Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(checkers): Add polarssl fedora contains patterns #1695

Merged
merged 7 commits into from
Jun 21, 2022
Merged

feat(checkers): Add polarssl fedora contains patterns #1695

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
208b1b7
feat: add polarssl contains patterns on fedora packages
Jun 8, 2022
050e643
refactor: comment the seccond hint docstring of polarssl checker
Jun 8, 2022
a89e281
refactor: remove unused regex sign from begining of expat checker doc…
Jun 8, 2022
aecadb6
fix: remove blank line end of array
Jun 8, 2022
ee6da3c
fix: use double back-slash in docstring to correct string format
Jun 8, 2022
2d009a3
fix: correct format with black
Jun 9, 2022
6af47f6
Revert changes on expat checker docstring
Jun 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions cve_bin_tool/checkers/expat.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Copyright (C) 2021 Intel Corporation
# SPDX-License-Identifier: GPL-3.0-or-later

r"""
"""
CVE checker for libexpat

References:
Expand All @@ -14,7 +14,7 @@
http://www.cvedetails.com/vulnerability-feed.php?vendor_id=16735&product_id=0&version_id=0&orderby=3&cvssscoremin=0

Easiest way to check CVEs is currently the Changes.txt file. You can pinpoint the CVEs using grep as follows:
grep 'Release\|CVE' Changes.txt
grep 'Release\\|CVE' Changes.txt
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you double check that the grep works as expected on the expat changes file after this change, and update it if it's no longer correct?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @terriko, Sorry, I probably changed this by a mistake. I'm going to revert this change.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I probably changed this because backslash's parsing error on docstring, if it's parsed with __doc__ property the grep command would be correct.
Now I understand why docstring signed as regex before. I'm going to revert this too.


Which will give you output like...

Expand All @@ -26,7 +26,6 @@
Release 2.2.1 Sat June 17 2017
CVE-2017-9233 -- External entity infinite loop DoS
(etc.)

"""
from cve_bin_tool.checkers import Checker

Expand Down
18 changes: 12 additions & 6 deletions cve_bin_tool/checkers/polarssl_fedora.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,16 +15,22 @@


class PolarsslFedoraChecker(Checker):
CONTAINS_PATTERNS = []
CONTAINS_PATTERNS = [
r"Bad usage of mbedtls_ssl_set_bio() or mbedtls_ssl_set_bio()",
r"You must use mbedtls_ssl_set_timer_cb() for DTLS",
r"configured max major version is invalid, consider using mbedtls_ssl_config_defaults()",
# Alternate optional contains patterns,
# see https://github.com/intel/cve-bin-tool/tree/main/cve_bin_tool/checkers#helper-script for more details
# r"mbedtls_ssl_conf_ciphersuites_for_version",
# r"mbedtls_x509_crt_check_extended_key_usage",
]
FILENAME_PATTERNS = [r"libpolarssl.so."]
VERSION_PATTERNS = [
r"libpolarssl.so.([0-9]+\.[0-9]+\.[0-9]+)"
] # patterns like this aren't ideal
VENDOR_PRODUCT = [("polarssl", "polarssl")]


"""
Using filenames (containing patterns like '.so' etc.) in the binaries as VERSION_PATTERNS aren't ideal.
The reason behind this is that these might depend on who packages the file (like it
might work on fedora but not on ubuntu)
"""
# Using filenames (containing patterns like '.so' etc.) in the binaries as VERSION_PATTERNS aren't ideal.
# The reason behind this is that these might depend on who packages the file (like it
# might work on fedora but not on ubuntu)