diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt index 319bd9ae9f..2689c5aa7e 100644 --- a/.github/actions/spelling/allow.txt +++ b/.github/actions/spelling/allow.txt @@ -183,6 +183,7 @@ libraryname libsndfile libsoup libsqlite +libsrtp libssh libtiff libvirt diff --git a/README.md b/README.md index 6b9be6f28a..b4178180c5 100644 --- a/README.md +++ b/README.md @@ -135,7 +135,7 @@ match certain vulnerable versions of the following libraries and tools: | | | | Available checkers | | | | -|--------------- |------------- |--------- |---------- |------------- |------------ |--------------- | +|--------------- |--------- |------------- |---------- |------------- |---------- |------------ | | accountsservice |avahi |bash |bind |binutils |bolt |bubblewrap | | busybox |bzip2 |cronie |cryptsetup |cups |curl |dbus | | dnsmasq |dovecot |dpkg |enscript |expat |ffmpeg |freeradius | @@ -143,15 +143,15 @@ match certain vulnerable versions of the following libraries and tools: | gpgme |gstreamer |gupnp |haproxy |hdf5 |hostapd |hunspell | | icecast |icu |irssi |kbd |kerberos |kexectools |libarchive | | libbpg |libdb |libgcrypt |libical |libjpeg_turbo |liblas |libnss | -| libsndfile |libsoup |libssh2 |libtiff |libvirt |libvncserver |libxslt | -| lighttpd |logrotate |lua |mariadb |mdadm |memcached |mtr | -| mysql |nano |ncurses |nessus |netpbm |nginx |node | -| ntp |open_vm_tools |openafs |openjpeg |openldap |openssh |openssl | -| openswan |openvpn |p7zip |pcsc_lite |pigz |png |polarssl_fedora | -| poppler |postgresql |pspp |python |qt |radare2 |rsyslog | -| samba |sane_backends |sqlite |strongswan |subversion |sudo |syslogng | -| systemd |tcpdump |trousers |varnish |webkitgtk |wireshark |wpa_supplicant | -| xerces |xml2 |zlib |zsh | | | | +| libsndfile |libsoup |libsrtp |libssh2 |libtiff |libvirt |libvncserver | +| libxslt |lighttpd |logrotate |lua |mariadb |mdadm |memcached | +| mtr |mysql |nano |ncurses |nessus |netpbm |nginx | +| node |ntp |open_vm_tools |openafs |openjpeg |openldap |openssh | +| openssl |openswan |openvpn |p7zip |pcsc_lite |pigz |png | +| polarssl_fedora |poppler |postgresql |pspp |python |qt |radare2 | +| rsyslog |samba |sane_backends |sqlite |strongswan |subversion |sudo | +| syslogng |systemd |tcpdump |trousers |varnish |webkitgtk |wireshark | +| wpa_supplicant |xerces |xml2 |zlib |zsh | | | All the checkers can be found in the checkers directory, as can the diff --git a/cve_bin_tool/checkers/__init__.py b/cve_bin_tool/checkers/__init__.py index f9fdacf62d..fd7938a1b0 100644 --- a/cve_bin_tool/checkers/__init__.py +++ b/cve_bin_tool/checkers/__init__.py @@ -62,6 +62,7 @@ "libnss", "libsndfile", "libsoup", + "libsrtp", "libssh2", "libtiff", "libvirt", diff --git a/cve_bin_tool/checkers/libsrtp.py b/cve_bin_tool/checkers/libsrtp.py new file mode 100644 index 0000000000..1d797b3e49 --- /dev/null +++ b/cve_bin_tool/checkers/libsrtp.py @@ -0,0 +1,23 @@ +# Copyright (C) 2022 Intel Corporation +# SPDX-License-Identifier: GPL-3.0-or-later + +""" +CVE checker for libsrtp + +https://www.cvedetails.com/vulnerability-list/vendor_id-16/product_id-26868/version_id-502930/Cisco-Libsrtp--.html + +""" + +from cve_bin_tool.checkers import Checker + + +class LibsrtpChecker(Checker): + CONTAINS_PATTERNS = [ + r"An implementation of the Secure Real-time Transport Protocol \(SRTP\)", + r"This package provides an implementation of the Secure Real-time", + r"Transport Protocol \(SRTP\), the Universal Security Transform \(UST\), and", + r"a supporting cryptographic kernel\.", + ] + FILENAME_PATTERNS = [r"libsrtp"] + VERSION_PATTERNS = [r"libsrtp[0-9]? ([0-9]+\.