Skip to content

Commit fcdbd4a

Browse files
ffontaineffontaine
committed
fix: improve kerberos checker
- Drop mit:kerberos and get_version as NVD NIST has deprecated this unusual versioning since January 2020: https://nvd.nist.gov/products/cpe/detail/335C9545-32F8-4473-97BD-636F1532525F?namingFormat=2.3&orderBy=CPEURI&keyword=cpe%3A2.3%3Aa%3Amit%3Akerberos%3A5-1.5.1%3A*%3A*%3A*%3A*%3A*%3A*%3A*&status=FINAL%2CDEPRECATED - Add debian and openwrt test packages Signed-off-by: Fabrice Fontaine <[email protected]>
1 parent caa5612 commit fcdbd4a

12 files changed

+35
-86
lines changed

‎cve_bin_tool/checkers/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -531,7 +531,7 @@ return following dictionary.
531531

532532
In most of the cases, Just providing above five class attributes will be enough.
533533
But sometimes, you need to override this method to correctly detect version of
534-
the product. We have done this in the checkers of `python`, `sqlite` and `kerberos`.
534+
the product. We have done this in the checkers of `python` and`sqlite`.
535535

536536
## Updating checker table
537537

‎cve_bin_tool/checkers/kerberos.py

Lines changed: 2 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
CVE checker for kerberos (CLI/library)
77
88
References:
9-
https://www.cvedetails.com/vulnerability-list/vendor_id-42/product_id-61/MIT-Kerberos.html
9+
https://www.cvedetails.com/product/12666/MIT-Kerberos-5.html?vendor_id=42
1010
"""
1111
from cve_bin_tool.checkers import Checker
1212

@@ -18,27 +18,4 @@ class KerberosChecker(Checker):
1818
r"KRB5_BRAND: krb5-(\d+\.\d+\.?\d?)-final",
1919
r"kerberos 5[_-][apl-]*(1+\.[0-9]+(\.[0-9]+)*)",
2020
]
21-
VENDOR_PRODUCT = [("mit", "kerberos"), ("mit", "kerberos_5")]
22-
23-
def get_version(self, lines, filename):
24-
version_info = super().get_version(lines, filename)
25-
26-
# currently we're only detecting kerberos 5, so return a double-version_info list
27-
# if we ever detect kerberos that's not 5, this if statement will change
28-
if "is_or_contains" in version_info:
29-
version_info5 = [dict(), dict()]
30-
version_info5[0] = version_info
31-
version_info5[1] = dict()
32-
version_info5[1]["is_or_contains"] = version_info["is_or_contains"]
33-
version_info5[1]["productname"] = "kerberos_5"
34-
35-
# strip the leading "5-" off the version for 'kerberos_5' if there is one
36-
# or conversely, add one to the 'kerberos' listing if there isn't
37-
if version_info["version"][:2] == "5-":
38-
version_info5[1]["version"] = version_info["version"][2:]
39-
else:
40-
version_info5[1]["version"] = version_info["version"]
41-
version_info5[0]["version"] = "5-{}".format(version_info["version"])
42-
return version_info5
43-
44-
return version_info
21+
VENDOR_PRODUCT = [("mit", "kerberos_5")]

‎test/condensed-downloads/krb5-libs_1.17-2_x86_64.ipk.tar.gz

534 KB
Binary file not shown.

‎test/condensed-downloads/libkrb5-3_1.12.1+dfsg-19+deb8u4_amd64.deb.tar.gz

155 KB
Binary file not shown.

‎test/json/bad_intermediate.json

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,6 @@
5252
"cve_number": "",
5353
"severity": ""
5454
},
55-
{
56-
"vendor": "mit",
57-
"product": "kerberos",
58-
"version": "1.15.1",
59-
"remarks": "",
60-
"comments": "",
61-
"cve_number": "",
62-
"severity": ""
63-
},
6455
{
6556
"vendor": "sun",
6657
"product": "sunos",
@@ -80,4 +71,4 @@
8071
"severity": ""
8172
}
8273
]
83-
}
74+
}

‎test/json/bad_metadata.json

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -54,16 +54,6 @@
5454
"severity": "",
5555
"paths": ""
5656
},
57-
{
58-
"vendor": "mit",
59-
"product": "kerberos",
60-
"version": "1.15.1",
61-
"remarks": "",
62-
"comments": "",
63-
"cve_number": "",
64-
"severity": "",
65-
"paths": ""
66-
},
6757
{
6858
"vendor": "sun",
6959
"product": "sunos",
@@ -85,4 +75,4 @@
8575
"paths": ""
8676
}
8777
]
88-
}
78+
}

