Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(redhat): support build info in RHEL #807

Merged
merged 16 commits into from
Jan 28, 2022
Merged

feat(redhat): support build info in RHEL #807

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
9a1404d
fix(redhat): add EOL of CentOS 8
knqyf263 Jan 14, 2021
279dde8
feat(redhat): support build info in RHEL
knqyf263 Jan 14, 2021
bd3f2da
chore(mod): update fanal and trivy-db
knqyf263 Jan 14, 2021
7707c50
feat(redhat): add vendor IDs
knqyf263 Jan 19, 2021
5084f68
test(redhat): use boltfixtures
knqyf263 Jan 19, 2021
10b0d05
chore(mod): update trivy-db
knqyf263 Jan 19, 2021
14162fd
refactor(dbtest): add a comment
knqyf263 Jan 19, 2021
433af17
refactor(dbtest): sort imports
knqyf263 Jan 19, 2021
8888e36
Merge branch 'main' into feat/redhat_oval2
knqyf263 Dec 29, 2021
52e5675
feat(redhat): support nvr
knqyf263 Dec 29, 2021
1f3894c
Merge branch 'main' into feat/redhat_oval2
knqyf263 Dec 30, 2021
ee4745d
test(integration): add redhat cases
knqyf263 Dec 30, 2021
f4dbf35
Merge branch 'main' into feat/redhat_oval2
knqyf263 Jan 28, 2022
a9f6d6d
chore(mod): tidy
knqyf263 Jan 28, 2022
55b785c
test(integration): add a reference
knqyf263 Jan 28, 2022
d420141
test(integration): fix golden files
knqyf263 Jan 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
feat(redhat): support build info in RHEL
  • Loading branch information
@knqyf263
knqyf263 committed Jan 14, 2021
commit 279dde87ba91238c5cb63483c501c14e4b3ad2c3
82 changes: 51 additions & 31 deletions pkg/detector/ospkg/redhat/redhat.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ import (

"github.com/aquasecurity/fanal/analyzer/os"
ftypes "github.com/aquasecurity/fanal/types"
dbTypes "github.com/aquasecurity/trivy-db/pkg/types"
"github.com/aquasecurity/trivy-db/pkg/vulnsrc/redhat"
oval "github.com/aquasecurity/trivy-db/pkg/vulnsrc/redhat-oval"
"github.com/aquasecurity/trivy/pkg/log"
"github.com/aquasecurity/trivy/pkg/scanner/utils"
"github.com/aquasecurity/trivy/pkg/types"
Expand Down Expand Up @@ -40,13 +40,15 @@ var (

// Scanner implements the Redhat scanner
type Scanner struct {
vs dbTypes.VulnSrc
api redhat.VulnSrc
oval oval.VulnSrc
}

// NewScanner is the factory method for Scanner
func NewScanner() *Scanner {
return &Scanner{
vs: redhat.NewVulnSrc(),
api: redhat.NewVulnSrc(),
oval: oval.NewVulnSrc(),
}
}

Expand All @@ -66,50 +68,68 @@ func (s *Scanner) Detect(osVer string, pkgs []ftypes.Package) ([]types.DetectedV
continue
}

// For Red Hat Security Data API containing only source package names
pkgName := addModularNamespace(pkg.SrcName, pkg.Modularitylabel)
advisories, err := s.vs.Get(osVer, pkgName)
detectedVulns, err := s.detectFixedVulnerabilities(osVer, pkg)
if err != nil {
return nil, xerrors.Errorf("failed to get Red Hat advisories: %w", err)
return nil, err
}
vulns = append(vulns, detectedVulns...)

installed := utils.FormatVersion(pkg)
installedVersion := version.NewVersion(installed)
detectedVulns, err = s.detectUnfixedVulnerabilities(osVer, pkg)
if err != nil {
return nil, err
}
vulns = append(vulns, detectedVulns...)
}
return vulns, nil
}

for _, adv := range advisories {
if adv.FixedVersion != "" {
continue
}
func (s *Scanner) detectFixedVulnerabilities(osVer string, pkg ftypes.Package) ([]types.DetectedVulnerability, error) {
// For Red Hat OVAL v2 containing only binary package names
pkgName := addModularNamespace(pkg.Name, pkg.Modularitylabel)
advisories, err := s.oval.Get(osVer, pkgName, pkg.ContentSets)
if err != nil {
return nil, xerrors.Errorf("failed to get Red Hat advisories: %w", err)
}

installed := utils.FormatVersion(pkg)
installedVersion := version.NewVersion(installed)

var vulns []types.DetectedVulnerability
for _, adv := range advisories {
fixedVersion := version.NewVersion(adv.FixedVersion)
if installedVersion.LessThan(fixedVersion) {
vuln := types.DetectedVulnerability{
VulnerabilityID: adv.VulnerabilityID,
PkgName: pkg.Name,
InstalledVersion: installed,
FixedVersion: fixedVersion.String(),
Layer: pkg.Layer,
}
vulns = append(vulns, vuln)
}
}
return vulns, nil
}

// For Red Hat OVAL v2 containing only binary package names
pkgName = addModularNamespace(pkg.Name, pkg.Modularitylabel)
advisories, err = s.vs.Get(osVer, pkgName)
if err != nil {
return nil, xerrors.Errorf("failed to get Red Hat advisories: %w", err)
}
func (s *Scanner) detectUnfixedVulnerabilities(osVer string, pkg ftypes.Package) ([]types.DetectedVulnerability, error) {
// For Red Hat Security Data API containing only source package names
pkgName := addModularNamespace(pkg.SrcName, pkg.Modularitylabel)
advisories, err := s.api.Get(osVer, pkgName)
if err != nil {
return nil, xerrors.Errorf("failed to get Red Hat advisories: %w", err)
}

for _, adv := range advisories {
fixedVersion := version.NewVersion(adv.FixedVersion)
if installedVersion.LessThan(fixedVersion) {
vuln := types.DetectedVulnerability{
VulnerabilityID: adv.VulnerabilityID,
PkgName: pkg.Name,
InstalledVersion: installed,
FixedVersion: fixedVersion.String(),
Layer: pkg.Layer,
}
vulns = append(vulns, vuln)
}
var vulns []types.DetectedVulnerability
for _, adv := range advisories {
vuln := types.DetectedVulnerability{
VulnerabilityID: adv.VulnerabilityID,
PkgName: pkg.Name,
InstalledVersion: utils.FormatVersion(pkg),
Layer: pkg.Layer,
}
vulns = append(vulns, vuln)
}

return vulns, nil
}

Expand Down
1 change: 1 addition & 0 deletions pkg/scanner/local/scan.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import (
"golang.org/x/xerrors"

"github.com/aquasecurity/fanal/analyzer"
_ "github.com/aquasecurity/fanal/analyzer/buildinfo"
_ "github.com/aquasecurity/fanal/analyzer/command/apk"
_ "github.com/aquasecurity/fanal/analyzer/library/bundler"
_ "github.com/aquasecurity/fanal/analyzer/library/cargo"
Expand Down