Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(rdb): change query to Package Arch for each OS #178

Merged
merged 1 commit into from
Dec 24, 2021

Conversation

MaineK00n
Copy link
Collaborator

@MaineK00n MaineK00n commented Dec 8, 2021

What did you implement:

OS other than Amazon/Oracle do not have Arch information in Package. With the current query, when searching for vuls with arch information, there is a problem that OS such as Debian cannot be scanned correctly.
This bug was not noticed because the integration test uses server mode, so it is not searched in Debian with arch information.

Type of change

  • Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Using CentOS8, here are the differences in the search results for vuls.
When using master mod, the number of OVAL detections is 0, while when using MaineK00n/fix-rdb-query, the number of OVAL detections is 171.

master

$ vuls report -format-one-line-text
[Dec  9 02:33:18]  INFO [localhost] vuls-v0.19.0-build-20211207_094022_0c6a892
[Dec  9 02:33:18]  INFO [localhost] Validating config...
[Dec  9 02:33:18]  INFO [localhost] cveDict.type=sqlite3, cveDict.url=, cveDict.SQLite3Path=/usr/share/vuls-data/cve.sqlite3
[Dec  9 02:33:18]  INFO [localhost] ovalDict.type=sqlite3, ovalDict.url=, ovalDict.SQLite3Path=/usr/share/vuls-data/oval.sqlite3
[Dec  9 02:33:18]  INFO [localhost] gost.type=sqlite3, gost.url=, gost.SQLite3Path=/usr/share/vuls-data/gost.sqlite3
[Dec  9 02:33:18]  INFO [localhost] exploit.type=sqlite3, exploit.url=, exploit.SQLite3Path=/usr/share/vuls-data/go-exploitdb.sqlite3
[Dec  9 02:33:18]  INFO [localhost] metasploit.type=sqlite3, metasploit.url=, metasploit.SQLite3Path=/usr/share/vuls-data/go-msfdb.sqlite3
[Dec  9 02:33:18]  INFO [localhost] kevuln.type=sqlite3, kevuln.url=, kevuln.SQLite3Path=/usr/share/vuls-data/go-kev.sqlite3
[Dec  9 02:33:18]  INFO [localhost] Loaded: /home/mainek00n/github/github.com/MaineK00n/vuls/results/2021-12-09T02:33:14+09:00
[Dec  9 02:33:18]  INFO [localhost] OVAL centos 8.1.1911 found. defs: 778
[Dec  9 02:33:18]  INFO [localhost] OVAL centos 8.1.1911 is fresh. lastModified: 2021-12-09T02:29:12+09:00
[Dec  9 02:33:18]  INFO [localhost] vuls-target: 0 CVEs are detected with OVAL
[Dec  9 02:33:18]  INFO [localhost] vuls-target: 38 unfixed CVEs are detected with gost
[Dec  9 02:33:18]  INFO [localhost] vuls-target: 0 CVEs are detected with CPE
[Dec  9 02:33:18]  INFO [localhost] vuls-target: 0 PoC are detected
[Dec  9 02:33:18]  INFO [localhost] vuls-target: 0 exploits are detected
[Dec  9 02:33:18]  INFO [localhost] vuls-target: total 37 CVEs detected
[Dec  9 02:33:18]  INFO [localhost] vuls-target: 0 CVEs filtered by --confidence-over=80


One Line Summary
================
vuls-target	Total: 37 (Critical:4 High:12 Medium:13 Low:8 ?:0)	0/37 Fixed	193 installed	22 poc	0 exploits	cisa: 0, uscert: 0, jpcert: 0 alerts

MaineK00n/fix-rdb-query

$ vuls report -format-one-line-text
[Dec  9 02:33:53]  INFO [localhost] vuls-v0.19.0-build-20211209_021325_0c6a892
[Dec  9 02:33:53]  INFO [localhost] Validating config...
[Dec  9 02:33:53]  INFO [localhost] cveDict.type=sqlite3, cveDict.url=, cveDict.SQLite3Path=/usr/share/vuls-data/cve.sqlite3
[Dec  9 02:33:53]  INFO [localhost] ovalDict.type=sqlite3, ovalDict.url=, ovalDict.SQLite3Path=/usr/share/vuls-data/oval.sqlite3
[Dec  9 02:33:53]  INFO [localhost] gost.type=sqlite3, gost.url=, gost.SQLite3Path=/usr/share/vuls-data/gost.sqlite3
[Dec  9 02:33:53]  INFO [localhost] exploit.type=sqlite3, exploit.url=, exploit.SQLite3Path=/usr/share/vuls-data/go-exploitdb.sqlite3
[Dec  9 02:33:53]  INFO [localhost] metasploit.type=sqlite3, metasploit.url=, metasploit.SQLite3Path=/usr/share/vuls-data/go-msfdb.sqlite3
[Dec  9 02:33:53]  INFO [localhost] kevuln.type=sqlite3, kevuln.url=, kevuln.SQLite3Path=/usr/share/vuls-data/go-kev.sqlite3
[Dec  9 02:33:53]  INFO [localhost] Loaded: /home/mainek00n/github/github.com/MaineK00n/vuls/results/2021-12-09T02:33:14+09:00
[Dec  9 02:33:53]  INFO [localhost] OVAL centos 8.1.1911 found. defs: 778
[Dec  9 02:33:53]  INFO [localhost] OVAL centos 8.1.1911 is fresh. lastModified: 2021-12-09T02:29:12+09:00
[Dec  9 02:33:53]  INFO [localhost] vuls-target: 171 CVEs are detected with OVAL
[Dec  9 02:33:53]  INFO [localhost] vuls-target: 17 unfixed CVEs are detected with gost
[Dec  9 02:33:53]  INFO [localhost] vuls-target: 0 CVEs are detected with CPE
[Dec  9 02:33:54]  INFO [localhost] vuls-target: 1 PoC are detected
[Dec  9 02:33:54]  INFO [localhost] vuls-target: 1 exploits are detected
[Dec  9 02:33:54]  INFO [localhost] vuls-target: total 187 CVEs detected
[Dec  9 02:33:54]  INFO [localhost] vuls-target: 0 CVEs filtered by --confidence-over=80


One Line Summary
================
vuls-target	Total: 187 (Critical:19 High:97 Medium:67 Low:4 ?:0)	150/187 Fixed	193 installed	77 poc	1 exploits	cisa: 1, uscert: 2, jpcert: 2 alerts

Checklist:

You don't have to satisfy all of the following.

  • Write tests
  • Write documentation
  • Check that there aren't other open pull requests for the same issue/feature
  • Format your source code by make fmt
  • Pass the test by make test
  • Provide verification config / commands
  • Enable "Allow edits from maintainers" for this PR
  • Update the messages below

Is this ready for review?: YES

Reference

@MaineK00n MaineK00n self-assigned this Dec 8, 2021
@MaineK00n MaineK00n requested a review from kotakanbe December 8, 2021 17:40
@MaineK00n MaineK00n marked this pull request as ready for review December 8, 2021 17:40
Copy link
Collaborator

@kotakanbe kotakanbe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kotakanbe kotakanbe merged commit c2e61e7 into master Dec 24, 2021
@kotakanbe kotakanbe deleted the MaineK00n/fix-rdb-query branch December 24, 2021 01:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants