redhat.com/errata/RHBA-2019:3674", + "https://bugs.openldap.org/show_bug.cgi?id=9266", + "https://bugzilla.redhat.com/show_bug.cgi?id=1740070", + "https://kc.mcafee.com/corporate/index?page=content&id=SB10365", + "https://www.oracle.com/security-alerts/cpuapr2022.html" + ], + "description": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N", + "metrics": { + "baseScore": 4, + "exploitabilityScore": 4.9, + "impactScore": 4.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", + "metrics": { + "baseScore": 4.2, + "exploitabilityScore": 1.6, + "impactScore": 2.5 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openldap", + "version": "2.4.57+dfsg-3+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2020-15719" + } + } + ], + "artifact": { + "id": "796a192b709a2a2b", + "name": "libldap-2.4-2", + "version": "2.4.57+dfsg-3+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libldap-2.4-2/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libldap-2.4-2@2.4.57+dfsg-3+deb11u1?arch=amd64&upstream=openldap&distro=debian-11", + "upstreams": [ + { + "name": "openldap" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-17740", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-17740", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-17740" + ], + "description": "contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-17740", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-17740", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html", + "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html", + "http://www.openldap.org/its/index.cgi/Incoming?id=8759", + "https://kc.mcafee.com/corporate/index?page=content&id=SB10365", + "https://www.oracle.com/security-alerts/cpuapr2022.html" + ], + "description": "contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openldap", + "version": "2.4.57+dfsg-3+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-17740" + } + } + ], + "artifact": { + "id": "796a192b709a2a2b", + "name": "libldap-2.4-2", + "version": "2.4.57+dfsg-3+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libldap-2.4-2/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libldap-2.4-2@2.4.57+dfsg-3+deb11u1?arch=amd64&upstream=openldap&distro=debian-11", + "upstreams": [ + { + "name": "openldap" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-14159", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-14159", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-14159" + ], + "description": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-14159", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-14159", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.openldap.org/its/index.cgi?findid=8703", + "https://www.oracle.com/security-alerts/cpuapr2022.html" + ], + "description": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 1.9, + "exploitabilityScore": 3.4, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 4.7, + "exploitabilityScore": 1, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openldap", + "version": "2.4.57+dfsg-3+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-14159" + } + } + ], + "artifact": { + "id": "796a192b709a2a2b", + "name": "libldap-2.4-2", + "version": "2.4.57+dfsg-3+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libldap-2.4-2/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libldap-2.4-2@2.4.57+dfsg-3+deb11u1?arch=amd64&upstream=openldap&distro=debian-11", + "upstreams": [ + { + "name": "openldap" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2015-3276", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2015-3276", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2015-3276" + ], + "description": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2015-3276", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2015-3276", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://rhn.redhat.com/errata/RHSA-2015-2131.html", + "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", + "http://www.securitytracker.com/id/1034221", + "https://bugzilla.redhat.com/show_bug.cgi?id=1238322" + ], + "description": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openldap", + "version": "2.4.57+dfsg-3+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2015-3276" + } + } + ], + "artifact": { + "id": "796a192b709a2a2b", + "name": "libldap-2.4-2", + "version": "2.4.57+dfsg-3+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libldap-2.4-2/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap-2.4-2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libldap:libldap_2.4_2:2.4.57+dfsg-3+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libldap-2.4-2@2.4.57+dfsg-3+deb11u1?arch=amd64&upstream=openldap&distro=debian-11", + "upstreams": [ + { + "name": "openldap" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-0563", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-0563", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-0563" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-0563", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", + "https://security.netapp.com/advisory/ntap-20220331-0002/" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", + "metrics": { + "baseScore": 1.9, + "exploitabilityScore": 3.4, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "util-linux", + "version": "2.36.1-8+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-0563" + } + } + ], + "artifact": { + "id": "85192996a27b8c7f", + "name": "libmount1", + "version": "2.36.1-8+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libmount1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libmount1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-2-clause", + "BSD-3-clause", + "BSD-4-clause", + "GPL-2", + "GPL-2+", + "GPL-3", + "GPL-3+", + "LGPL", + "LGPL-2", + "LGPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "LGPL-3", + "LGPL-3+", + "MIT", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libmount1:libmount1:2.36.1-8+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libmount1@2.36.1-8+deb11u1?arch=amd64&upstream=util-linux&distro=debian-11", + "upstreams": [ + { + "name": "util-linux" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-41409", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-41409", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-41409" + ], + "description": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-41409", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-41409", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35", + "https://github.com/PCRE2Project/pcre2/issues/141" + ], + "description": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "pcre2", + "version": "10.36-2+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-41409" + } + } + ], + "artifact": { + "id": "5d07d7ec308f6bb2", + "name": "libpcre2-8-0", + "version": "10.36-2+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libpcre2-8-0/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.36-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.36-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.36-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.36-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.36-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.36-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.36-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.36-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libpcre2:libpcre2-8-0:10.36-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:libpcre2:libpcre2_8_0:10.36-2+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libpcre2-8-0@10.36-2+deb11u1?arch=amd64&upstream=pcre2&distro=debian-11", + "upstreams": [ + { + "name": "pcre2" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2019-20838", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2019-20838", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2019-20838" + ], + "description": "libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2019-20838", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2019-20838", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://seclists.org/fulldisclosure/2020/Dec/32", + "http://seclists.org/fulldisclosure/2021/Feb/14", + "https://bugs.gentoo.org/717920", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", + "https://support.apple.com/kb/HT211931", + "https://support.apple.com/kb/HT212147", + "https://www.pcre.org/original/changelog.txt" + ], + "description": "libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 4.3, + "exploitabilityScore": 8.6, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "pcre3", + "version": "2:8.39-13" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2019-20838" + } + } + ], + "artifact": { + "id": "1c1641a0882b431f", + "name": "libpcre3", + "version": "2:8.39-13", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libpcre3/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libpcre3:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libpcre3:libpcre3:2:8.39-13:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libpcre3@2:8.39-13?arch=amd64&upstream=pcre3&distro=debian-11", + "upstreams": [ + { + "name": "pcre3" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-7246", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-7246", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-7246" + ], + "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-7246", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-7246", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://www.securityfocus.com/bid/97067", + "https://access.redhat.com/errata/RHSA-2018:2486", + "https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/", + "https://security.gentoo.org/glsa/201710-25" + ], + "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 6.8, + "exploitabilityScore": 8.6, + "impactScore": 6.4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "pcre3", + "version": "2:8.39-13" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-7246" + } + } + ], + "artifact": { + "id": "1c1641a0882b431f", + "name": "libpcre3", + "version": "2:8.39-13", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libpcre3/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libpcre3:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libpcre3:libpcre3:2:8.39-13:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libpcre3@2:8.39-13?arch=amd64&upstream=pcre3&distro=debian-11", + "upstreams": [ + { + "name": "pcre3" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-7245", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-7245", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-7245" + ], + "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-7245", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-7245", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://www.securityfocus.com/bid/97067", + "https://access.redhat.com/errata/RHSA-2018:2486", + "https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/", + "https://security.gentoo.org/glsa/201710-25" + ], + "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 6.8, + "exploitabilityScore": 8.6, + "impactScore": 6.4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "pcre3", + "version": "2:8.39-13" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-7245" + } + } + ], + "artifact": { + "id": "1c1641a0882b431f", + "name": "libpcre3", + "version": "2:8.39-13", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libpcre3/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libpcre3:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libpcre3:libpcre3:2:8.39-13:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libpcre3@2:8.39-13?arch=amd64&upstream=pcre3&distro=debian-11", + "upstreams": [ + { + "name": "pcre3" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-16231", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-16231", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-16231" + ], + "description": "** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-16231", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-16231", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://packetstormsecurity.com/files/150897/PCRE-8.41-Buffer-Overflow.html", + "http://seclists.org/fulldisclosure/2018/Dec/33", + "http://www.openwall.com/lists/oss-security/2017/11/01/11", + "http://www.openwall.com/lists/oss-security/2017/11/01/3", + "http://www.openwall.com/lists/oss-security/2017/11/01/7", + "http://www.openwall.com/lists/oss-security/2017/11/01/8", + "http://www.securityfocus.com/bid/101688", + "https://bugs.exim.org/show_bug.cgi?id=2047" + ], + "description": "** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 2.1, + "exploitabilityScore": 3.9, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "pcre3", + "version": "2:8.39-13" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-16231" + } + } + ], + "artifact": { + "id": "1c1641a0882b431f", + "name": "libpcre3", + "version": "2:8.39-13", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libpcre3/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libpcre3:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libpcre3:libpcre3:2:8.39-13:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libpcre3@2:8.39-13?arch=amd64&upstream=pcre3&distro=debian-11", + "upstreams": [ + { + "name": "pcre3" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-11164", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-11164", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-11164" + ], + "description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-11164", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-11164", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://openwall.com/lists/oss-security/2017/07/11/3", + "http://www.openwall.com/lists/oss-security/2023/04/11/1", + "http://www.openwall.com/lists/oss-security/2023/04/12/1", + "http://www.securityfocus.com/bid/99575", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" + ], + "description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 10, + "impactScore": 6.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "pcre3", + "version": "2:8.39-13" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-11164" + } + } + ], + "artifact": { + "id": "1c1641a0882b431f", + "name": "libpcre3", + "version": "2:8.39-13", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libpcre3/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libpcre3:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libpcre3:libpcre3:2:8.39-13:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libpcre3@2:8.39-13?arch=amd64&upstream=pcre3&distro=debian-11", + "upstreams": [ + { + "name": "pcre3" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2021-4214", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2021-4214", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2021-4214" + ], + "description": "A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2021-4214", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2021-4214", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://access.redhat.com/security/cve/CVE-2021-4214", + "https://bugzilla.redhat.com/show_bug.cgi?id=2043393", + "https://github.com/glennrp/libpng/issues/302", + "https://security-tracker.debian.org/tracker/CVE-2021-4214", + "https://security.netapp.com/advisory/ntap-20221020-0001/" + ], + "description": "A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libpng1.6", + "version": "1.6.37-3" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2021-4214" + } + } + ], + "artifact": { + "id": "8ac7ccda954c414f", + "name": "libpng16-16", + "version": "1.6.37-3", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libpng16-16/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libpng16-16:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Apache-2.0", + "BSD-3-clause", + "BSD-like-with-advertising-clause", + "GPL-2", + "GPL-2+", + "expat", + "libpng" + ], + "cpes": [ + "cpe:2.3:a:libpng16-16:libpng16-16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16-16:libpng16_16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16_16:libpng16-16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16_16:libpng16_16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16:libpng16-16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16:libpng16_16:1.6.37-3:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libpng16-16@1.6.37-3?arch=amd64&upstream=libpng1.6&distro=debian-11", + "upstreams": [ + { + "name": "libpng1.6" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2019-6129", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2019-6129", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2019-6129" + ], + "description": "** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated \"I don't think it is libpng's job to free this buffer.\"", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2019-6129", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2019-6129", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/glennrp/libpng/issues/269", + "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" + ], + "description": "** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated \"I don't think it is libpng's job to free this buffer.