all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* Dealing with CVEs that apply to unspecified package versions
@ 2017-03-06 21:36 Ludovic Courtès
  2017-03-11  4:05 ` Leo Famulari
  0 siblings, 1 reply; 4+ messages in thread
From: Ludovic Courtès @ 2017-03-06 21:36 UTC (permalink / raw)
  To: Leo Famulari; +Cc: guix-devel

[-- Attachment #1: Type: text/plain, Size: 914 bytes --]

Hi!

A couple of weeks ago you mentioned that CVE-2016-10165 (for lcms) is
not reported by ‘guix lint -c cve’.  This is due to the fact that the
CVE does not specify the lcms version number it applies to, and thus
(guix cve) ignores it.

The attached patch fixes (guix cve) to honor CVEs with an unspecified
version number.

Unfortunately, there’s no way to know whether such CVEs are actually
fixed at a specific package version or not, and they’re not uncommon.
Consequently, ‘guix lint -c cve’ would now report old CVEs that possibly
no longer apply to our package versions.

In the patch, I added the ability to specify a ‘patched-vulnerabilities’
property to work around that (with Coreutils as an example).  The
downside is that we’d have to maintain these lists by ourselves, which
is not great, but might still be better than the status quo.

Thoughts?

Ludo’.


[-- Attachment #2: Type: text/x-patch, Size: 15112 bytes --]

diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index c75e03828..c84571c21 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2012 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
@@ -320,6 +320,7 @@ used to apply commands with arbitrarily long arguments.")
                       (("#!/bin/sh")
                        (format #f "#!~a/bin/sh" bash)))))
                 %standard-phases)))
+   (properties '((patched-vulnerabilities "CVE-2016-2781"))) ;really?
    (synopsis "Core GNU utilities (file, text, shell)")
    (description
     "GNU Coreutils includes all of the basic command-line tools that are
diff --git a/guix/cve.scm b/guix/cve.scm
index 088e39837..771b82d05 100644
--- a/guix/cve.scm
+++ b/guix/cve.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -88,9 +88,17 @@
         (close-port port)))))
 
 (define %cpe-package-rx
+  ;; The CPE syntax as defined in the CPE 2.2 specs from
+  ;; <https://cpe.mitre.org/specification/2.2/cpe-specification_2.2.pdf>.
+  ;;
   ;; For applications: "cpe:/a:VENDOR:PACKAGE:VERSION", or sometimes
-  ;; "cpe/a:VENDOR:PACKAGE:VERSION:PATCH-LEVEL".
-  (make-regexp "^cpe:/a:([^:]+):([^:]+):([^:]+)((:.+)?)"))
+  ;; "cpe/a:VENDOR:PACKAGE:VERSION:PATCH-LEVEL"; in some cases, simply
+  ;; "cpe:/a:VENDOR:PACKAGE", meaning that the affected versions are not
+  ;; specified.
+  (make-regexp "^c[pP][eE]:/[aA]:([^:]+):(.*)"))
+
+(define %not-colon
+  (char-set-complement (char-set #\:)))
 
 (define (cpe->package-name cpe)
   "Converts the Common Platform Enumeration (CPE) string CPE to a package
@@ -99,15 +107,17 @@ version string.  Return #f and #f if CPE does not look like an application CPE
 string."
   (cond ((regexp-exec %cpe-package-rx (string-trim-both cpe))
          =>
-         (lambda (matches)
-           (values (match:substring matches 2)
-                   (string-append (match:substring matches 3)
-                                  (match (match:substring matches 4)
-                                    ("" "")
-                                    (patch-level
-                                     ;; Drop the colon from things like
-                                     ;; "cpe:/a:openbsd:openssh:6.8:p1".
-                                     (string-drop patch-level 1)))))))
+         (lambda (rx-match)
+           (match (string-tokenize (match:substring rx-match 2)
+                                   %not-colon)
+             ((package)
+              ;; No version component, as in
+              ;; "cpe:/a:littlecms:little_cms_color_engine".
+              (values package 'any))
+             ((package version _ ...)
+              ;; Ignore the "patch level" part if there is one, as in
+              ;; "cpe:/a:openbsd:openssh:6.8:p1".
+              (values package version)))))
         (else
          (values #f #f))))
 
