fix(redhat): add rejected vulnerability check for rhsa-xxx #236
Conversation
| @@ -342,6 +342,15 @@ func parseDefinitions(advisories []redhatOVAL, tests map[string]rpmInfoTest, uni | |||
|
|
|||
| var cveEntries []CveEntry | |||
| for _, cve := range advisory.Metadata.Advisory.Cves { | |||
| // get details from NVD | |||
| details, err := vs.dbc.GetVulnerabilityDetail(cve.CveID) | |||
There was a problem hiding this comment.
VulnSrc should be order-agnostic. Your change depends on the order. NVD must be inserted before Red Hat OVAL. I'd suggest adding CveIDs here.
https://github.com/aquasecurity/trivy-db/blob/2bd1364579ec652f8f595c4a61595fd9575e8496/pkg/types/types.go
And check the rejected status of the related CVE-IDs as well here.
trivy-db/pkg/vulnsrc/vulnerability/vulnerability.go
Lines 178 to 189 in 9304617
| @@ -1,65 +1,65 @@ | |||
| package redhatoval | |||
| package types | |||
There was a problem hiding this comment.
Could you tell me the reason why we want to move this package?
There was a problem hiding this comment.
we need to decode Advisory structure here:
trivy-db/pkg/db/advisory_detail.go
Lines 119 to 128 in 03e5c84
this is necessary to remove rejected cves from
CveEntry.But we can't import
redhatoval package from db package, because we will get cycle import.(redhatoval imported db for PutAdvisoryDetail func)
| // SaveRhsaAdvisoryDetails Extract 'RHSA' advisories from 'advisory-detail'-'Red Hat' bucket and copy them in each | ||
| func (dbc Config) SaveRhsaAdvisoryDetails(tx *bolt.Tx, vulnID string, rejectedCve []string) error { | ||
| root := tx.Bucket([]byte(advisoryDetailBucket)) | ||
| if root == nil { | ||
| return nil | ||
| } | ||
|
|
||
| cveBucket := root.Bucket([]byte(vulnID)) | ||
| if cveBucket == nil { | ||
| return nil | ||
| } | ||
|
|
||
| redHatBucket := cveBucket.Bucket([]byte("Red Hat")) | ||
| if redHatBucket == nil { | ||
| return nil | ||
| } | ||
|
|
||
| if err := dbc.saveRhsaAdvisories(tx, redHatBucket, []string{"Red Hat"}, vulnID, rejectedCve); err != nil { | ||
| return xerrors.Errorf("walk advisories error: %w", err) | ||
| } | ||
|
|
||
| return nil | ||
| } |
There was a problem hiding this comment.
What is this function for...?
There was a problem hiding this comment.
this function finds all Red Hat buckets, decodes them, removes rejected cves and saves to db as SaveAdvisoryDetails.
Description
RHSA-xxxadvisories don't checks torejectwhen optimizing becauseNVDonly containsCVE-xxx.Added check for RHSAs
Related issues