\"", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 4.3, + "exploitabilityScore": 8.6, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libpng1.6", + "version": "1.6.37-3" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2019-6129" + } + } + ], + "artifact": { + "id": "8ac7ccda954c414f", + "name": "libpng16-16", + "version": "1.6.37-3", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libpng16-16/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libpng16-16:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Apache-2.0", + "BSD-3-clause", + "BSD-like-with-advertising-clause", + "GPL-2", + "GPL-2+", + "expat", + "libpng" + ], + "cpes": [ + "cpe:2.3:a:libpng16-16:libpng16-16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16-16:libpng16_16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16_16:libpng16-16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16_16:libpng16_16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16:libpng16-16:1.6.37-3:*:*:*:*:*:*:*", + "cpe:2.3:a:libpng16:libpng16_16:1.6.37-3:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libpng16-16@1.6.37-3?arch=amd64&upstream=libpng1.6&distro=debian-11", + "upstreams": [ + { + "name": "libpng1.6" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2021-36087", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2021-36087", + "namespace": "debian:distro:debian:11", + "severity": "Low", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2021-36087" + ], + "description": "The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2021-36087", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2021-36087", + "namespace": "nvd:cpe", + "severity": "Low", + "urls": [ + "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32675", + "https://github.com/SELinuxProject/selinux/commit/340f0eb7f3673e8aacaf0a96cbfcd4d12a405521", + "https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-585.yaml", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U7ZYR3PIJ75N6U2IONJWCKZ5L2NKJTGR/", + "https://lore.kernel.org/selinux/CAEN2sdqJKHvDzPnxS-J8grU8fSf32DDtx=kyh84OsCq_Vm+yaQ@mail.gmail.com/T/" + ], + "description": "The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 2.1, + "exploitabilityScore": 3.9, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 1.8, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libsepol", + "version": "3.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2021-36087" + } + } + ], + "artifact": { + "id": "455dae0a07323046", + "name": "libsepol1", + "version": "3.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsepol1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsepol1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL", + "LGPL" + ], + "cpes": [ + "cpe:2.3:a:libsepol1:libsepol1:3.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsepol1@3.1-1?arch=amd64&upstream=libsepol&distro=debian-11", + "upstreams": [ + { + "name": "libsepol" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2021-36086", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2021-36086", + "namespace": "debian:distro:debian:11", + "severity": "Low", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2021-36086" + ], + "description": "The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2021-36086", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2021-36086", + "namespace": "nvd:cpe", + "severity": "Low", + "urls": [ + "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32177", + "https://github.com/SELinuxProject/selinux/commit/c49a8ea09501ad66e799ea41b8154b6770fec2c8", + "https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-536.yaml", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U7ZYR3PIJ75N6U2IONJWCKZ5L2NKJTGR/" + ], + "description": "The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 2.1, + "exploitabilityScore": 3.9, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 1.8, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libsepol", + "version": "3.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2021-36086" + } + } + ], + "artifact": { + "id": "455dae0a07323046", + "name": "libsepol1", + "version": "3.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsepol1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsepol1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL", + "LGPL" + ], + "cpes": [ + "cpe:2.3:a:libsepol1:libsepol1:3.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsepol1@3.1-1?arch=amd64&upstream=libsepol&distro=debian-11", + "upstreams": [ + { + "name": "libsepol" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2021-36085", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2021-36085", + "namespace": "debian:distro:debian:11", + "severity": "Low", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2021-36085" + ], + "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2021-36085", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2021-36085", + "namespace": "nvd:cpe", + "severity": "Low", + "urls": [ + "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31124", + "https://github.com/SELinuxProject/selinux/commit/2d35fcc7e9e976a2346b1de20e54f8663e8a6cba", + "https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-421.yaml", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U7ZYR3PIJ75N6U2IONJWCKZ5L2NKJTGR/" + ], + "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 2.1, + "exploitabilityScore": 3.9, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 1.8, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libsepol", + "version": "3.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2021-36085" + } + } + ], + "artifact": { + "id": "455dae0a07323046", + "name": "libsepol1", + "version": "3.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsepol1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsepol1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL", + "LGPL" + ], + "cpes": [ + "cpe:2.3:a:libsepol1:libsepol1:3.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsepol1@3.1-1?arch=amd64&upstream=libsepol&distro=debian-11", + "upstreams": [ + { + "name": "libsepol" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2021-36084", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2021-36084", + "namespace": "debian:distro:debian:11", + "severity": "Low", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2021-36084" + ], + "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2021-36084", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2021-36084", + "namespace": "nvd:cpe", + "severity": "Low", + "urls": [ + "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31065", + "https://github.com/SELinuxProject/selinux/commit/f34d3d30c8325e4847a6b696fe7a3936a8a361f3", + "https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-417.yaml", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U7ZYR3PIJ75N6U2IONJWCKZ5L2NKJTGR/" + ], + "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 2.1, + "exploitabilityScore": 3.9, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 1.8, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libsepol", + "version": "3.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2021-36084" + } + } + ], + "artifact": { + "id": "455dae0a07323046", + "name": "libsepol1", + "version": "3.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsepol1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsepol1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL", + "LGPL" + ], + "cpes": [ + "cpe:2.3:a:libsepol1:libsepol1:3.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsepol1@3.1-1?arch=amd64&upstream=libsepol&distro=debian-11", + "upstreams": [ + { + "name": "libsepol" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-0563", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-0563", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-0563" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-0563", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", + "https://security.netapp.com/advisory/ntap-20220331-0002/" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", + "metrics": { + "baseScore": 1.9, + "exploitabilityScore": 3.4, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "util-linux", + "version": "2.36.1-8+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-0563" + } + } + ], + "artifact": { + "id": "c38aaebe13ed88d7", + "name": "libsmartcols1", + "version": "2.36.1-8+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsmartcols1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsmartcols1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-2-clause", + "BSD-3-clause", + "BSD-4-clause", + "GPL-2", + "GPL-2+", + "GPL-3", + "GPL-3+", + "LGPL", + "LGPL-2", + "LGPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "LGPL-3", + "LGPL-3+", + "MIT", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libsmartcols1:libsmartcols1:2.36.1-8+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsmartcols1@2.36.1-8+deb11u1?arch=amd64&upstream=util-linux&distro=debian-11", + "upstreams": [ + { + "name": "util-linux" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-1304", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-1304", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-1304" + ], + "description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-1304", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-1304", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://bugzilla.redhat.com/show_bug.cgi?id=2069726" + ], + "description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 6.8, + "exploitabilityScore": 8.6, + "impactScore": 6.4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "e2fsprogs", + "version": "1.46.2-2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-1304" + } + } + ], + "artifact": { + "id": "4ba13b2c11cb0876", + "name": "libss2", + "version": "1.46.2-2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libss2/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libss2:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libss2:libss2:1.46.2-2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libss2@1.46.2-2?arch=amd64&upstream=e2fsprogs&distro=debian-11", + "upstreams": [ + { + "name": "e2fsprogs" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2020-22218", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2020-22218", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2020-22218" + ], + "description": "An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2020-22218", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2020-22218", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://github.com/libssh2/libssh2/pull/476" + ], + "description": "An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libssh2", + "version": "1.9.0-2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2020-22218" + } + } + ], + "artifact": { + "id": "4228335ce25053eb", + "name": "libssh2-1", + "version": "1.9.0-2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libssh2-1/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libssh2-1:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD3" + ], + "cpes": [ + "cpe:2.3:a:libssh2-1:libssh2-1:1.9.0-2:*:*:*:*:*:*:*", + "cpe:2.3:a:libssh2-1:libssh2_1:1.9.0-2:*:*:*:*:*:*:*", + "cpe:2.3:a:libssh2_1:libssh2-1:1.9.0-2:*:*:*:*:*:*:*", + "cpe:2.3:a:libssh2_1:libssh2_1:1.9.0-2:*:*:*:*:*:*:*", + "cpe:2.3:a:libssh2:libssh2-1:1.9.0-2:*:*:*:*:*:*:*", + "cpe:2.3:a:libssh2:libssh2_1:1.9.0-2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libssh2-1@1.9.0-2?arch=amd64&upstream=libssh2&distro=debian-11", + "upstreams": [ + { + "name": "libssh2" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-0464", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-0464", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-0464" + ], + "description": "A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints. Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", + "cvss": [], + "fix": { + "versions": [ + "1.1.1n-0+deb11u5" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5417-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5417-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-0464", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-0464", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1", + "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html", + "https://www.debian.org/security/2023/dsa-5417", + "https://www.openssl.org/news/secadv/20230322.txt" + ], + "description": "A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints. Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "< 1.1.1n-0+deb11u5 (deb)", + "vulnerabilityID": "CVE-2023-0464" + } + } + ], + "artifact": { + "id": "63a11d0164944054", + "name": "libssl1.1", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libssl1.1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libssl1.1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libssl1.1:libssl1.1:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libssl1.1@1.1.1n-0+deb11u4?arch=amd64&upstream=openssl&distro=debian-11", + "upstreams": [ + { + "name": "openssl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-3817", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-3817", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-3817" + ], + "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-3817", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-3817", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://seclists.org/fulldisclosure/2023/Jul/43", + "http://www.openwall.com/lists/oss-security/2023/07/31/1", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5", + "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html", + "https://security.netapp.com/advisory/ntap-20230818-0014/", + "https://www.openssl.org/news/secadv/20230731.txt" + ], + "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-3817" + } + } + ], + "artifact": { + "id": "63a11d0164944054", + "name": "libssl1.1", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libssl1.1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libssl1.1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libssl1.1:libssl1.1:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libssl1.1@1.1.1n-0+deb11u4?arch=amd64&upstream=openssl&distro=debian-11", + "upstreams": [ + { + "name": "openssl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-3446", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-3446", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-3446" + ], + "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-3446", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-3446", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.openwall.com/lists/oss-security/2023/07/19/4", + "http://www.openwall.com/lists/oss-security/2023/07/19/5", + "http://www.openwall.com/lists/oss-security/2023/07/19/6", + "http://www.openwall.com/lists/oss-security/2023/07/31/1", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23", + "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html", + "https://security.netapp.com/advisory/ntap-20230803-0011/", + "https://www.openssl.org/news/secadv/20230719.txt" + ], + "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-3446" + } + } + ], + "artifact": { + "id": "63a11d0164944054", + "name": "libssl1.1", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libssl1.1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libssl1.1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libssl1.1:libssl1.1:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libssl1.1@1.1.1n-0+deb11u4?arch=amd64&upstream=openssl&distro=debian-11", + "upstreams": [ + { + "name": "openssl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-2650", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-2650", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-2650" + ], + "description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit. OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime. The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced. This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL. If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS. It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain. Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates. This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low.", + "cvss": [], + "fix": { + "versions": [ + "1.1.1n-0+deb11u5" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5417-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5417-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-2650", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-2650", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.openwall.com/lists/oss-security/2023/05/30/1", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a", + "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html", + "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009", + "https://security.netapp.com/advisory/ntap-20230703-0001/", + "https://www.debian.org/security/2023/dsa-5417", + "https://www.openssl.org/news/secadv/20230530.txt" + ], + "description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit. OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime. The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced. This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL. If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS. It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain. Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates. This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "< 1.1.1n-0+deb11u5 (deb)", + "vulnerabilityID": "CVE-2023-2650" + } + } + ], + "artifact": { + "id": "63a11d0164944054", + "name": "libssl1.1", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libssl1.1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libssl1.1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libssl1.1:libssl1.1:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libssl1.1@1.1.1n-0+deb11u4?arch=amd64&upstream=openssl&distro=debian-11", + "upstreams": [ + { + "name": "openssl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-0466", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-0466", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-0466" + ], + "description": "The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications.", + "cvss": [], + "fix": { + "versions": [ + "1.1.1n-0+deb11u5" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5417-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5417-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-0466", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-0466", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061", + "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html", + "https://security.netapp.com/advisory/ntap-20230414-0001/", + "https://www.debian.org/security/2023/dsa-5417", + "https://www.openssl.org/news/secadv/20230328.txt" + ], + "description": "The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "< 1.1.1n-0+deb11u5 (deb)", + "vulnerabilityID": "CVE-2023-0466" + } + } + ], + "artifact": { + "id": "63a11d0164944054", + "name": "libssl1.1", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libssl1.1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libssl1.1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libssl1.1:libssl1.1:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libssl1.1@1.1.1n-0+deb11u4?arch=amd64&upstream=openssl&distro=debian-11", + "upstreams": [ + { + "name": "openssl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-0465", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-0465", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-0465" + ], + "description": "Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", + "cvss": [], + "fix": { + "versions": [ + "1.1.1n-0+deb11u5" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5417-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5417-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-0465", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-0465", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c", + "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html", + "https://security.netapp.com/advisory/ntap-20230414-0001/", + "https://www.debian.org/security/2023/dsa-5417", + "https://www.openssl.org/news/secadv/20230328.txt" + ], + "description": "Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "< 1.1.1n-0+deb11u5 (deb)", + "vulnerabilityID": "CVE-2023-0465" + } + } + ], + "artifact": { + "id": "63a11d0164944054", + "name": "libssl1.1", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libssl1.1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libssl1.1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libssl1.1:libssl1.1:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libssl1.1@1.1.1n-0+deb11u4?arch=amd64&upstream=openssl&distro=debian-11", + "upstreams": [ + { + "name": "openssl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2010-0928", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2010-0928", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2010-0928" + ], + "description": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2010-0928", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2010-0928", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/", + "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf", + "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html", + "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/", + "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750" + ], + "description": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:H/Au:N/C:C/I:N/A:N", + "metrics": { + "baseScore": 4, + "exploitabilityScore": 1.9, + "impactScore": 6.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2010-0928" + } + } + ], + "artifact": { + "id": "63a11d0164944054", + "name": "libssl1.1", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libssl1.1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libssl1.1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libssl1.1:libssl1.1:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libssl1.1@1.1.1n-0+deb11u4?arch=amd64&upstream=openssl&distro=debian-11", + "upstreams": [ + { + "name": "openssl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2007-6755", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2007-6755", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2007-6755" + ], + "description": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2007-6755", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2007-6755", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", + "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", + "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", + "http://rump2007.cr.yp.to/15-shumow.pdf", + "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", + "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", + "http://www.securityfocus.com/bid/63657", + "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html" + ], + "description": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N", + "metrics": { + "baseScore": 5.8, + "exploitabilityScore": 8.6, + "impactScore": 4.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2007-6755" + } + } + ], + "artifact": { + "id": "63a11d0164944054", + "name": "libssl1.1", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libssl1.1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libssl1.1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libssl1.1:libssl1.1:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libssl1.1@1.1.1n-0+deb11u4?arch=amd64&upstream=openssl&distro=debian-11", + "upstreams": [ + { + "name": "openssl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-31439", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-31439", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-31439" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-31439", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-31439", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/kastel-security/Journald", + "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", + "https://github.com/systemd/systemd/releases" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-31439" + } + } + ], + "artifact": { + "id": "4a1aa34abd06cc6c", + "name": "libsystemd0", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsystemd0/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libsystemd0:libsystemd0:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsystemd0@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-31438", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-31438", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-31438" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-31438", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-31438", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/kastel-security/Journald", + "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", + "https://github.com/systemd/systemd/releases" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-31438" + } + } + ], + "artifact": { + "id": "4a1aa34abd06cc6c", + "name": "libsystemd0", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsystemd0/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libsystemd0:libsystemd0:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsystemd0@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-31437", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-31437", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-31437" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-31437", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-31437", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/kastel-security/Journald", + "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", + "https://github.com/systemd/systemd/releases" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-31437" + } + } + ], + "artifact": { + "id": "4a1aa34abd06cc6c", + "name": "libsystemd0", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsystemd0/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libsystemd0:libsystemd0:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsystemd0@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2020-13529", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2020-13529", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2020-13529" + ], + "description": "An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2020-13529", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2020-13529", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.openwall.com/lists/oss-security/2021/08/04/2", + "http://www.openwall.com/lists/oss-security/2021/08/17/3", + "http://www.openwall.com/lists/oss-security/2021/09/07/3", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/", + "https://security.gentoo.org/glsa/202107-48", + "https://security.netapp.com/advisory/ntap-20210625-0005/", + "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1142" + ], + "description": "An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:A/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 2.9, + "exploitabilityScore": 5.5, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "talos-cna@cisco.com", + "type": "Secondary", + "version": "3.0", + "vector": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.1, + "exploitabilityScore": 1.6, + "impactScore": 4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.1, + "exploitabilityScore": 1.6, + "impactScore": 4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2020-13529" + } + } + ], + "artifact": { + "id": "4a1aa34abd06cc6c", + "name": "libsystemd0", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsystemd0/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libsystemd0:libsystemd0:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsystemd0@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2013-4392", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2013-4392", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2013-4392" + ], + "description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2013-4392", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2013-4392", + "namespace": "nvd:cpe", + "severity": "Low", + "urls": [ + "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357", + "http://www.openwall.com/lists/oss-security/2013/10/01/9", + "https://bugzilla.redhat.com/show_bug.cgi?id=859060" + ], + "description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 3.4, + "impactScore": 4.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2013-4392" + } + } + ], + "artifact": { + "id": "4a1aa34abd06cc6c", + "name": "libsystemd0", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libsystemd0/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libsystemd0:libsystemd0:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libsystemd0@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-3618", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-3618", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-3618" + ], + "description": "A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-3618", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-3618", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://access.redhat.com/security/cve/CVE-2023-3618", + "https://bugzilla.redhat.com/show_bug.cgi?id=2215865", + "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html", + "https://security.netapp.com/advisory/ntap-20230824-0012/" + ], + "description": "A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + }, + { + "source": "secalert@redhat.com", + "type": "Secondary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-3618" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-3316", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-3316", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-3316" + ], + "description": "A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.\n\n", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-3316", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-3316", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://gitlab.com/libtiff/libtiff/-/issues/515", + "https://gitlab.com/libtiff/libtiff/-/merge_requests/468", + "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html", + "https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/" + ], + "description": "A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.\n\n", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + }, + { + "source": "reefs@jfrog.com", + "type": "Secondary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.9, + "exploitabilityScore": 2.2, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-3316" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-2908", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-2908", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-2908" + ], + "description": "A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-2908", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-2908", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://access.redhat.com/security/cve/CVE-2023-2908", + "https://bugzilla.redhat.com/show_bug.cgi?id=2218830", + "https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f", + "https://gitlab.com/libtiff/libtiff/-/merge_requests/479", + "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html", + "https://security.netapp.com/advisory/ntap-20230731-0004/" + ], + "description": "A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + }, + { + "source": "secalert@redhat.com", + "type": "Secondary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-2908" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-26966", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-26966", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-26966" + ], + "description": "libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-26966", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-26966", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://gitlab.com/libtiff/libtiff/-/issues/530", + "https://gitlab.com/libtiff/libtiff/-/merge_requests/473", + "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html" + ], + "description": "libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-26966" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-26965", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-26965", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-26965" + ], + "description": "loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-26965", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-26965", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://gitlab.com/libtiff/libtiff/-/merge_requests/472", + "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html", + "https://security.netapp.com/advisory/ntap-20230706-0009/" + ], + "description": "loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-26965" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-25433", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-25433", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-25433" + ], + "description": "libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-25433", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-25433", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://gitlab.com/libtiff/libtiff/-/issues/520", + "https://gitlab.com/libtiff/libtiff/-/merge_requests/467", + "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html" + ], + "description": "libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-25433" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-40090", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-40090", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-40090" + ], + "description": "An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-40090", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-40090", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://gitlab.com/libtiff/libtiff/-/issues/455", + "https://gitlab.com/libtiff/libtiff/-/merge_requests/386" + ], + "description": "An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-40090" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-3164", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-3164", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-3164" + ], + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-3164" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-30775", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-30775", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-30775" + ], + "description": "A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-30775", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-30775", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://access.redhat.com/security/cve/CVE-2023-30775", + "https://bugzilla.redhat.com/show_bug.cgi?id=2187141", + "https://gitlab.com/libtiff/libtiff/-/issues/464", + "https://security.netapp.com/advisory/ntap-20230703-0002/" + ], + "description": "A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-30775" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-1916", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-1916", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-1916" + ], + "description": "A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-1916", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-1916", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://gitlab.com/libtiff/libtiff/-/issues/536", + "https://gitlab.com/libtiff/libtiff/-/issues/536,", + "https://gitlab.com/libtiff/libtiff/-/issues/537" + ], + "description": "A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", + "metrics": { + "baseScore": 6.1, + "exploitabilityScore": 1.8, + "impactScore": 4.2 