@@ -119,6 +129,11 @@ applications listed in PRODUCTS, with names converted to package names:
     '(\"cpe:/a:gnu:libtasn1:4.7\" \"cpe:/a:gnu:libtasn1:4.6\" \"cpe:/a:gnu:cpio:2.11\"))
   => ((\"libtasn1\" \"4.7\" \"4.6\") (\"cpio\" \"2.11\"))
 "
+  (define (version-cons v lst)
+    (cond ((eq? v 'any) 'any)
+          ((eq? lst 'any) 'any)
+          (else (cons v lst))))
+
   (fold (lambda (product result)
           (let-values (((name version) (cpe->package-name product)))
             (if name
@@ -126,10 +141,10 @@ applications listed in PRODUCTS, with names converted to package names:
                   (((previous . versions) . tail)
                    ;; Attempt to coalesce NAME and PREVIOUS.
                    (if (string=? name previous)
-                       (alist-cons name (cons version versions) tail)
-                       (alist-cons name (list version) result)))
+                       (alist-cons name (version-cons version versions) tail)
+                       (alist-cons name (version-cons version '()) result)))
                   (()
-                   (alist-cons name (list version) result)))
+                   (alist-cons name (version-cons version '()) result)))
                 result)))
         '()
         (sort products string<?)))
@@ -282,6 +297,8 @@ vulnerabilities affecting the given package version."
     (vhash-fold* (if version
                      (lambda (pair result)
                        (match pair
+                         ((vuln . 'any)
+                          (cons vuln result))
                          ((vuln . versions)
                           (if (member version versions)
                               (cons vuln result)
diff --git a/guix/scripts/lint.scm b/guix/scripts/lint.scm
index 776e7332c..ca96b9a73 100644
--- a/guix/scripts/lint.scm
+++ b/guix/scripts/lint.scm
@@ -790,10 +790,15 @@ from ~s: ~a (~s)~%")
                                      (or (and=> (package-source package)
                                                 origin-patches)
                                          '())))
+              (patched   (or (assoc-ref (package-properties package)
+                                        'patched-vulnerabilities)
+                             '()))
               (unpatched (remove (lambda (vuln)
-                                   (find (cute string-contains
-                                           <> (vulnerability-id vuln))
-                                         patches))
+                                   (or (member (vulnerability-id vuln)
+                                               patched)
+                                       (find (cute string-contains
+                                               <> (vulnerability-id vuln))
+                                             patches)))
                                  vulnerabilities)))
          (unless (null? unpatched)
            (emit-warning package
diff --git a/tests/cve-sample.xml b/tests/cve-sample.xml
index ce158490f..78b2e302b 100644
--- a/tests/cve-sample.xml
+++ b/tests/cve-sample.xml
@@ -613,4 +613,68 @@
     </vuln:references>
     <vuln:summary>The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security Note 2238619.</vuln:summary>
   </entry>
+  <entry id="CVE-2016-10165">
+    <vuln:vulnerable-configuration id="http://nvd.nist.gov/">
+      <cpe-lang:logical-test operator="OR" negate="false">
+        <cpe-lang:fact-ref name="cpe:/a:littlecms:little_cms_color_engine"/>
+      </cpe-lang:logical-test>
+    </vuln:vulnerable-configuration>
+    <vuln:vulnerable-configuration id="http://nvd.nist.gov/">
+      <cpe-lang:logical-test operator="OR" negate="false">
+        <cpe-lang:fact-ref name="cpe:/o:debian:debian_linux:8.0"/>
+      </cpe-lang:logical-test>
+    </vuln:vulnerable-configuration>
+    <vuln:vulnerable-configuration id="http://nvd.nist.gov/">
+      <cpe-lang:logical-test operator="OR" negate="false">
+        <cpe-lang:fact-ref name="cpe:/o:novell:leap:42.1"/>
+      </cpe-lang:logical-test>
+    </vuln:vulnerable-configuration>
+    <vuln:vulnerable-software-list>
+      <vuln:product>cpe:/o:debian:debian_linux:8.0</vuln:product>
+      <vuln:product>cpe:/a:littlecms:little_cms_color_engine</vuln:product>
+      <vuln:product>cpe:/o:novell:leap:42.1</vuln:product>
+    </vuln:vulnerable-software-list>
+    <vuln:cve-id>CVE-2016-10165</vuln:cve-id>
+    <vuln:published-datetime>2017-02-03T14:59:00.177-05:00</vuln:published-datetime>
+    <vuln:last-modified-datetime>2017-02-09T10:05:10.670-05:00</vuln:last-modified-datetime>
+    <vuln:cvss>
+      <cvss:base_metrics>
+        <cvss:score>5.8</cvss:score>
+        <cvss:access-vector>NETWORK</cvss:access-vector>
+        <cvss:access-complexity>MEDIUM</cvss:access-complexity>
+        <cvss:authentication>NONE</cvss:authentication>
+        <cvss:confidentiality-impact>PARTIAL</cvss:confidentiality-impact>
+        <cvss:integrity-impact>NONE</cvss:integrity-impact>
+        <cvss:availability-impact>PARTIAL</cvss:availability-impact>
+        <cvss:source>http://nvd.nist.gov</cvss:source>
+        <cvss:generated-on-datetime>2017-02-08T12:23:39.653-05:00</cvss:generated-on-datetime>
+      </cvss:base_metrics>
+    </vuln:cvss>
+    <vuln:cwe id="CWE-125"/>
+    <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY">
+      <vuln:source>SUSE</vuln:source>
+      <vuln:reference href="http://lists.opensuse.org/opensuse-updates/2017-01/msg00174.html" xml:lang="en">openSUSE-SU-2017:0336</vuln:reference>
+    </vuln:references>
+    <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY">
+      <vuln:source>DEBIAN</vuln:source>
+      <vuln:reference href="http://www.debian.org/security/2017/dsa-3774" xml:lang="en">DSA-3774</vuln:reference>
+    </vuln:references>
+    <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY">
+      <vuln:source>MLIST</vuln:source>
+      <vuln:reference href="http://www.openwall.com/lists/oss-security/2017/01/23/1" xml:lang="en">[oss-security] 20170125 Re: CVE MLIST:[oss-security] 20170123 CVE request: lcms2 heap OOB read parsing crafted ICC profile</vuln:reference>
+    </vuln:references>
+    <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY">
+      <vuln:source>MLIST</vuln:source>
+      <vuln:reference href="http://www.openwall.com/lists/oss-security/2017/01/25/14" xml:lang="en">[oss-security] 20170125 Re: CVE request: lcms2 heap OOB read parsing crafted ICC profile</vuln:reference>
+    </vuln:references>
+    <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY">
+      <vuln:source>BID</vuln:source>
+      <vuln:reference href="http://www.securityfocus.com/bid/95808" xml:lang="en">95808</vuln:reference>
+    </vuln:references>
+    <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY">
+      <vuln:source>CONFIRM</vuln:source>
+      <vuln:reference href="https://github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2" xml:lang="en">https://github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2</vuln:reference>
+    </vuln:references>
+    <vuln:summary>The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.</vuln:summary>
+  </entry>
 </nvd>
diff --git a/tests/cve.scm b/tests/cve.scm
index 3fbb22d3c..d4d9ba5f8 100644
--- a/tests/cve.scm
+++ b/tests/cve.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -31,12 +31,13 @@
   ;; What we should get when reading %SAMPLE.
   (list
    ;; CVE-2003-0001 has no "/a" in its product list so it is omitted.
-   ;; CVE-2004-0230 lists "tcp" as an application, but lacks a version number.
+   (vulnerability "CVE-2004-0230" '(("tcp" . any)))
    (vulnerability "CVE-2008-2335" '(("phpvid" "1.2" "1.1")))
    (vulnerability "CVE-2008-3522" '(("enterprise_virtualization" "3.5")
                                     ("jasper" "1.900.1")))
    (vulnerability "CVE-2009-3301" '(("openoffice.org" "2.3.0" "2.2.1" "2.1.0")))
    ;; CVE-2015-8330 has no software list.
+   (vulnerability "CVE-2016-10165" '(("little_cms_color_engine" . any)))
    ))
 
