fix(fetch/oracle): collect modularity label #401
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
MaineK00n
force-pushed
the
MaineK00n/oracle-modular
branch
from
ba6aaad to
992bf90
Compare
Vuls Difference on Oracle Linux 8setup[root@e86b66e1d6e0 ~]# cat /etc/os-release
NAME="Oracle Linux Server"
VERSION="8.10"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="8.10"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Oracle Linux Server 8.10"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:oracle:linux:8:10:server"
HOME_URL="https://linux.oracle.com/"
BUG_REPORT_URL="https://github.com/oracle/oracle-linux"
ORACLE_BUGZILLA_PRODUCT="Oracle Linux 8"
ORACLE_BUGZILLA_PRODUCT_VERSION=8.10
ORACLE_SUPPORT_PRODUCT="Oracle Linux"
ORACLE_SUPPORT_PRODUCT_VERSION=8.10
[root@e86b66e1d6e0 ~]# dnf module install -y container-tools:ol8:8040020210727075255:81945453:x86_64
[root@e86b66e1d6e0 ~]# rpm -qa --queryformat "%{NAME} %{EPOCHNUM} %{VERSION} %{RELEASE} %{ARCH} %{MODULARITYLABEL}\n" | grep module+el
crun 0 0.20.1 1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
libslirp 0 4.3.1 1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
runc 0 1.0.0 74.rc95.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
conmon 2 2.0.29 1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
containers-common 1 1.3.1 5.0.1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
container-selinux 2 2.164.1 1.module+el8.4.0+20289+730b73cc noarch container-tools:ol8:8040020210727075255:81945453
podman 0 3.2.3 0.10.0.1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
buildah 0 1.21.4 1.0.1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
udica 0 0.2.4 2.module+el8.4.0+20289+730b73cc noarch container-tools:ol8:8040020210727075255:81945453
slirp4netns 0 1.1.8 1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
criu 0 3.15 1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
containernetworking-plugins 0 0.9.1 1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
python36 0 3.6.8 39.module+el8.10.0+90274+07ba55de x86_64 python36:3.6:8100020240410010355:5ae887d0
fuse-overlayfs 0 1.6 1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
podman-catatonit 0 3.2.3 0.10.0.1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453
cockpit-podman 0 32 2.module+el8.4.0+20289+730b73cc noarch container-tools:ol8:8040020210727075255:81945453
skopeo 1 1.3.1 5.0.1.module+el8.4.0+20289+730b73cc x86_64 container-tools:ol8:8040020210727075255:81945453$ vuls scan
$ cat results/2024-06-18T02-10-23+0900/docker.json | jq -r '.packages.runc'
{
"name": "runc",
"version": "1.0.0",
"release": "74.rc95.module+el8.4.0+20289+730b73cc",
"newVersion": "1:1.1.9",
"newRelease": "1.module+el8.9.0+90102+5a5b2dad",
"arch": "x86_64",
"repository": "ol8_appstream",
"modularitylabel": "container-tools:ol8:8040020210727075255:81945453"
}old OVAL DB$ vuls report --refresh-cve
$ cat results/2024-06-18T02-10-23+0900/docker.json | jq -r '.scannedCves."CVE-2021-34558"'
(empty)new OVAL DB$ vuls report --refresh-cve
$ cat results/2024-06-18T02-10-23+0900/docker.json | jq -r '.scannedCves."CVE-2021-34558"'
{
"cveID": "CVE-2021-34558",
"confidences": [
{
"score": 100,
"detectionMethod": "OvalMatch"
}
],
"affectedPackages": [
{
"name": "buildah",
"fixedIn": "2:1.33.6-2.module+el8.10.0+90298+77a9814d"
},
{
"name": "conmon",
"fixedIn": "3:2.1.10-1.module+el8.10.0+90298+77a9814d"
},
{
"name": "containernetworking-plugins",
"fixedIn": "1:1.4.0-2.module+el8.10.0+90298+77a9814d"
},
{
"name": "containers-common",
"fixedIn": "2:1-81.0.1.module+el8.10.0+90298+77a9814d"
},
{
"name": "criu",
"fixedIn": "0:3.18-4.module+el8.9.0+90147+a4870853"
},
{
"name": "crun",
"fixedIn": "0:1.14.3-2.module+el8.10.0+90298+77a9814d"
},
{
"name": "fuse-overlayfs",
"fixedIn": "0:1.13-1.module+el8.10.0+90298+77a9814d"
},
{
"name": "libslirp",
"fixedIn": "0:4.4.0-1.module+el8.9.0+90147+a4870853"
},
{
"name": "podman",
"fixedIn": "3:4.9.4-0.1.module+el8.10.0+90298+77a9814d"
},
{
"name": "podman-catatonit",
"fixedIn": "3:4.9.4-0.1.module+el8.10.0+90298+77a9814d"
},
{
"name": "runc",
"fixedIn": "1:1.1.12-1.module+el8.10.0+90298+77a9814d"
},
{
"name": "skopeo",
"fixedIn": "2:1.14.3-0.1.module+el8.10.0+90298+77a9814d"
},
{
"name": "slirp4netns",
"fixedIn": "0:1.2.3-1.module+el8.10.0+90298+77a9814d"
}
],
"distroAdvisories": [
{
"advisoryID": "ELSA-2024-2988",
"severity": "MODERATE",
"issued": "1000-01-01T00:00:00Z",
"updated": "1000-01-01T00:00:00Z",
"description": ""
}
],
... |
shino
approved these changes
Jun 18, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What did you implement:
Like Red Hat, Oracle also has vulnerabilities defined for modular packages, and it is necessary to collect modularity labels. This PR will collect modularity labels.
Type of change
How Has This Been Tested?
before
after
Checklist:
You don't have to satisfy all of the following.
make fmtmake testIs this ready for review?: YES
Reference