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-1916" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-1210", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-1210", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-1210" + ], + "description": "A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-1210", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-1210", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://gitlab.com/libtiff/libtiff/-/issues/402", + "https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff", + "https://security.gentoo.org/glsa/202210-10", + "https://security.netapp.com/advisory/ntap-20220513-0005/", + "https://vuldb.com/?id.196363" + ], + "description": "A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 4.3, + "exploitabilityScore": 8.6, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + }, + { + "source": "cna@vuldb.com", + "type": "Secondary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 4.3, + "exploitabilityScore": 2.8, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-1210" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-1056", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-1056", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-1056" + ], + "description": "Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-1056", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-1056", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1056.json", + "https://gitlab.com/libtiff/libtiff/-/issues/391", + "https://gitlab.com/libtiff/libtiff/-/merge_requests/307", + "https://security.gentoo.org/glsa/202210-10", + "https://security.netapp.com/advisory/ntap-20221228-0008/" + ], + "description": "Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 4.3, + "exploitabilityScore": 8.6, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + }, + { + "source": "cve@gitlab.com", + "type": "Secondary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-1056" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2018-10126", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2018-10126", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2018-10126" + ], + "description": "LibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2018-10126", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2018-10126", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://bugzilla.maptools.org/show_bug.cgi?id=2786", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" + ], + "description": "LibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 4.3, + "exploitabilityScore": 8.6, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2018-10126" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-9117", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-9117", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-9117" + ], + "description": "In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-9117", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-9117", + "namespace": "nvd:cpe", + "severity": "Critical", + "urls": [ + "http://bugzilla.maptools.org/show_bug.cgi?id=2690", + "http://www.securityfocus.com/bid/98581", + "https://usn.ubuntu.com/3606-1/" + ], + "description": "In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 10, + "impactScore": 6.4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 9.8, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-9117" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-5563", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-5563", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-5563" + ], + "description": "LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-5563", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-5563", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://bugzilla.maptools.org/show_bug.cgi?id=2664", + "http://www.securityfocus.com/bid/95705", + "https://security.gentoo.org/glsa/201709-27", + "https://usn.ubuntu.com/3606-1/" + ], + "description": "LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 6.8, + "exploitabilityScore": 8.6, + "impactScore": 6.4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 8.8, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-5563" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-17973", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-17973", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-17973" + ], + "description": "** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-17973", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-17973", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://bugzilla.maptools.org/show_bug.cgi?id=2769", + "http://www.securityfocus.com/bid/102331", + "https://bugzilla.novell.com/show_bug.cgi?id=1074318", + "https://bugzilla.redhat.com/show_bug.cgi?id=1530912" + ], + "description": "** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 6.8, + "exploitabilityScore": 8.6, + "impactScore": 6.4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 8.8, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-17973" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2017-16232", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2017-16232", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2017-16232" + ], + "description": "** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2017-16232", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2017-16232", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html", + "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html", + "http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html", + "http://seclists.org/fulldisclosure/2018/Dec/32", + "http://seclists.org/fulldisclosure/2018/Dec/47", + "http://www.openwall.com/lists/oss-security/2017/11/01/11", + "http://www.openwall.com/lists/oss-security/2017/11/01/3", + "http://www.openwall.com/lists/oss-security/2017/11/01/7", + "http://www.openwall.com/lists/oss-security/2017/11/01/8", + "http://www.securityfocus.com/bid/101696" + ], + "description": "** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2017-16232" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-41175", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-41175", + "namespace": "debian:distro:debian:11", + "severity": "Unknown", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-41175" + ], + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-41175" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-40745", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-40745", + "namespace": "debian:distro:debian:11", + "severity": "Unknown", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-40745" + ], + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tiff", + "version": "4.2.0-1+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-40745" + } + } + ], + "artifact": { + "id": "02a94248cc826034", + "name": "libtiff5", + "version": "4.2.0-1+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtiff5/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libtiff5:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Hylafax" + ], + "cpes": [ + "cpe:2.3:a:libtiff5:libtiff5:4.2.0-1+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtiff5@4.2.0-1+deb11u4?arch=amd64&upstream=tiff&distro=debian-11", + "upstreams": [ + { + "name": "tiff" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-29491", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-29491", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-29491" + ], + "description": "ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-29491", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-29491", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://ncurses.scripts.mit.edu/?p=ncurses.git;a=commit;h=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56", + "http://www.openwall.com/lists/oss-security/2023/04/19/10", + "http://www.openwall.com/lists/oss-security/2023/04/19/11", + "https://security.netapp.com/advisory/ntap-20230517-0009/", + "https://www.openwall.com/lists/oss-security/2023/04/12/5", + "https://www.openwall.com/lists/oss-security/2023/04/13/4" + ], + "description": "ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "ncurses", + "version": "6.2+20201114-2+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-29491" + } + } + ], + "artifact": { + "id": "0e5503f23b30595d", + "name": "libtinfo6", + "version": "6.2+20201114-2+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libtinfo6/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libtinfo6:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-3-clause", + "MIT/X11", + "X11" + ], + "cpes": [ + "cpe:2.3:a:libtinfo6:libtinfo6:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libtinfo6@6.2+20201114-2+deb11u1?arch=amd64&upstream=ncurses&distro=debian-11", + "upstreams": [ + { + "name": "ncurses" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-31439", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-31439", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-31439" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-31439", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-31439", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/kastel-security/Journald", + "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", + "https://github.com/systemd/systemd/releases" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-31439" + } + } + ], + "artifact": { + "id": "e91f946b23d08cc9", + "name": "libudev1", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libudev1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libudev1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libudev1:libudev1:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libudev1@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-31438", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-31438", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-31438" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-31438", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-31438", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/kastel-security/Journald", + "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", + "https://github.com/systemd/systemd/releases" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-31438" + } + } + ], + "artifact": { + "id": "e91f946b23d08cc9", + "name": "libudev1", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libudev1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libudev1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libudev1:libudev1:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libudev1@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-31437", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-31437", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-31437" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-31437", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-31437", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/kastel-security/Journald", + "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", + "https://github.com/systemd/systemd/releases" + ], + "description": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-31437" + } + } + ], + "artifact": { + "id": "e91f946b23d08cc9", + "name": "libudev1", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libudev1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libudev1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libudev1:libudev1:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libudev1@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2020-13529", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2020-13529", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2020-13529" + ], + "description": "An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2020-13529", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2020-13529", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.openwall.com/lists/oss-security/2021/08/04/2", + "http://www.openwall.com/lists/oss-security/2021/08/17/3", + "http://www.openwall.com/lists/oss-security/2021/09/07/3", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/", + "https://security.gentoo.org/glsa/202107-48", + "https://security.netapp.com/advisory/ntap-20210625-0005/", + "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1142" + ], + "description": "An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:A/AC:M/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 2.9, + "exploitabilityScore": 5.5, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "talos-cna@cisco.com", + "type": "Secondary", + "version": "3.0", + "vector": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.1, + "exploitabilityScore": 1.6, + "impactScore": 4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.1, + "exploitabilityScore": 1.6, + "impactScore": 4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2020-13529" + } + } + ], + "artifact": { + "id": "e91f946b23d08cc9", + "name": "libudev1", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libudev1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libudev1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libudev1:libudev1:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libudev1@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2013-4392", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2013-4392", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2013-4392" + ], + "description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2013-4392", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2013-4392", + "namespace": "nvd:cpe", + "severity": "Low", + "urls": [ + "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357", + "http://www.openwall.com/lists/oss-security/2013/10/01/9", + "https://bugzilla.redhat.com/show_bug.cgi?id=859060" + ], + "description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 3.4, + "impactScore": 4.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "systemd", + "version": "247.3-7+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2013-4392" + } + } + ], + "artifact": { + "id": "e91f946b23d08cc9", + "name": "libudev1", + "version": "247.3-7+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libudev1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libudev1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "CC0-1.0", + "Expat", + "GPL-2", + "GPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libudev1:libudev1:247.3-7+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libudev1@247.3-7+deb11u2?arch=amd64&upstream=systemd&distro=debian-11", + "upstreams": [ + { + "name": "systemd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-0563", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-0563", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-0563" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-0563", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", + "https://security.netapp.com/advisory/ntap-20220331-0002/" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", + "metrics": { + "baseScore": 1.9, + "exploitabilityScore": 3.4, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "util-linux", + "version": "2.36.1-8+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-0563" + } + } + ], + "artifact": { + "id": "a183ab0912a52954", + "name": "libuuid1", + "version": "2.36.1-8+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libuuid1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libuuid1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-2-clause", + "BSD-3-clause", + "BSD-4-clause", + "GPL-2", + "GPL-2+", + "GPL-3", + "GPL-3+", + "LGPL", + "LGPL-2", + "LGPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "LGPL-3", + "LGPL-3+", + "MIT", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:libuuid1:libuuid1:2.36.1-8+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libuuid1@2.36.1-8+deb11u1?arch=amd64&upstream=util-linux&distro=debian-11", + "upstreams": [ + { + "name": "util-linux" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-3138", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-3138", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-3138" + ], + "description": "A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.", + "cvss": [], + "fix": { + "versions": [ + "2:1.7.2-1+deb11u1" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5433-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5433-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-3138", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-3138", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://access.redhat.com/security/cve/CVE-2023-3138", + "https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c", + "https://lists.x.org/archives/xorg-announce/2023-June/003406.html", + "https://lists.x.org/archives/xorg-announce/2023-June/003407.html" + ], + "description": "A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libx11", + "version": "2:1.7.2-1" + } + }, + "found": { + "versionConstraint": "< 2:1.7.2-1+deb11u1 (deb)", + "vulnerabilityID": "CVE-2023-3138" + } + } + ], + "artifact": { + "id": "ce4e2010925a4939", + "name": "libx11-6", + "version": "2:1.7.2-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libx11-6/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libx11-6:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libx11-6:libx11-6:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11-6:libx11_6:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11_6:libx11-6:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11_6:libx11_6:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11:libx11-6:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11:libx11_6:2:1.7.2-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libx11-6@2:1.7.2-1?arch=amd64&upstream=libx11&distro=debian-11", + "upstreams": [ + { + "name": "libx11" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-3138", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-3138", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-3138" + ], + "description": "A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.", + "cvss": [], + "fix": { + "versions": [ + "2:1.7.2-1+deb11u1" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5433-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5433-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-3138", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-3138", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://access.redhat.com/security/cve/CVE-2023-3138", + "https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c", + "https://lists.x.org/archives/xorg-announce/2023-June/003406.html", + "https://lists.x.org/archives/xorg-announce/2023-June/003407.html" + ], + "description": "A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libx11", + "version": "2:1.7.2-1" + } + }, + "found": { + "versionConstraint": "< 2:1.7.2-1+deb11u1 (deb)", + "vulnerabilityID": "CVE-2023-3138" + } + } + ], + "artifact": { + "id": "8defa9b2d11078dc", + "name": "libx11-data", + "version": "2:1.7.2-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libx11-data/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libx11-data.