Ola Lundqvist pushed to branch
30-improve-gen-dsa-by-checking-cve-s-are-related-to-package at Debian Security
Tracker / security-tracker
Commits:
39492470 by Ola Lundqvist at 2024-08-30T23:08:55+02:00
Print a warning if the package cannot be found for a given CVE
Introduced a new bin/check-package-cves script that check whether
a CVE is related to a package. If not a warning is emitted and
exit with error code 1.
bin/gen-DSA is also updated to call this new script and if an exit
code != 0 is returned check if it should proceed.
For more information see:
https://salsa.debian.org/lts-team/lts-extra-tasks/-/issues/61
- - - - -
2 changed files:
- + bin/check-package-cves
- bin/gen-DSA
Changes:
=====================================
bin/check-package-cves
=====================================
@@ -0,0 +1,49 @@
+#!/usr/bin/python3
+#
+# Check if a package is affected by no-dsa tags from data/CVE/list
+#
+# Copyright © 2021 Emilio Pozuelo Monfort <po...@debian.org>
+# Copyright © 2024 Ola Lundqvist <o...@debian.org>
+# This script is written by Ola, but based on remove-cve-tags written by
+# Emilio.
+
+import os.path
+import sys
+
+import setup_paths # noqa
+import config
+from sectracker.parsers import cvelist, PackageAnnotation
+
+if len(sys.argv) <= 3:
+ # assume there are no CVEs, so nothing to do
+ sys.exit(0)
+
+releases = sys.argv[1].split(",")
+package = sys.argv[2]
+cves = sys.argv[3:]
+
+main_list = os.path.dirname(__file__) + '/../data/CVE/list'
+# check if another file was specified in config, e.g. a ExtendedFile
+
+for release in releases:
+ distconfig = config.get_config()[release]
+ if 'maincvefile' in distconfig:
+ main_list = os.path.dirname(__file__) + '/../' +
distconfig['maincvefile']
+
+data = cvelist(main_list)
+cvematch = []
+
+for cve in data:
+ if cve.header.name in cves:
+ for annotation in cve.annotations:
+ if isinstance(annotation, PackageAnnotation):
+ if annotation.package == package:
+ cvematch.append(cve.header.name)
+
+error = 0
+for cve in cves:
+ if not cve in cvematch:
+ error = 1
+ print(f"Warning: Cannot find that {cve} is related to {package}. Check
package name or CVE.")
+
+exit (error)
=====================================
bin/gen-DSA
=====================================
@@ -358,6 +358,7 @@ for dist in $RELEASES; do
done
DISTS=
+DISTSX=
for dist in $CODENAMES; do
version="$(eval 'printf "%s" "$'"$dist"_VERSION'"')"
@@ -370,10 +371,17 @@ for dist in $CODENAMES; do
fi
[ -z "$version" ] || setvar "${dist}_VERSION" "$version"
[ -z "$version" ] || DISTS="${DISTS},${dist}"
+ DISTSX="${DISTSX},${dist}"
done
DISTS="${DISTS#,}"
+DISTSX="${DISTSX#,}"
+bin/check-package-cves "${DISTSX}" "${PACKAGE}" ${CVE}
+if [ $? -ne 0 ] ; then
+ echo Are you sure you want to continue. If to press enter.
+ read
+fi
if [ -n "${DISTS}" ]; then
bin/remove-cve-dist-tags "${DISTS}" "${PACKAGE}" ${CVE}
fi
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/39492470a26b870a18451bb123d6a9becdde18a1
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/39492470a26b870a18451bb123d6a9becdde18a1
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