 \f
@@ -47,17 +48,27 @@
   (call-with-input-file %sample xml->vulnerabilities))
 
 (test-equal "vulnerabilities->lookup-proc"
-  (list (list (first %expected-vulnerabilities))
+  (list (list (second %expected-vulnerabilities))
         '()
         '()
-        (list (second %expected-vulnerabilities))
-        (list (third %expected-vulnerabilities)))
+        (list (third %expected-vulnerabilities))
+        (list (fourth %expected-vulnerabilities))
+
+        (list (fifth %expected-vulnerabilities))
+        (list (fifth %expected-vulnerabilities))
+        (list (fifth %expected-vulnerabilities)))
   (let* ((vulns  (call-with-input-file %sample xml->vulnerabilities))
          (lookup (vulnerabilities->lookup-proc vulns)))
     (list (lookup "phpvid")
           (lookup "jasper" "2.0")
           (lookup "foobar")
           (lookup "jasper" "1.900.1")
-          (lookup "openoffice.org" "2.3.0"))))
+          (lookup "openoffice.org" "2.3.0")
+
+          ;; The 'littlecms' vulnerability has no version specifier so it
+          ;; should always match.
+          (lookup "little_cms_color_engine")
+          (lookup "little_cms_color_engine" "1.2.3")
+          (lookup "little_cms_color_engine" "42"))))
 
 (test-end "cve")
diff --git a/tests/lint.scm b/tests/lint.scm
index 3a9b89fe9..64bbc18b5 100644
--- a/tests/lint.scm
+++ b/tests/lint.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2014, 2015, 2016 Eric Bavier <bavier@member.fsf.org>
-;;; Copyright © 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015, 2016 Mathieu Lirzin <mthl@gnu.org>
 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
 ;;;
@@ -598,6 +598,21 @@
                              (patches
                               (list "/a/b/pi-CVE-2015-1234.patch"))))))))))
 
+(test-assert "cve: one patched vulnerability in properties"
+  (mock ((guix scripts lint) package-vulnerabilities
+         (lambda (package)
+           (list (make-struct (@@ (guix cve) <vulnerability>) 0
+                              "CVE-2015-1234"
+                              (list (cons (package-name package)
+                                          (package-version package)))))))
+        (string-null?
+         (with-warnings
+           (check-vulnerabilities
+            (dummy-package "pi"
+                           (version "3.14")
+                           (properties
+                            '((patched-vulnerabilities "CVE-2015-1234")))))))))
+
 (test-assert "cve: vulnerability fixed in replacement version"
   (mock ((guix scripts lint) package-vulnerabilities
          (lambda (package)

^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-03-16 10:08 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-06 21:36 Dealing with CVEs that apply to unspecified package versions Ludovic Courtès
2017-03-11  4:05 ` Leo Famulari
2017-03-11 11:09   ` Ludovic Courtès
2017-03-16 10:07     ` Ludovic Courtès

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.