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libx11-data:libx11-data:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11-data:libx11_data:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11_data:libx11-data:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11_data:libx11_data:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11:libx11-data:2:1.7.2-1:*:*:*:*:*:*:*", + "cpe:2.3:a:libx11:libx11_data:2:1.7.2-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libx11-data@2:1.7.2-1?arch=all&upstream=libx11&distro=debian-11", + "upstreams": [ + { + "name": "libx11" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-2309", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-2309", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-2309" + ], + "description": "NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-2309", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-2309", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f", + "https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO/", + "https://security.gentoo.org/glsa/202208-06", + "https://security.netapp.com/advisory/ntap-20220915-0006/" + ], + "description": "NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "security@huntr.dev", + "type": "Secondary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libxml2", + "version": "2.9.10+dfsg-6.7+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-2309" + } + } + ], + "artifact": { + "id": "cfab8ee0ffb19913", + "name": "libxml2", + "version": "2.9.10+dfsg-6.7+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libxml2/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libxml2:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "ISC", + "MIT-1" + ], + "cpes": [ + "cpe:2.3:a:libxml2:libxml2:2.9.10+dfsg-6.7+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libxml2@2.9.10+dfsg-6.7+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2023-39615", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-39615", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-39615" + ], + "description": "Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-39615", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-39615", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://gitlab.gnome.org/GNOME/libxml2/-/issues/535" + ], + "description": "Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libxml2", + "version": "2.9.10+dfsg-6.7+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-39615" + } + } + ], + "artifact": { + "id": "cfab8ee0ffb19913", + "name": "libxml2", + "version": "2.9.10+dfsg-6.7+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libxml2/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libxml2:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "ISC", + "MIT-1" + ], + "cpes": [ + "cpe:2.3:a:libxml2:libxml2:2.9.10+dfsg-6.7+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libxml2@2.9.10+dfsg-6.7+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2016-3709", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2016-3709", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2016-3709" + ], + "description": "Possible cross-site scripting vulnerability in libxml after commit 960f0e2.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2016-3709", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2016-3709", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://mail.gnome.org/archives/xml/2018-January/msg00010.html" + ], + "description": "Possible cross-site scripting vulnerability in libxml after commit 960f0e2.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "metrics": { + "baseScore": 6.1, + "exploitabilityScore": 2.8, + "impactScore": 2.7 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libxml2", + "version": "2.9.10+dfsg-6.7+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2016-3709" + } + } + ], + "artifact": { + "id": "cfab8ee0ffb19913", + "name": "libxml2", + "version": "2.9.10+dfsg-6.7+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libxml2/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libxml2:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "ISC", + "MIT-1" + ], + "cpes": [ + "cpe:2.3:a:libxml2:libxml2:2.9.10+dfsg-6.7+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libxml2@2.9.10+dfsg-6.7+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2015-9019", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2015-9019", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2015-9019" + ], + "description": "In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2015-9019", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2015-9019", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://bugzilla.gnome.org/show_bug.cgi?id=758400", + "https://bugzilla.suse.com/show_bug.cgi?id=934119" + ], + "description": "In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.0", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libxslt", + "version": "1.1.34-4+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2015-9019" + } + } + ], + "artifact": { + "id": "ee58630377288c70", + "name": "libxslt1.1", + "version": "1.1.34-4+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libxslt1.1/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/libxslt1.1:amd64.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.34-4+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libxslt1.1@1.1.34-4+deb11u1?arch=amd64&upstream=libxslt&distro=debian-11", + "upstreams": [ + { + "name": "libxslt" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-4899", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-4899", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-4899" + ], + "description": "A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-4899", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-4899", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://github.com/facebook/zstd/issues/3200", + "https://security.netapp.com/advisory/ntap-20230725-0005/" + ], + "description": "A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "libzstd", + "version": "1.4.8+dfsg-2.1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-4899" + } + } + ], + "artifact": { + "id": "156fff5a33a4d4c0", + "name": "libzstd1", + "version": "1.4.8+dfsg-2.1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/libzstd1/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/libzstd1:amd64.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-3-clause", + "Expat", + "GPL-2", + "zlib" + ], + "cpes": [ + "cpe:2.3:a:libzstd1:libzstd1:1.4.8+dfsg-2.1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/libzstd1@1.4.8+dfsg-2.1?arch=amd64&upstream=libzstd&distro=debian-11", + "upstreams": [ + { + "name": "libzstd" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-29383", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-29383", + "namespace": "debian:distro:debian:11", + "severity": "Low", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-29383" + ], + "description": "In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-29383", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-29383", + "namespace": "nvd:cpe", + "severity": "Low", + "urls": [ + "https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d", + "https://github.com/shadow-maint/shadow/pull/687", + "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/", + "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797" + ], + "description": "In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 1.8, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "shadow", + "version": "1:4.8.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-29383" + } + } + ], + "artifact": { + "id": "8aa12b8095f6746e", + "name": "login", + "version": "1:4.8.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/login/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/login.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/login.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:login:login:1:4.8.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/login@1:4.8.1-1?arch=amd64&upstream=shadow&distro=debian-11", + "upstreams": [ + { + "name": "shadow" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2019-19882", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2019-19882", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2019-19882" + ], + "description": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2019-19882", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2019-19882", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://bugs.archlinux.org/task/64836", + "https://bugs.gentoo.org/702252", + "https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75", + "https://github.com/shadow-maint/shadow/pull/199", + "https://github.com/void-linux/void-packages/pull/17580", + "https://security.gentoo.org/glsa/202008-09" + ], + "description": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C", + "metrics": { + "baseScore": 6.9, + "exploitabilityScore": 3.4, + "impactScore": 10 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "shadow", + "version": "1:4.8.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2019-19882" + } + } + ], + "artifact": { + "id": "8aa12b8095f6746e", + "name": "login", + "version": "1:4.8.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/login/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/login.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/login.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:login:login:1:4.8.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/login@1:4.8.1-1?arch=amd64&upstream=shadow&distro=debian-11", + "upstreams": [ + { + "name": "shadow" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2013-4235", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2013-4235", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2013-4235" + ], + "description": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2013-4235", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2013-4235", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://access.redhat.com/security/cve/cve-2013-4235", + "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E", + "https://security-tracker.debian.org/tracker/CVE-2013-4235", + "https://security.gentoo.org/glsa/202210-26" + ], + "description": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:N/I:P/A:P", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 3.4, + "impactScore": 4.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", + "metrics": { + "baseScore": 4.7, + "exploitabilityScore": 1, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "shadow", + "version": "1:4.8.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2013-4235" + } + } + ], + "artifact": { + "id": "8aa12b8095f6746e", + "name": "login", + "version": "1:4.8.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/login/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/login.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/login.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:login:login:1:4.8.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/login@1:4.8.1-1?arch=amd64&upstream=shadow&distro=debian-11", + "upstreams": [ + { + "name": "shadow" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2007-5686", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2007-5686", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2007-5686" + ], + "description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2007-5686", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2007-5686", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.securityfocus.com/archive/1/482129/100/100/threaded", + "http://www.securityfocus.com/archive/1/482857/100/0/threaded", + "http://www.securityfocus.com/bid/26048", + "http://www.vupen.com/english/advisories/2007/3474", + "https://issues.rpath.com/browse/RPL-1825" + ], + "description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N", + "metrics": { + "baseScore": 4.9, + "exploitabilityScore": 3.9, + "impactScore": 6.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "shadow", + "version": "1:4.8.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2007-5686" + } + } + ], + "artifact": { + "id": "8aa12b8095f6746e", + "name": "login", + "version": "1:4.8.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/login/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/login.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/login.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:login:login:1:4.8.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/login@1:4.8.1-1?arch=amd64&upstream=shadow&distro=debian-11", + "upstreams": [ + { + "name": "shadow" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-1304", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-1304", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-1304" + ], + "description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-1304", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-1304", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://bugzilla.redhat.com/show_bug.cgi?id=2069726" + ], + "description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 6.8, + "exploitabilityScore": 8.6, + "impactScore": 6.4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "e2fsprogs", + "version": "1.46.2-2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-1304" + } + } + ], + "artifact": { + "id": "9ac5cde115b8b055", + "name": "logsave", + "version": "1.46.2-2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/logsave/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/logsave.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2", + "LGPL-2" + ], + "cpes": [ + "cpe:2.3:a:logsave:logsave:1.46.2-2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/logsave@1.46.2-2?arch=amd64&upstream=e2fsprogs&distro=debian-11", + "upstreams": [ + { + "name": "e2fsprogs" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-0563", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-0563", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-0563" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-0563", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", + "https://security.netapp.com/advisory/ntap-20220331-0002/" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", + "metrics": { + "baseScore": 1.9, + "exploitabilityScore": 3.4, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "util-linux", + "version": "2.36.1-8+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-0563" + } + } + ], + "artifact": { + "id": "6dad3fb630fad4a6", + "name": "mount", + "version": "2.36.1-8+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/mount/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/mount.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-2-clause", + "BSD-3-clause", + "BSD-4-clause", + "GPL-2", + "GPL-2+", + "GPL-3", + "GPL-3+", + "LGPL", + "LGPL-2", + "LGPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "LGPL-3", + "LGPL-3+", + "MIT", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:mount:mount:2.36.1-8+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/mount@2.36.1-8+deb11u1?arch=amd64&upstream=util-linux&distro=debian-11", + "upstreams": [ + { + "name": "util-linux" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-29491", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-29491", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-29491" + ], + "description": "ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-29491", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-29491", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://ncurses.scripts.mit.edu/?p=ncurses.git;a=commit;h=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56", + "http://www.openwall.com/lists/oss-security/2023/04/19/10", + "http://www.openwall.com/lists/oss-security/2023/04/19/11", + "https://security.netapp.com/advisory/ntap-20230517-0009/", + "https://www.openwall.com/lists/oss-security/2023/04/12/5", + "https://www.openwall.com/lists/oss-security/2023/04/13/4" + ], + "description": "ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "ncurses", + "version": "6.2+20201114-2+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-29491" + } + } + ], + "artifact": { + "id": "9f36c8fafc5de9d6", + "name": "ncurses-base", + "version": "6.2+20201114-2+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/ncurses-base/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/ncurses-base.