vulns: add curl and libcurl vulns #1275
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
RTann
added
the
generate-dumps-on-pr
RTann
force-pushed
the
curl-vulns-10-11-23
branch
from
321a31e to
f338fed
Compare
|
/retest |
|
Images are ready for the commit at f338fed. To use the images, use the tag |
|
daynewlee
approved these changes
Oct 11, 2023
dcaravel
requested changes
Oct 11, 2023
pkg/vulnloader/nvdloader/manual.go
Outdated
| Description: []*schema.CVEJSON40LangString{ | ||
| { | ||
| Lang: "en", | ||
| Value: "CWE-611", |
There was a problem hiding this comment.
Per curl.se this should be CWE-122 Heap-based Buffer Overflow
pkg/vulnloader/nvdloader/manual.go
Outdated
Comment on lines
982
to
986
| { | ||
| Cpe23Uri: `cpe:2.3:a:ubuntu:curl:*:*:*:*:*:*:*:*`, | ||
| VersionEndExcluding: "8.4.0", | ||
| Vulnerable: true, | ||
| }, |
There was a problem hiding this comment.
Should add VersionStartIncluding: "7.69.0"
pkg/vulnloader/nvdloader/manual.go
Outdated
| { | ||
| CPEMatch: []*schema.NVDCVEFeedJSON10DefCPEMatch{ | ||
| { | ||
| Cpe23Uri: `cpe:2.3:a:ubuntu:curl:*:*:*:*:*:*:*:*`, |
There was a problem hiding this comment.
Is the vendor ubuntu in the CPE line here accurate? See other curl vulns use haxx as the vendor.
pkg/vulnloader/nvdloader/manual.go
Outdated
Comment on lines
995
to
1009
| AttackComplexity: "LOW", | ||
| AttackVector: "NETWORK", | ||
| AvailabilityImpact: "HIGH", | ||
| BaseScore: 7.5, | ||
| BaseSeverity: "HIGH", | ||
| ConfidentialityImpact: "HIGH", | ||
| IntegrityImpact: "HIGH", | ||
| PrivilegesRequired: "NONE", | ||
| Scope: "UNCHANGED", | ||
| UserInteraction: "REQUIRED", | ||
| VectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", | ||
| Version: "3.1", | ||
| }, | ||
| ExploitabilityScore: 1.6, | ||
| ImpactScore: 5.9, |
There was a problem hiding this comment.
Assuming this was sourced from RH data?
Based on vector AC:H, AttackComplexity should be HIGH
pkg/vulnloader/nvdloader/manual.go
Outdated
| Description: []*schema.CVEJSON40LangString{ | ||
| { | ||
| Lang: "en", | ||
| Value: "CWE-611", |
There was a problem hiding this comment.
Per curl.se - CWE-73: External Control of File Name or Path
pkg/vulnloader/nvdloader/manual.go
Outdated
Comment on lines
1056
to
1059
| Name: "https://github.com/curl/curl/discussions/12026", | ||
| Refsource: "MISC", | ||
| Tags: []string{"Patch", "Third Party Advisory"}, | ||
| URL: "https://github.com/curl/curl/discussions/12026", |
There was a problem hiding this comment.
Should these links be https://curl.se/docs/CVE-2023-38546.html instead?
pkg/vulnloader/nvdloader/manual.go
Outdated
Comment on lines
969
to
972
| Name: "https://github.com/curl/curl/discussions/12026", | ||
| Refsource: "MISC", | ||
| Tags: []string{"Patch", "Third Party Advisory"}, | ||
| URL: "https://github.com/curl/curl/discussions/12026", |
There was a problem hiding this comment.
Should these links be https://curl.se/docs/CVE-2023-38545.html instead?
pkg/vulnloader/nvdloader/manual.go
Outdated
Comment on lines
1070
to
1072
| Cpe23Uri: `cpe:2.3:a:ubuntu:libcurl:*:*:*:*:*:*:*:*`, | ||
| VersionEndExcluding: "8.4.0", | ||
| Vulnerable: true, |
There was a problem hiding this comment.
Should add VersionStartIncluding: "7.9.1"
RTann
removed
the
generate-dumps-on-pr
dcaravel
approved these changes
Oct 11, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I ran a genesis dump without these changes (see #1276). You'll notice in that PR in the genesis dump logs, you will find logs saying CVE-2023-38545 and CVE-2023-38546 are missing for several distributions. With this PR, they are no longer missing, as we utilize the CVSSv3 scores from our "NVD" manual entries.
Note: this does not affect Red Hat, as they track CVSS scores, themselves