‎test/json/test_triage.json

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -44,15 +44,6 @@
4444
"cve_number": "",
4545
"severity": ""
4646
},
47-
{
48-
"vendor": "mit",
49-
"product": "kerberos",
50-
"version": "1.15.1",
51-
"remarks": "",
52-
"comments": "",
53-
"cve_number": "",
54-
"severity": ""
55-
},
5647
{
5748
"vendor": "sun",
5849
"product": "sunos",
@@ -71,4 +62,4 @@
7162
"cve_number": "",
7263
"severity": ""
7364
}
74-
]
65+
]

‎test/test_checkers.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ def setup_class(cls):
7474
"international_components_for_unicode.o",
7575
["international_components_for_unicode"],
7676
),
77-
("kerberos", "kerberos", ["kerberos", "kerberos_5"]),
77+
("kerberos", "kerberos", ["kerberos_5"]),
7878
("libcurl", "libcurl.so.2.0", ["libcurl"]),
7979
("libdb", "libdb-2.0.so", ["libdb"]),
8080
("libgcrypt", "libgcrypt.so.1.0", ["libgcrypt"]),

‎test/test_csv2cve.py

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ async def test_csv2cve_valid_file(self, caplog):
3131
) in caplog.record_tuples
3232

3333
for cve_count, product in [
34-
[3, "mit.kerberos v1.15.1"],
3534
[60, "haxx.curl v7.34.0"],
3635
[10, "mit.kerberos_5 v1.15.1"],
3736
]:

‎test/test_data/kerberos.py

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,46 @@
11
# Copyright (C) 2021 Intel Corporation
22
# SPDX-License-Identifier: GPL-3.0-or-later
33

4-
from __future__ import annotations
5-
64
mapping_test_data = [
75
{
8-
"product": "kerberos",
9-
"version": "5-1.15.1",
6+
"product": "kerberos_5",
7+
"version": "1.15.1",
108
"version_strings": [
119
"An unknown option was passed in to kerberos",
1210
"CLIENT kerberos 5-1.15.1",
1311
"KRB5_BRAND: ",
1412
],
1513
},
1614
{
17-
"product": "kerberos",
18-
"version": "5-1.15.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1",
15+
"product": "kerberos_5",
16+
"version": "1.15.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1",
1917
"version_strings": [
2018
"An unknown option was passed in to kerberos",
2119
"CLIENT kerberos 5-1.15.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1",
2220
"KRB5_BRAND: ",
2321
],
2422
},
2523
]
26-
package_test_data: list[dict] = []
24+
package_test_data = [
25+
{
26+
"url": "http://mirror.centos.org/centos/7/os/x86_64/Packages/",
27+
"package_name": "krb5-libs-1.15.1-50.el7.x86_64.rpm",
28+
"product": "kerberos_5",
29+
"version": "1.15.1",
30+
"other_products": [],
31+
},
32+
{
33+
"url": "http://ftp.fr.debian.org/debian/pool/main/k/krb5/",
34+
"package_name": "libkrb5-3_1.12.1+dfsg-19+deb8u4_amd64.deb",
35+
"product": "kerberos_5",
36+
"version": "1.12.1",
37+
"other_products": [],
38+
},
39+
{
40+
"url": "https://downloads.openwrt.org/releases/packages-19.07/x86_64/packages/",
41+
"package_name": "krb5-libs_1.17-2_x86_64.ipk",
42+
"product": "kerberos_5",
43+
"version": "1.17",
44+
"other_products": [],
45+
},
46+
]

‎test/test_data/kerberos_5.py

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎test/test_input_engine.py

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,7 @@ class TestInputEngine:
4646
},
4747
"paths": {""},
4848
},
49-
ProductInfo("mit", "kerberos", "1.15.1"): {
50-
"default": {"comments": "", "remarks": Remarks.Unexplored, "severity": ""},
51-
"paths": {""},
52-
},
53-
ProductInfo("mit", "kerberos_5", "5-1.15.1"): {
49+
ProductInfo("mit", "kerberos_5", "1.15.1"): {
5450
"default": {"comments": "", "remarks": Remarks.Confirmed, "severity": ""},
5551
"paths": {""},
5652
},

0 commit comments

Comments
 (0)