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/ncurses-base.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-3-clause", + "MIT/X11", + "X11" + ], + "cpes": [ + "cpe:2.3:a:ncurses-base:ncurses-base:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses-base:ncurses_base:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses_base:ncurses-base:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses_base:ncurses_base:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses:ncurses-base:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses:ncurses_base:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/ncurses-base@6.2+20201114-2+deb11u1?arch=all&upstream=ncurses&distro=debian-11", + "upstreams": [ + { + "name": "ncurses" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-29491", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-29491", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-29491" + ], + "description": "ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-29491", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-29491", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://ncurses.scripts.mit.edu/?p=ncurses.git;a=commit;h=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56", + "http://www.openwall.com/lists/oss-security/2023/04/19/10", + "http://www.openwall.com/lists/oss-security/2023/04/19/11", + "https://security.netapp.com/advisory/ntap-20230517-0009/", + "https://www.openwall.com/lists/oss-security/2023/04/12/5", + "https://www.openwall.com/lists/oss-security/2023/04/13/4" + ], + "description": "ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "ncurses", + "version": "6.2+20201114-2+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-29491" + } + } + ], + "artifact": { + "id": "082d6dbda206b0ff", + "name": "ncurses-bin", + "version": "6.2+20201114-2+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/ncurses-bin/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/ncurses-bin.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-3-clause", + "MIT/X11", + "X11" + ], + "cpes": [ + "cpe:2.3:a:ncurses-bin:ncurses-bin:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses-bin:ncurses_bin:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses_bin:ncurses-bin:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses_bin:ncurses_bin:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses:ncurses-bin:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:ncurses:ncurses_bin:6.2+20201114-2+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/ncurses-bin@6.2+20201114-2+deb11u1?arch=amd64&upstream=ncurses&distro=debian-11", + "upstreams": [ + { + "name": "ncurses" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2020-36309", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2020-36309", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2020-36309" + ], + "description": "ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2020-36309", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2020-36309", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://github.com/openresty/lua-nginx-module/compare/v0.10.15...v0.10.16", + "https://github.com/openresty/lua-nginx-module/pull/1654", + "https://news.ycombinator.com/item?id=26712562", + "https://security.netapp.com/advisory/ntap-20210507-0005/" + ], + "description": "ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "nginx", + "version": "1.25.0-1~bullseye" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2020-36309" + } + } + ], + "artifact": { + "id": "5279257dbc7b380a", + "name": "nginx", + "version": "1.25.0-1~bullseye", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/nginx/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/nginx.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/nginx.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:nginx:nginx:1.25.0-1~bullseye:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/nginx@1.25.0-1~bullseye?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2013-0337", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2013-0337", + "namespace": "debian:distro:debian:11", + "severity": "Low", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2013-0337" + ], + "description": "The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2013-0337", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2013-0337", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://security.gentoo.org/glsa/glsa-201310-04.xml", + "http://www.openwall.com/lists/oss-security/2013/02/21/15", + "http://www.openwall.com/lists/oss-security/2013/02/22/1", + "http://www.openwall.com/lists/oss-security/2013/02/24/1" + ], + "description": "The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 10, + "impactScore": 6.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "nginx", + "version": "1.25.0-1~bullseye" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2013-0337" + } + } + ], + "artifact": { + "id": "5279257dbc7b380a", + "name": "nginx", + "version": "1.25.0-1~bullseye", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/nginx/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/nginx.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/nginx.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:nginx:nginx:1.25.0-1~bullseye:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/nginx@1.25.0-1~bullseye?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2009-4487", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2009-4487", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2009-4487" + ], + "description": "nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2009-4487", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2009-4487", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.securityfocus.com/archive/1/508830/100/0/threaded", + "http://www.securityfocus.com/bid/37711", + "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt" + ], + "description": "nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 6.8, + "exploitabilityScore": 8.6, + "impactScore": 6.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "nginx", + "version": "1.25.0-1~bullseye" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2009-4487" + } + } + ], + "artifact": { + "id": "5279257dbc7b380a", + "name": "nginx", + "version": "1.25.0-1~bullseye", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/nginx/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/nginx.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/nginx.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:nginx:nginx:1.25.0-1~bullseye:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/nginx@1.25.0-1~bullseye?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2023-0464", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-0464", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-0464" + ], + "description": "A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints. Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", + "cvss": [], + "fix": { + "versions": [ + "1.1.1n-0+deb11u5" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5417-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5417-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-0464", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-0464", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1", + "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html", + "https://www.debian.org/security/2023/dsa-5417", + "https://www.openssl.org/news/secadv/20230322.txt" + ], + "description": "A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints. Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "< 1.1.1n-0+deb11u5 (deb)", + "vulnerabilityID": "CVE-2023-0464" + } + } + ], + "artifact": { + "id": "a7dc6e66845f14bf", + "name": "openssl", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/openssl/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:openssl:openssl:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/openssl@1.1.1n-0+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2023-3817", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-3817", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-3817" + ], + "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-3817", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-3817", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://seclists.org/fulldisclosure/2023/Jul/43", + "http://www.openwall.com/lists/oss-security/2023/07/31/1", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5", + "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html", + "https://security.netapp.com/advisory/ntap-20230818-0014/", + "https://www.openssl.org/news/secadv/20230731.txt" + ], + "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-3817" + } + } + ], + "artifact": { + "id": "a7dc6e66845f14bf", + "name": "openssl", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/openssl/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:openssl:openssl:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/openssl@1.1.1n-0+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2023-3446", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-3446", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-3446" + ], + "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-3446", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-3446", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.openwall.com/lists/oss-security/2023/07/19/4", + "http://www.openwall.com/lists/oss-security/2023/07/19/5", + "http://www.openwall.com/lists/oss-security/2023/07/19/6", + "http://www.openwall.com/lists/oss-security/2023/07/31/1", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23", + "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html", + "https://security.netapp.com/advisory/ntap-20230803-0011/", + "https://www.openssl.org/news/secadv/20230719.txt" + ], + "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-3446" + } + } + ], + "artifact": { + "id": "a7dc6e66845f14bf", + "name": "openssl", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/openssl/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:openssl:openssl:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/openssl@1.1.1n-0+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2023-2650", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-2650", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-2650" + ], + "description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit. OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime. The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced. This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL. If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS. It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain. Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates. This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low.", + "cvss": [], + "fix": { + "versions": [ + "1.1.1n-0+deb11u5" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5417-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5417-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-2650", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-2650", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.openwall.com/lists/oss-security/2023/05/30/1", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a", + "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html", + "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009", + "https://security.netapp.com/advisory/ntap-20230703-0001/", + "https://www.debian.org/security/2023/dsa-5417", + "https://www.openssl.org/news/secadv/20230530.txt" + ], + "description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit. OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime. The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced. This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL. If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS. It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain. Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates. This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 6.5, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "< 1.1.1n-0+deb11u5 (deb)", + "vulnerabilityID": "CVE-2023-2650" + } + } + ], + "artifact": { + "id": "a7dc6e66845f14bf", + "name": "openssl", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/openssl/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:openssl:openssl:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/openssl@1.1.1n-0+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2023-0466", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-0466", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-0466" + ], + "description": "The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications.", + "cvss": [], + "fix": { + "versions": [ + "1.1.1n-0+deb11u5" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5417-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5417-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-0466", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-0466", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061", + "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html", + "https://security.netapp.com/advisory/ntap-20230414-0001/", + "https://www.debian.org/security/2023/dsa-5417", + "https://www.openssl.org/news/secadv/20230328.txt" + ], + "description": "The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "< 1.1.1n-0+deb11u5 (deb)", + "vulnerabilityID": "CVE-2023-0466" + } + } + ], + "artifact": { + "id": "a7dc6e66845f14bf", + "name": "openssl", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/openssl/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:openssl:openssl:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/openssl@1.1.1n-0+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2023-0465", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-0465", + "namespace": "debian:distro:debian:11", + "severity": "Medium", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-0465" + ], + "description": "Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", + "cvss": [], + "fix": { + "versions": [ + "1.1.1n-0+deb11u5" + ], + "state": "fixed" + }, + "advisories": [ + { + "id": "DSA-5417-1", + "link": "https://security-tracker.debian.org/tracker/DSA-5417-1" + } + ] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-0465", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-0465", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95", + "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c", + "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html", + "https://security.netapp.com/advisory/ntap-20230414-0001/", + "https://www.debian.org/security/2023/dsa-5417", + "https://www.openssl.org/news/secadv/20230328.txt" + ], + "description": "Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 5.3, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "< 1.1.1n-0+deb11u5 (deb)", + "vulnerabilityID": "CVE-2023-0465" + } + } + ], + "artifact": { + "id": "a7dc6e66845f14bf", + "name": "openssl", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/openssl/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:openssl:openssl:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/openssl@1.1.1n-0+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2010-0928", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2010-0928", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2010-0928" + ], + "description": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2010-0928", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2010-0928", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/", + "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf", + "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html", + "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/", + "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750" + ], + "description": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:H/Au:N/C:C/I:N/A:N", + "metrics": { + "baseScore": 4, + "exploitabilityScore": 1.9, + "impactScore": 6.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2010-0928" + } + } + ], + "artifact": { + "id": "a7dc6e66845f14bf", + "name": "openssl", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/openssl/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:openssl:openssl:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/openssl@1.1.1n-0+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2007-6755", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2007-6755", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2007-6755" + ], + "description": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2007-6755", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2007-6755", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", + "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", + "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", + "http://rump2007.cr.yp.to/15-shumow.pdf", + "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", + "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", + "http://www.securityfocus.com/bid/63657", + "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html" + ], + "description": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N", + "metrics": { + "baseScore": 5.8, + "exploitabilityScore": 8.6, + "impactScore": 4.