-
Notifications
You must be signed in to change notification settings - Fork 201
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Refactor, add test and clean up #971
Reference: #971 Signed-off-by: John M. Horan <[email protected]>
- Loading branch information
1 parent
71e52a2
commit 0b74c9f
Showing
4 changed files
with
167 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
34 changes: 34 additions & 0 deletions
34
vulnerabilities/tests/test_data/apache_httpd/CVE-2022-28614-apache-httpd-expected.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| { | ||
| "aliases": [ | ||
| "CVE-2022-28614" | ||
| ], | ||
| "summary": "The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function.\n\nModules compiled and distributed separately from Apache HTTP Server that use the \"ap_rputs\" function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.", | ||
| "affected_packages": [ | ||
| { | ||
| "package": { | ||
| "type": "generic", | ||
| "namespace": null, | ||
| "name": "apache_httpd", | ||
| "version": null, | ||
| "qualifiers": null, | ||
| "subpath": null | ||
| }, | ||
| "affected_version_range": "vers:generic/<=2.4.53|!=2.4.54", | ||
| "fixed_version": null | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "reference_id": "CVE-2022-28614", | ||
| "url": "https://httpd.apache.org/security/json/CVE-2022-28614.json", | ||
| "severities": [ | ||
| { | ||
| "system": "apache_httpd", | ||
| "value": "low", | ||
| "scoring_elements": "" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "date_published": null | ||
| } |
122 changes: 122 additions & 0 deletions
122
vulnerabilities/tests/test_data/apache_httpd/CVE-2022-28614.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,122 @@ | ||
| { | ||
| "data_type": "CVE", | ||
| "data_format": "MITRE", | ||
| "data_version": "4.0", | ||
| "generator": { | ||
| "engine": "Vulnogram 0.0.9" | ||
| }, | ||
| "CVE_data_meta": { | ||
| "ID": "CVE-2022-28614", | ||
| "ASSIGNER": "[email protected]", | ||
| "DATE_PUBLIC": "", | ||
| "TITLE": "read beyond bounds via ap_rwrite() ", | ||
| "AKA": "", | ||
| "STATE": "PUBLIC" | ||
| }, | ||
| "source": { | ||
| "defect": [], | ||
| "advisory": "", | ||
| "discovery": "UNKNOWN" | ||
| }, | ||
| "affects": { | ||
| "vendor": { | ||
| "vendor_data": [ | ||
| { | ||
| "vendor_name": "Apache Software Foundation", | ||
| "product": { | ||
| "product_data": [ | ||
| { | ||
| "product_name": "Apache HTTP Server", | ||
| "version": { | ||
| "version_data": [ | ||
| { | ||
| "version_name": "", | ||
| "version_affected": "<=", | ||
| "version_value": "2.4.53", | ||
| "platform": "" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "problemtype": { | ||
| "problemtype_data": [ | ||
| { | ||
| "description": [ | ||
| { | ||
| "lang": "eng", | ||
| "value": "CWE-190 Integer Overflow or Wraparound" | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "description": [ | ||
| { | ||
| "lang": "eng", | ||
| "value": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| "description": { | ||
| "description_data": [ | ||
| { | ||
| "value": "The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function.\n\nModules compiled and distributed separately from Apache HTTP Server that use the \"ap_rputs\" function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.", | ||
| "lang": "eng" | ||
| } | ||
| ] | ||
| }, | ||
| "references": { | ||
| "reference_data": [ | ||
| { | ||
| "refsource": "CONFIRM", | ||
| "url": "https://httpd.apache.org/security/vulnerabilities_24.html", | ||
| "name": "" | ||
| } | ||
| ] | ||
| }, | ||
| "configuration": [], | ||
| "impact": [ | ||
| { | ||
| "other": "low" | ||
| } | ||
| ], | ||
| "exploit": [], | ||
| "work_around": [], | ||
| "solution": [], | ||
| "credit": [ | ||
| { | ||
| "lang": "eng", | ||
| "value": "The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue" | ||
| } | ||
| ], | ||
| "CNA_private": { | ||
| "owner": "httpd", | ||
| "publish": { | ||
| "ym": "", | ||
| "year": "", | ||
| "month": "" | ||
| }, | ||
| "share_with_CVE": true, | ||
| "CVE_table_description": [], | ||
| "CVE_list": [], | ||
| "internal_comments": "", | ||
| "todo": [], | ||
| "emailed": "yes", | ||
| "userslist": "[email protected]", | ||
| "email": "" | ||
| }, | ||
| "timeline": [ | ||
| { | ||
| "time": "2022-06-08", | ||
| "lang": "eng", | ||
| "value": "released in 2.4.54" | ||
| } | ||
| ] | ||
| } |