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "openssl", + "version": "1.1.1n-0+deb11u4" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2007-6755" + } + } + ], + "artifact": { + "id": "a7dc6e66845f14bf", + "name": "openssl", + "version": "1.1.1n-0+deb11u4", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/openssl/copyright", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.conffiles", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/info/openssl.md5sums", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [], + "cpes": [ + "cpe:2.3:a:openssl:openssl:1.1.1n-0+deb11u4:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/openssl@1.1.1n-0+deb11u4?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2023-29383", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-29383", + "namespace": "debian:distro:debian:11", + "severity": "Low", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-29383" + ], + "description": "In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-29383", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-29383", + "namespace": "nvd:cpe", + "severity": "Low", + "urls": [ + "https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d", + "https://github.com/shadow-maint/shadow/pull/687", + "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/", + "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797" + ], + "description": "In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 1.8, + "impactScore": 1.4 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "shadow", + "version": "1:4.8.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-29383" + } + } + ], + "artifact": { + "id": "c31ea6da71073f40", + "name": "passwd", + "version": "1:4.8.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/passwd/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/passwd.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/passwd.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:passwd:passwd:1:4.8.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/passwd@1:4.8.1-1?arch=amd64&upstream=shadow&distro=debian-11", + "upstreams": [ + { + "name": "shadow" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2019-19882", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2019-19882", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2019-19882" + ], + "description": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2019-19882", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2019-19882", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "https://bugs.archlinux.org/task/64836", + "https://bugs.gentoo.org/702252", + "https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75", + "https://github.com/shadow-maint/shadow/pull/199", + "https://github.com/void-linux/void-packages/pull/17580", + "https://security.gentoo.org/glsa/202008-09" + ], + "description": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C", + "metrics": { + "baseScore": 6.9, + "exploitabilityScore": 3.4, + "impactScore": 10 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "shadow", + "version": "1:4.8.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2019-19882" + } + } + ], + "artifact": { + "id": "c31ea6da71073f40", + "name": "passwd", + "version": "1:4.8.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/passwd/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/passwd.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/passwd.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:passwd:passwd:1:4.8.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/passwd@1:4.8.1-1?arch=amd64&upstream=shadow&distro=debian-11", + "upstreams": [ + { + "name": "shadow" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2013-4235", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2013-4235", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2013-4235" + ], + "description": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2013-4235", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2013-4235", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://access.redhat.com/security/cve/cve-2013-4235", + "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235", + "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E", + "https://security-tracker.debian.org/tracker/CVE-2013-4235", + "https://security.gentoo.org/glsa/202210-26" + ], + "description": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:N/I:P/A:P", + "metrics": { + "baseScore": 3.3, + "exploitabilityScore": 3.4, + "impactScore": 4.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", + "metrics": { + "baseScore": 4.7, + "exploitabilityScore": 1, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "shadow", + "version": "1:4.8.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2013-4235" + } + } + ], + "artifact": { + "id": "c31ea6da71073f40", + "name": "passwd", + "version": "1:4.8.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/passwd/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/passwd.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/passwd.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:passwd:passwd:1:4.8.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/passwd@1:4.8.1-1?arch=amd64&upstream=shadow&distro=debian-11", + "upstreams": [ + { + "name": "shadow" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2007-5686", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2007-5686", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2007-5686" + ], + "description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2007-5686", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2007-5686", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "http://www.securityfocus.com/archive/1/482129/100/100/threaded", + "http://www.securityfocus.com/archive/1/482857/100/0/threaded", + "http://www.securityfocus.com/bid/26048", + "http://www.vupen.com/english/advisories/2007/3474", + "https://issues.rpath.com/browse/RPL-1825" + ], + "description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N", + "metrics": { + "baseScore": 4.9, + "exploitabilityScore": 3.9, + "impactScore": 6.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "shadow", + "version": "1:4.8.1-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2007-5686" + } + } + ], + "artifact": { + "id": "c31ea6da71073f40", + "name": "passwd", + "version": "1:4.8.1-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/passwd/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/passwd.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/passwd.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2" + ], + "cpes": [ + "cpe:2.3:a:passwd:passwd:1:4.8.1-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/passwd@1:4.8.1-1?arch=amd64&upstream=shadow&distro=debian-11", + "upstreams": [ + { + "name": "shadow" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-31484", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-31484", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-31484" + ], + "description": "CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-31484", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-31484", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://www.openwall.com/lists/oss-security/2023/04/29/1", + "http://www.openwall.com/lists/oss-security/2023/05/03/3", + "http://www.openwall.com/lists/oss-security/2023/05/03/5", + "http://www.openwall.com/lists/oss-security/2023/05/07/2", + "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/", + "https://github.com/andk/cpanpm/pull/175", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/", + "https://metacpan.org/dist/CPAN/changes", + "https://www.openwall.com/lists/oss-security/2023/04/18/14" + ], + "description": "CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 8.1, + "exploitabilityScore": 2.2, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "perl", + "version": "5.32.1-4+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-31484" + } + } + ], + "artifact": { + "id": "70fee5abfefd1735", + "name": "perl-base", + "version": "5.32.1-4+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/perl-base/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/perl-base.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Artistic", + "Artistic-2", + "Artistic-dist", + "BSD-3-clause", + "BSD-3-clause-GENERIC", + "BSD-3-clause-with-weird-numbering", + "BSD-4-clause-POWERDOG", + "BZIP", + "DONT-CHANGE-THE-GPL", + "Expat", + "GPL-1", + "GPL-1+", + "GPL-2", + "GPL-2+", + "GPL-3+-WITH-BISON-EXCEPTION", + "HSIEH-BSD", + "HSIEH-DERIVATIVE", + "LGPL-2.1", + "REGCOMP", + "REGCOMP,", + "RRA-KEEP-THIS-NOTICE", + "SDBM-PUBLIC-DOMAIN", + "TEXT-TABS", + "Unicode", + "ZLIB" + ], + "cpes": [ + "cpe:2.3:a:perl-base:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl-base:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl_base:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl_base:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/perl-base@5.32.1-4+deb11u2?arch=amd64&upstream=perl&distro=debian-11", + "upstreams": [ + { + "name": "perl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2020-16156", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2020-16156", + "namespace": "debian:distro:debian:11", + "severity": "High", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2020-16156" + ], + "description": "CPAN 2.28 allows Signature Verification Bypass.", + "cvss": [], + "fix": { + "versions": [], + "state": "wont-fix" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2020-16156", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2020-16156", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html", + "https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/", + "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/", + "https://metacpan.org/pod/distribution/CPAN/scripts/cpan" + ], + "description": "CPAN 2.28 allows Signature Verification Bypass.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", + "metrics": { + "baseScore": 6.8, + "exploitabilityScore": 8.6, + "impactScore": 6.4 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 7.8, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "perl", + "version": "5.32.1-4+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2020-16156" + } + } + ], + "artifact": { + "id": "70fee5abfefd1735", + "name": "perl-base", + "version": "5.32.1-4+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/perl-base/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/perl-base.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Artistic", + "Artistic-2", + "Artistic-dist", + "BSD-3-clause", + "BSD-3-clause-GENERIC", + "BSD-3-clause-with-weird-numbering", + "BSD-4-clause-POWERDOG", + "BZIP", + "DONT-CHANGE-THE-GPL", + "Expat", + "GPL-1", + "GPL-1+", + "GPL-2", + "GPL-2+", + "GPL-3+-WITH-BISON-EXCEPTION", + "HSIEH-BSD", + "HSIEH-DERIVATIVE", + "LGPL-2.1", + "REGCOMP", + "REGCOMP,", + "RRA-KEEP-THIS-NOTICE", + "SDBM-PUBLIC-DOMAIN", + "TEXT-TABS", + "Unicode", + "ZLIB" + ], + "cpes": [ + "cpe:2.3:a:perl-base:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl-base:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl_base:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl_base:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/perl-base@5.32.1-4+deb11u2?arch=amd64&upstream=perl&distro=debian-11", + "upstreams": [ + { + "name": "perl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2023-31486", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2023-31486", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2023-31486" + ], + "description": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2023-31486", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-31486", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://www.openwall.com/lists/oss-security/2023/04/29/1", + "http://www.openwall.com/lists/oss-security/2023/05/03/3", + "http://www.openwall.com/lists/oss-security/2023/05/03/5", + "http://www.openwall.com/lists/oss-security/2023/05/07/2", + "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/", + "https://github.com/chansen/p5-http-tiny/pull/153", + "https://hackeriet.github.io/cpan-http-tiny-overview/", + "https://www.openwall.com/lists/oss-security/2023/04/18/14", + "https://www.openwall.com/lists/oss-security/2023/05/03/4", + "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/" + ], + "description": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", + "metrics": { + "baseScore": 8.1, + "exploitabilityScore": 2.2, + "impactScore": 5.9 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "perl", + "version": "5.32.1-4+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2023-31486" + } + } + ], + "artifact": { + "id": "70fee5abfefd1735", + "name": "perl-base", + "version": "5.32.1-4+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/perl-base/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/perl-base.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Artistic", + "Artistic-2", + "Artistic-dist", + "BSD-3-clause", + "BSD-3-clause-GENERIC", + "BSD-3-clause-with-weird-numbering", + "BSD-4-clause-POWERDOG", + "BZIP", + "DONT-CHANGE-THE-GPL", + "Expat", + "GPL-1", + "GPL-1+", + "GPL-2", + "GPL-2+", + "GPL-3+-WITH-BISON-EXCEPTION", + "HSIEH-BSD", + "HSIEH-DERIVATIVE", + "LGPL-2.1", + "REGCOMP", + "REGCOMP,", + "RRA-KEEP-THIS-NOTICE", + "SDBM-PUBLIC-DOMAIN", + "TEXT-TABS", + "Unicode", + "ZLIB" + ], + "cpes": [ + "cpe:2.3:a:perl-base:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl-base:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl_base:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl_base:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/perl-base@5.32.1-4+deb11u2?arch=amd64&upstream=perl&distro=debian-11", + "upstreams": [ + { + "name": "perl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2011-4116", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2011-4116", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2011-4116" + ], + "description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2011-4116", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2011-4116", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://www.openwall.com/lists/oss-security/2011/11/04/2", + "http://www.openwall.com/lists/oss-security/2011/11/04/4", + "https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14", + "https://rt.cpan.org/Public/Bug/Display.html?id=69106", + "https://seclists.org/oss-sec/2011/q4/238" + ], + "description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", + "metrics": { + "baseScore": 5, + "exploitabilityScore": 10, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", + "metrics": { + "baseScore": 7.5, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-indirect-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "perl", + "version": "5.32.1-4+deb11u2" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2011-4116" + } + } + ], + "artifact": { + "id": "70fee5abfefd1735", + "name": "perl-base", + "version": "5.32.1-4+deb11u2", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/perl-base/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/perl-base.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "Artistic", + "Artistic-2", + "Artistic-dist", + "BSD-3-clause", + "BSD-3-clause-GENERIC", + "BSD-3-clause-with-weird-numbering", + "BSD-4-clause-POWERDOG", + "BZIP", + "DONT-CHANGE-THE-GPL", + "Expat", + "GPL-1", + "GPL-1+", + "GPL-2", + "GPL-2+", + "GPL-3+-WITH-BISON-EXCEPTION", + "HSIEH-BSD", + "HSIEH-DERIVATIVE", + "LGPL-2.1", + "REGCOMP", + "REGCOMP,", + "RRA-KEEP-THIS-NOTICE", + "SDBM-PUBLIC-DOMAIN", + "TEXT-TABS", + "Unicode", + "ZLIB" + ], + "cpes": [ + "cpe:2.3:a:perl-base:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl-base:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl_base:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl_base:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl:perl-base:5.32.1-4+deb11u2:*:*:*:*:*:*:*", + "cpe:2.3:a:perl:perl_base:5.32.1-4+deb11u2:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/perl-base@5.32.1-4+deb11u2?arch=amd64&upstream=perl&distro=debian-11", + "upstreams": [ + { + "name": "perl" + } + ] + } + }, + { + "vulnerability": { + "id": "CVE-2022-48303", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-48303", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-48303" + ], + "description": "GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-48303", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-48303", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/", + "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/", + "https://savannah.gnu.org/bugs/?62387", + "https://savannah.gnu.org/patch/?10307" + ], + "description": "GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tar", + "version": "1.34+dfsg-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-48303" + } + } + ], + "artifact": { + "id": "6cd0f2a416ae6604", + "name": "tar", + "version": "1.34+dfsg-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/tar/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/tar.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2", + "GPL-3" + ], + "cpes": [ + "cpe:2.3:a:tar:tar:1.34+dfsg-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/tar@1.34+dfsg-1?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2005-2541", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2005-2541", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2005-2541" + ], + "description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2005-2541", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2005-2541", + "namespace": "nvd:cpe", + "severity": "High", + "urls": [ + "http://marc.info/?l=bugtraq&m=112327628230258&w=2", + "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E" + ], + "description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C", + "metrics": { + "baseScore": 10, + "exploitabilityScore": 10, + "impactScore": 10 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "tar", + "version": "1.34+dfsg-1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2005-2541" + } + } + ], + "artifact": { + "id": "6cd0f2a416ae6604", + "name": "tar", + "version": "1.34+dfsg-1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/tar/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/tar.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "GPL-2", + "GPL-3" + ], + "cpes": [ + "cpe:2.3:a:tar:tar:1.34+dfsg-1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/tar@1.34+dfsg-1?arch=amd64&distro=debian-11", + "upstreams": [] + } + }, + { + "vulnerability": { + "id": "CVE-2022-0563", + "dataSource": "https://security-tracker.debian.org/tracker/CVE-2022-0563", + "namespace": "debian:distro:debian:11", + "severity": "Negligible", + "urls": [ + "https://security-tracker.debian.org/tracker/CVE-2022-0563" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [], + "fix": { + "versions": [], + "state": "not-fixed" + }, + "advisories": [] + }, + "relatedVulnerabilities": [ + { + "id": "CVE-2022-0563", + "dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", + "namespace": "nvd:cpe", + "severity": "Medium", + "urls": [ + "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", + "https://security.netapp.com/advisory/ntap-20220331-0002/" + ], + "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", + "cvss": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "2.0", + "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", + "metrics": { + "baseScore": 1.9, + "exploitabilityScore": 3.4, + "impactScore": 2.9 + }, + "vendorMetadata": {} + }, + { + "source": "nvd@nist.gov", + "type": "Primary", + "version": "3.1", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "metrics": { + "baseScore": 5.5, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + }, + "vendorMetadata": {} + } + ] + } + ], + "matchDetails": [ + { + "type": "exact-direct-match", + "matcher": "dpkg-matcher", + "searchedBy": { + "distro": { + "type": "debian", + "version": "11" + }, + "namespace": "debian:distro:debian:11", + "package": { + "name": "util-linux", + "version": "2.36.1-8+deb11u1" + } + }, + "found": { + "versionConstraint": "none (deb)", + "vulnerabilityID": "CVE-2022-0563" + } + } + ], + "artifact": { + "id": "7a1db5d0da40785c", + "name": "util-linux", + "version": "2.36.1-8+deb11u1", + "type": "deb", + "locations": [ + { + "path": "/usr/share/doc/util-linux/copyright", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/util-linux.conffiles", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/info/util-linux.md5sums", + "layerID": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3" + }, + { + "path": "/var/lib/dpkg/status", + "layerID": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb" + } + ], + "language": "", + "licenses": [ + "BSD-2-clause", + "BSD-3-clause", + "BSD-4-clause", + "GPL-2", + "GPL-2+", + "GPL-3", + "GPL-3+", + "LGPL", + "LGPL-2", + "LGPL-2+", + "LGPL-2.1", + "LGPL-2.1+", + "LGPL-3", + "LGPL-3+", + "MIT", + "public-domain" + ], + "cpes": [ + "cpe:2.3:a:util-linux:util-linux:2.36.1-8+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:util-linux:util_linux:2.36.1-8+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:util_linux:util-linux:2.36.1-8+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:util_linux:util_linux:2.36.1-8+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:util:util-linux:2.36.1-8+deb11u1:*:*:*:*:*:*:*", + "cpe:2.3:a:util:util_linux:2.36.1-8+deb11u1:*:*:*:*:*:*:*" + ], + "purl": "pkg:deb/debian/util-linux@2.36.1-8+deb11u1?arch=amd64&distro=debian-11", + "upstreams": [] + } + } + ], + "source": { + "type": "image", + "target": { + "userInput": "docker.io/library/nginx:latest", + "imageID": "sha256:f9c14fe76d502861ba0939bc3189e642c02e257f06f4c0214b1f8ca329326cda", + "manifestDigest": "sha256:90e3eef0a52039273b4abc0a2debfafdd691db292b5ade57934a12c238a0400f", + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "tags": [ + "nginx:latest" + ], + "imageSize": 142536216, + "layers": [ + { + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "digest": "sha256:8cbe4b54fa88d8fc0198ea0cc3a5432aea41573e6a0ee26eca8c79f9fbfa40e3", + "size": 80516736 + }, + { + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "digest": "sha256:4b8862fe7056d8a3c2c0910eb38ebb8fc08785eaa1f9f53b2043bf7ca8adbafb", + "size": 62008112 + }, + { + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "digest": "sha256:e60266289ce4a890aaf52b93228090998e28220aef04f128704141864992dd15", + "size": 1616 + }, + { + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "digest": "sha256:7daac92f43be84ad9675f94875c1a00357b975d6c58b11d17104e0a0e04da370", + "size": 2123 + }, + { + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "digest": "sha256:5e099cf3f3c83c449b8c062f944ac025c9bf2dd7ec255837c53430021f5a1517", + "size": 3008 + }, + { + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "digest": "sha256:4fd83434130318dede62defafcc5853d03dae8636eccfa1b9dcd385d92e3ff19", + "size": 4621 + } + ], + "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo3OTE2LCJkaWdlc3QiOiJzaGEyNTY6ZjljMTRmZTc2ZDUwMjg2MWJhMDkzOWJjMzE4OWU2NDJjMDJlMjU3ZjA2ZjRjMDIxNGIxZjhjYTMyOTMyNmNkYSJ9LCJsYXllcnMiOlt7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjo4NDAxMTAwOCwiZGlnZXN0Ijoic2hhMjU2OjhjYmU0YjU0ZmE4OGQ4ZmMwMTk4ZWEwY2MzYTU0MzJhZWE0MTU3M2U2YTBlZTI2ZWNhOGM3OWY5ZmJmYTQwZTMifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjo2MjkyMjc1MiwiZGlnZXN0Ijoic2hhMjU2OjRiODg2MmZlNzA1NmQ4YTNjMmMwOTEwZWIzOGViYjhmYzA4Nzg1ZWFhMWY5ZjUzYjIwNDNiZjdjYThhZGJhZmIifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjozNTg0LCJkaWdlc3QiOiJzaGEyNTY6ZTYwMjY2Mjg5Y2U0YTg5MGFhZjUyYjkzMjI4MDkwOTk4ZTI4MjIwYWVmMDRmMTI4NzA0MTQxODY0OTkyZGQxNSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjQ2MDgsImRpZ2VzdCI6InNoYTI1Njo3ZGFhYzkyZjQzYmU4NGFkOTY3NWY5NDg3NWMxYTAwMzU3Yjk3NWQ2YzU4YjExZDE3MTA0ZTBhMGUwNGRhMzcwIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6NTEyMCwiZGlnZXN0Ijoic2hhMjU2OjVlMDk5Y2YzZjNjODNjNDQ5YjhjMDYyZjk0NGFjMDI1YzliZjJkZDdlYzI1NTgzN2M1MzQzMDAyMWY1YTE1MTcifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjo3MTY4LCJkaWdlc3QiOiJzaGEyNTY6NGZkODM0MzQxMzAzMThkZWRlNjJkZWZhZmNjNTg1M2QwM2RhZTg2MzZlY2NmYTFiOWRjZDM4NWQ5MmUzZmYxOSJ9XX0=", + "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJIb3N0bmFtZSI6IiIsIkRvbWFpbm5hbWUiOiIiLCJVc2VyIjoiIiwiQXR0YWNoU3RkaW4iOmZhbHNlLCJBdHRhY2hTdGRvdXQiOmZhbHNlLCJBdHRhY2hTdGRlcnIiOmZhbHNlLCJFeHBvc2VkUG9ydHMiOnsiODAvdGNwIjp7fX0sIlR0eSI6ZmFsc2UsIk9wZW5TdGRpbiI6ZmFsc2UsIlN0ZGluT25jZSI6ZmFsc2UsIkVudiI6WyJQQVRIPS91c3IvbG9jYWwvc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL3NiaW46L3Vzci9iaW46L3NiaW46L2JpbiIsIk5HSU5YX1ZFUlNJT049MS4yNS4wIiwiTkpTX1ZFUlNJT049MC43LjEyIiwiUEtHX1JFTEVBU0U9MX5idWxsc2V5ZSJdLCJDbWQiOlsibmdpbngiLCItZyIsImRhZW1vbiBvZmY7Il0sIkltYWdlIjoic2hhMjU2OmExNGE1ODAzY2JmMDk1YTAyNjg2NjNmZTMyMzU2ODFjMmY3ZmQ1ZDBiNTljMjQyZDk5ZTdiMWViYjU5Mjg0ZjMiLCJWb2x1bWVzIjpudWxsLCJXb3JraW5nRGlyIjoiIiwiRW50cnlwb2ludCI6WyIvZG9ja2VyLWVudHJ5cG9pbnQuc2giXSwiT25CdWlsZCI6bnVsbCwiTGFiZWxzIjp7Im1haW50YWluZXIiOiJOR0lOWCBEb2NrZXIgTWFpbnRhaW5lcnMgXHUwMDNjZG9ja2VyLW1haW50QG5naW54LmNvbVx1MDAzZSJ9LCJTdG9wU2lnbmFsIjoiU0lHUVVJVCJ9LCJjb250YWluZXIiOiIyM2IwZmNlMmY0MGJlODNkYWExMjllYWNiZjc5YjhhNTdjNjUyNGE3ODk4YmYzYWJhMDZlMTBjMTViNDMzZDBkIiwiY29udGFpbmVyX2NvbmZpZyI6eyJIb3N0bmFtZSI6IjIzYjBmY2UyZjQwYiIsIkRvbWFpbm5hbWUiOiIiLCJVc2VyIjoiIiwiQXR0YWNoU3RkaW4iOmZhbHNlLCJBdHRhY2hTdGRvdXQiOmZhbHNlLCJBdHRhY2hTdGRlcnIiOmZhbHNlLCJFeHBvc2VkUG9ydHMiOnsiODAvdGNwIjp7fX0sIlR0eSI6ZmFsc2UsIk9wZW5TdGRpbiI6ZmFsc2UsIlN0ZGluT25jZSI6ZmFsc2UsIkVudiI6WyJQQVRIPS91c3IvbG9jYWwvc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL3NiaW46L3Vzci9iaW46L3NiaW46L2JpbiIsIk5HSU5YX1ZFUlNJT049MS4yNS4wIiwiTkpTX1ZFUlNJT049MC43LjEyIiwiUEtHX1JFTEVBU0U9MX5idWxsc2V5ZSJdLCJDbWQiOlsiL2Jpbi9zaCIsIi1jIiwiIyhub3ApICIsIkNNRCBbXCJuZ2lueFwiIFwiLWdcIiBcImRhZW1vbiBvZmY7XCJdIl0sIkltYWdlIjoic2hhMjU2OmExNGE1ODAzY2JmMDk1YTAyNjg2NjNmZTMyMzU2ODFjMmY3ZmQ1ZDBiNTljMjQyZDk5ZTdiMWViYjU5Mjg0ZjMiLCJWb2x1bWVzIjpudWxsLCJXb3JraW5nRGlyIjoiIiwiRW50cnlwb2ludCI6WyIvZG9ja2VyLWVudHJ5cG9pbnQuc2giXSwiT25CdWlsZCI6bnVsbCwiTGFiZWxzIjp7Im1haW50YWluZXIiOiJOR0lOWCBEb2NrZXIgTWFpbnRhaW5lcnMgXHUwMDNjZG9ja2VyLW1haW50QG5naW54LmNvbVx1MDAzZSJ9LCJTdG9wU2lnbmFsIjoiU0lHUVVJVCJ9LCJjcmVhdGVkIjoiMjAyMy0wNS0yNFQyMjo0Mzo0OC4xODIwNzU4N1oiLCJkb2NrZXJfdmVyc2lvbiI6IjIwLjEwLjIzIiwiaGlzdG9yeSI6W3siY3JlYXRlZCI6IjIwMjMtMDUtMjNUMDE6MjA6MTQuMDU2NjE3NTc1WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBBREQgZmlsZTo4ODI1MmE3ZjExOGI0ZDZmNTVkZDViYWY0OWRiY2FhMDUzYzlkNjE3MmM2NTI5NjNjMTE1MWZhNzZmNjI1ZTQ0IGluIC8gIn0seyJjcmVhdGVkIjoiMjAyMy0wNS0yM1QwMToyMDoxNC4zOTcyNjMzNTFaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApICBDTUQgW1wiYmFzaFwiXSIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDIzLTA1LTIzVDA4OjUxOjIwLjUzNTg0NDIwMVoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgIExBQkVMIG1haW50YWluZXI9TkdJTlggRG9ja2VyIE1haW50YWluZXJzIFx1MDAzY2RvY2tlci1tYWludEBuZ2lueC5jb21cdTAwM2UiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyMy0wNS0yNFQyMjo0MzoyNy4wNjYwMzE4MzZaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApICBFTlYgTkdJTlhfVkVSU0lPTj0xLjI1LjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyMy0wNS0yNFQyMjo0MzoyNy4xNDUyNDU4OTVaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApICBFTlYgTkpTX1ZFUlNJT049MC43LjEyIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjMtMDUtMjRUMjI6NDM6MjcuMjIzNzQ2MDkyWiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSAgRU5WIFBLR19SRUxFQVNFPTF+YnVsbHNleWUiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyMy0wNS0yNFQyMjo0Mzo0Ny4zODUyMjYwOTZaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgc2V0IC14ICAgICBcdTAwMjZcdTAwMjYgYWRkZ3JvdXAgLS1zeXN0ZW0gLS1naWQgMTAxIG5naW54ICAgICBcdTAwMjZcdTAwMjYgYWRkdXNlciAtLXN5c3RlbSAtLWRpc2FibGVkLWxvZ2luIC0taW5ncm91cCBuZ2lueCAtLW5vLWNyZWF0ZS1ob21lIC0taG9tZSAvbm9uZXhpc3RlbnQgLS1nZWNvcyBcIm5naW54IHVzZXJcIiAtLXNoZWxsIC9iaW4vZmFsc2UgLS11aWQgMTAxIG5naW54ICAgICBcdTAwMjZcdTAwMjYgYXB0LWdldCB1cGRhdGUgICAgIFx1MDAyNlx1MDAyNiBhcHQtZ2V0IGluc3RhbGwgLS1uby1pbnN0YWxsLXJlY29tbWVuZHMgLS1uby1pbnN0YWxsLXN1Z2dlc3RzIC15IGdudXBnMSBjYS1jZXJ0aWZpY2F0ZXMgICAgIFx1MDAyNlx1MDAyNiAgICAgTkdJTlhfR1BHS0VZPTU3M0JGRDZCM0Q4RkJDNjQxMDc5QTZBQkFCRjVCRDgyN0JEOUJGNjI7ICAgICBOR0lOWF9HUEdLRVlfUEFUSD0vdXNyL3NoYXJlL2tleXJpbmdzL25naW54LWFyY2hpdmUta2V5cmluZy5ncGc7ICAgICBleHBvcnQgR05VUEdIT01FPVwiJChta3RlbXAgLWQpXCI7ICAgICBmb3VuZD0nJzsgICAgIGZvciBzZXJ2ZXIgaW4gICAgICAgICBoa3A6Ly9rZXlzZXJ2ZXIudWJ1bnR1LmNvbTo4MCAgICAgICAgIHBncC5taXQuZWR1ICAgICA7IGRvICAgICAgICAgZWNobyBcIkZldGNoaW5nIEdQRyBrZXkgJE5HSU5YX0dQR0tFWSBmcm9tICRzZXJ2ZXJcIjsgICAgICAgICBncGcxIC0ta2V5c2VydmVyIFwiJHNlcnZlclwiIC0ta2V5c2VydmVyLW9wdGlvbnMgdGltZW91dD0xMCAtLXJlY3Yta2V5cyBcIiROR0lOWF9HUEdLRVlcIiBcdTAwMjZcdTAwMjYgZm91bmQ9eWVzIFx1MDAyNlx1MDAyNiBicmVhazsgICAgIGRvbmU7ICAgICB0ZXN0IC16IFwiJGZvdW5kXCIgXHUwMDI2XHUwMDI2IGVjaG8gXHUwMDNlXHUwMDI2MiBcImVycm9yOiBmYWlsZWQgdG8gZmV0Y2ggR1BHIGtleSAkTkdJTlhfR1BHS0VZXCIgXHUwMDI2XHUwMDI2IGV4aXQgMTsgICAgIGdwZzEgLS1leHBvcnQgXCIkTkdJTlhfR1BHS0VZXCIgXHUwMDNlIFwiJE5HSU5YX0dQR0tFWV9QQVRIXCIgOyAgICAgcm0gLXJmIFwiJEdOVVBHSE9NRVwiOyAgICAgYXB0LWdldCByZW1vdmUgLS1wdXJnZSAtLWF1dG8tcmVtb3ZlIC15IGdudXBnMSBcdTAwMjZcdTAwMjYgcm0gLXJmIC92YXIvbGliL2FwdC9saXN0cy8qICAgICBcdTAwMjZcdTAwMjYgZHBrZ0FyY2g9XCIkKGRwa2cgLS1wcmludC1hcmNoaXRlY3R1cmUpXCIgICAgIFx1MDAyNlx1MDAyNiBuZ2lueFBhY2thZ2VzPVwiICAgICAgICAgbmdpbng9JHtOR0lOWF9WRVJTSU9OfS0ke1BLR19SRUxFQVNFfSAgICAgICAgIG5naW54LW1vZHVsZS14c2x0PSR7TkdJTlhfVkVSU0lPTn0tJHtQS0dfUkVMRUFTRX0gICAgICAgICBuZ2lueC1tb2R1bGUtZ2VvaXA9JHtOR0lOWF9WRVJTSU9OfS0ke1BLR19SRUxFQVNFfSAgICAgICAgIG5naW54LW1vZHVsZS1pbWFnZS1maWx0ZXI9JHtOR0lOWF9WRVJTSU9OfS0ke1BLR19SRUxFQVNFfSAgICAgICAgIG5naW54LW1vZHVsZS1uanM9JHtOR0lOWF9WRVJTSU9OfSske05KU19WRVJTSU9OfS0ke1BLR19SRUxFQVNFfSAgICAgXCIgICAgIFx1MDAyNlx1MDAyNiBjYXNlIFwiJGRwa2dBcmNoXCIgaW4gICAgICAgICBhbWQ2NHxhcm02NCkgICAgICAgICAgICAgZWNobyBcImRlYiBbc2lnbmVkLWJ5PSROR0lOWF9HUEdLRVlfUEFUSF0gaHR0cHM6Ly9uZ2lueC5vcmcvcGFja2FnZXMvbWFpbmxpbmUvZGViaWFuLyBidWxsc2V5ZSBuZ2lueFwiIFx1MDAzZVx1MDAzZSAvZXRjL2FwdC9zb3VyY2VzLmxpc3QuZC9uZ2lueC5saXN0ICAgICAgICAgICAgIFx1MDAyNlx1MDAyNiBhcHQtZ2V0IHVwZGF0ZSAgICAgICAgICAgICA7OyAgICAgICAgICopICAgICAgICAgICAgIGVjaG8gXCJkZWItc3JjIFtzaWduZWQtYnk9JE5HSU5YX0dQR0tFWV9QQVRIXSBodHRwczovL25naW54Lm9yZy9wYWNrYWdlcy9tYWlubGluZS9kZWJpYW4vIGJ1bGxzZXllIG5naW54XCIgXHUwMDNlXHUwMDNlIC9ldGMvYXB0L3NvdXJjZXMubGlzdC5kL25naW54Lmxpc3QgICAgICAgICAgICAgICAgICAgICAgICAgXHUwMDI2XHUwMDI2IHRlbXBEaXI9XCIkKG1rdGVtcCAtZClcIiAgICAgICAgICAgICBcdTAwMjZcdTAwMjYgY2htb2QgNzc3IFwiJHRlbXBEaXJcIiAgICAgICAgICAgICAgICAgICAgICAgICBcdTAwMjZcdTAwMjYgc2F2ZWRBcHRNYXJrPVwiJChhcHQtbWFyayBzaG93bWFudWFsKVwiICAgICAgICAgICAgICAgICAgICAgICAgIFx1MDAyNlx1MDAyNiBhcHQtZ2V0IHVwZGF0ZSAgICAgICAgICAgICBcdTAwMjZcdTAwMjYgYXB0LWdldCBidWlsZC1kZXAgLXkgJG5naW54UGFja2FnZXMgICAgICAgICAgICAgXHUwMDI2XHUwMDI2ICggICAgICAgICAgICAgICAgIGNkIFwiJHRlbXBEaXJcIiAgICAgICAgICAgICAgICAgXHUwMDI2XHUwMDI2IERFQl9CVUlMRF9PUFRJT05TPVwibm9jaGVjayBwYXJhbGxlbD0kKG5wcm9jKVwiICAgICAgICAgICAgICAgICAgICAgYXB0LWdldCBzb3VyY2UgLS1jb21waWxlICRuZ2lueFBhY2thZ2VzICAgICAgICAgICAgICkgICAgICAgICAgICAgICAgICAgICAgICAgXHUwMDI2XHUwMDI2IGFwdC1tYXJrIHNob3dtYW51YWwgfCB4YXJncyBhcHQtbWFyayBhdXRvIFx1MDAzZSAvZGV2L251bGwgICAgICAgICAgICAgXHUwMDI2XHUwMDI2IHsgWyAteiBcIiRzYXZlZEFwdE1hcmtcIiBdIHx8IGFwdC1tYXJrIG1hbnVhbCAkc2F2ZWRBcHRNYXJrOyB9ICAgICAgICAgICAgICAgICAgICAgICAgIFx1MDAyNlx1MDAyNiBscyAtbEFGaCBcIiR0ZW1wRGlyXCIgICAgICAgICAgICAgXHUwMDI2XHUwMDI2ICggY2QgXCIkdGVtcERpclwiIFx1MDAyNlx1MDAyNiBkcGtnLXNjYW5wYWNrYWdlcyAuIFx1MDAzZSBQYWNrYWdlcyApICAgICAgICAgICAgIFx1MDAyNlx1MDAyNiBncmVwICdeUGFja2FnZTogJyBcIiR0ZW1wRGlyL1BhY2thZ2VzXCIgICAgICAgICAgICAgXHUwMDI2XHUwMDI2IGVjaG8gXCJkZWIgWyB0cnVzdGVkPXllcyBdIGZpbGU6Ly8kdGVtcERpciAuL1wiIFx1MDAzZSAvZXRjL2FwdC9zb3VyY2VzLmxpc3QuZC90ZW1wLmxpc3QgICAgICAgICAgICAgXHUwMDI2XHUwMDI2IGFwdC1nZXQgLW8gQWNxdWlyZTo6R3ppcEluZGV4ZXM9ZmFsc2UgdXBkYXRlICAgICAgICAgICAgIDs7ICAgICBlc2FjICAgICAgICAgXHUwMDI2XHUwMDI2IGFwdC1nZXQgaW5zdGFsbCAtLW5vLWluc3RhbGwtcmVjb21tZW5kcyAtLW5vLWluc3RhbGwtc3VnZ2VzdHMgLXkgICAgICAgICAgICAgICAgICAgICAgICAgJG5naW54UGFja2FnZXMgICAgICAgICAgICAgICAgICAgICAgICAgZ2V0dGV4dC1iYXNlICAgICAgICAgICAgICAgICAgICAgICAgIGN1cmwgICAgIFx1MDAyNlx1MDAyNiBhcHQtZ2V0IHJlbW92ZSAtLXB1cmdlIC0tYXV0by1yZW1vdmUgLXkgXHUwMDI2XHUwMDI2IHJtIC1yZiAvdmFyL2xpYi9hcHQvbGlzdHMvKiAvZXRjL2FwdC9zb3VyY2VzLmxpc3QuZC9uZ2lueC5saXN0ICAgICAgICAgXHUwMDI2XHUwMDI2IGlmIFsgLW4gXCIkdGVtcERpclwiIF07IHRoZW4gICAgICAgICBhcHQtZ2V0IHB1cmdlIC15IC0tYXV0by1yZW1vdmUgICAgICAgICBcdTAwMjZcdTAwMjYgcm0gLXJmIFwiJHRlbXBEaXJcIiAvZXRjL2FwdC9zb3VyY2VzLmxpc3QuZC90ZW1wLmxpc3Q7ICAgICBmaSAgICAgXHUwMDI2XHUwMDI2IGxuIC1zZiAvZGV2L3N0ZG91dCAvdmFyL2xvZy9uZ2lueC9hY2Nlc3MubG9nICAgICBcdTAwMjZcdTAwMjYgbG4gLXNmIC9kZXYvc3RkZXJyIC92YXIvbG9nL25naW54L2Vycm9yLmxvZyAgICAgXHUwMDI2XHUwMDI2IG1rZGlyIC9kb2NrZXItZW50cnlwb2ludC5kIn0seyJjcmVhdGVkIjoiMjAyMy0wNS0yNFQyMjo0Mzo0Ny42MTAyNTA5MDlaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApIENPUFkgZmlsZTo3YjMwN2I2MmU4MjI1NWYwNDBjOTgxMjQyMWEzMDA5MGJmOWFiZjM2ODVmMjdiMDJkNzdmY2NhOTlmOTk3OTExIGluIC8gIn0seyJjcmVhdGVkIjoiMjAyMy0wNS0yNFQyMjo0Mzo0Ny42OTQ5MjUwOTdaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApIENPUFkgZmlsZTo1YzE4MjcyNzM0MzQ5NDg4YmQwYzk0ZWM4ZDM4MmM4NzJjMWEwYTQzNWNjYTEzYmQ0NjcxMzUzZDYwMjFkMmNiIGluIC9kb2NrZXItZW50cnlwb2ludC5kICJ9LHsiY3JlYXRlZCI6IjIwMjMtMDUtMjRUMjI6NDM6NDcuNzgxODczNTEzWiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBDT1BZIGZpbGU6MzY0MjljZmVlYjI5OWY5OTEzYjg0ZWExMzZiMDA0YmUxMmZiZTRiYjRmOTc1YTk3N2EzNjA4MDQ0ZThiZmE5MSBpbiAvZG9ja2VyLWVudHJ5cG9pbnQuZCAifSx7ImNyZWF0ZWQiOiIyMDIzLTA1LTI0VDIyOjQzOjQ3Ljg2Nzc3MjI2NFoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgQ09QWSBmaWxlOmU1N2VlZjAxN2E0MTRjYTc5MzQ5OTcyOWQ4MGE3YjkwNzU3OTBjOWE4MDRmOTMwZjE0MTdlNTZkNTA2OTcwY2YgaW4gL2RvY2tlci1lbnRyeXBvaW50LmQgIn0seyJjcmVhdGVkIjoiMjAyMy0wNS0yNFQyMjo0Mzo0Ny45NDM3NTM2OTdaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApICBFTlRSWVBPSU5UIFtcIi9kb2NrZXItZW50cnlwb2ludC5zaFwiXSIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDIzLTA1LTI0VDIyOjQzOjQ4LjAyNDk2OTk2NVoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgIEVYUE9TRSA4MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDIzLTA1LTI0VDIyOjQzOjQ4LjEwNDAyNDU3WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSAgU1RPUFNJR05BTCBTSUdRVUlUIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjMtMDUtMjRUMjI6NDM6NDguMTgyMDc1ODdaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApICBDTUQgW1wibmdpbnhcIiBcIi1nXCIgXCJkYWVtb24gb2ZmO1wiXSIsImVtcHR5X2xheWVyIjp0cnVlfV0sIm9zIjoibGludXgiLCJyb290ZnMiOnsidHlwZSI6ImxheWVycyIsImRpZmZfaWRzIjpbInNoYTI1Njo4Y2JlNGI1NGZhODhkOGZjMDE5OGVhMGNjM2E1NDMyYWVhNDE1NzNlNmEwZWUyNmVjYThjNzlmOWZiZmE0MGUzIiwic2hhMjU2OjRiODg2MmZlNzA1NmQ4YTNjMmMwOTEwZWIzOGViYjhmYzA4Nzg1ZWFhMWY5ZjUzYjIwNDNiZjdjYThhZGJhZmIiLCJzaGEyNTY6ZTYwMjY2Mjg5Y2U0YTg5MGFhZjUyYjkzMjI4MDkwOTk4ZTI4MjIwYWVmMDRmMTI4NzA0MTQxODY0OTkyZGQxNSIsInNoYTI1Njo3ZGFhYzkyZjQzYmU4NGFkOTY3NWY5NDg3NWMxYTAwMzU3Yjk3NWQ2YzU4YjExZDE3MTA0ZTBhMGUwNGRhMzcwIiwic2hhMjU2OjVlMDk5Y2YzZjNjODNjNDQ5YjhjMDYyZjk0NGFjMDI1YzliZjJkZDdlYzI1NTgzN2M1MzQzMDAyMWY1YTE1MTciLCJzaGEyNTY6NGZkODM0MzQxMzAzMThkZWRlNjJkZWZhZmNjNTg1M2QwM2RhZTg2MzZlY2NmYTFiOWRjZDM4NWQ5MmUzZmYxOSJdfX0=", + "repoDigests": [ + "nginx@sha256:af296b188c7b7df99ba960ca614439c99cb7cf252ed7bbc23e90cfda59092305" + ], + "architecture": "amd64", + "os": "linux" + } + }, + "distro": { + "name": "debian", + "version": "11", + "idLike": [] + }, + "descriptor": { + "name": "grype", + "version": "[not provided]", + "db": { + "built": "2023-09-01T01:26:55Z", + "schemaVersion": 5, + "location": "/home/anubhav/.cache/grypedb/5", + "checksum": "sha256:5db8bddae95f375db7186527c7554311e9ddc41e815ef2dbc28dc5d206ef2c7b", + "error": null + }, + "timestamp": "2023-09-01T10:16:39.235963893+05:30" + } +}