[0-9]+\.[0-9]+)"] + VENDOR_PRODUCT = [("cisco", "libsrtp")] diff --git a/doc/MANUAL.md b/doc/MANUAL.md index 0b6542ef48..adb98b714b 100644 --- a/doc/MANUAL.md +++ b/doc/MANUAL.md @@ -115,7 +115,7 @@ which is useful if you're trying the latest code from | | | | Available checkers | | | | -|--------------- |------------- |--------- |---------- |------------- |------------ |--------------- | +|--------------- |--------- |------------- |---------- |------------- |---------- |------------ | | accountsservice |avahi |bash |bind |binutils |bolt |bubblewrap | | busybox |bzip2 |cronie |cryptsetup |cups |curl |dbus | | dnsmasq |dovecot |dpkg |enscript |expat |ffmpeg |freeradius | @@ -123,15 +123,15 @@ which is useful if you're trying the latest code from | gpgme |gstreamer |gupnp |haproxy |hdf5 |hostapd |hunspell | | icecast |icu |irssi |kbd |kerberos |kexectools |libarchive | | libbpg |libdb |libgcrypt |libical |libjpeg_turbo |liblas |libnss | -| libsndfile |libsoup |libssh2 |libtiff |libvirt |libvncserver |libxslt | -| lighttpd |logrotate |lua |mariadb |mdadm |memcached |mtr | -| mysql |nano |ncurses |nessus |netpbm |nginx |node | -| ntp |open_vm_tools |openafs |openjpeg |openldap |openssh |openssl | -| openswan |openvpn |p7zip |pcsc_lite |pigz |png |polarssl_fedora | -| poppler |postgresql |pspp |python |qt |radare2 |rsyslog | -| samba |sane_backends |sqlite |strongswan |subversion |sudo |syslogng | -| systemd |tcpdump |trousers |varnish |webkitgtk |wireshark |wpa_supplicant | -| xerces |xml2 |zlib |zsh | | | | +| libsndfile |libsoup |libsrtp |libssh2 |libtiff |libvirt |libvncserver | +| libxslt |lighttpd |logrotate |lua |mariadb |mdadm |memcached | +| mtr |mysql |nano |ncurses |nessus |netpbm |nginx | +| node |ntp |open_vm_tools |openafs |openjpeg |openldap |openssh | +| openssl |openswan |openvpn |p7zip |pcsc_lite |pigz |png | +| polarssl_fedora |poppler |postgresql |pspp |python |qt |radare2 | +| rsyslog |samba |sane_backends |sqlite |strongswan |subversion |sudo | +| syslogng |systemd |tcpdump |trousers |varnish |webkitgtk |wireshark | +| wpa_supplicant |xerces |xml2 |zlib |zsh | | | For a quick overview of usage and how it works, you can also see [the readme file](README.md). diff --git a/test/condensed-downloads/libsrtp-1.5.4-8.el8.aarch64.rpm.tar.gz b/test/condensed-downloads/libsrtp-1.5.4-8.el8.aarch64.rpm.tar.gz new file mode 100644 index 0000000000..6f45b987ba Binary files /dev/null and b/test/condensed-downloads/libsrtp-1.5.4-8.el8.aarch64.rpm.tar.gz differ diff --git a/test/condensed-downloads/libsrtp-2.3.0-7.el9.aarch64.rpm.tar.gz b/test/condensed-downloads/libsrtp-2.3.0-7.el9.aarch64.rpm.tar.gz new file mode 100644 index 0000000000..c9154f3ab4 Binary files /dev/null and b/test/condensed-downloads/libsrtp-2.3.0-7.el9.aarch64.rpm.tar.gz differ diff --git a/test/test_data/libsrtp.py b/test/test_data/libsrtp.py new file mode 100644 index 0000000000..e9cb88ce79 --- /dev/null +++ b/test/test_data/libsrtp.py @@ -0,0 +1,19 @@ +mapping_test_data = [ + {"product": "libsrtp", "version": "1.5.4", "version_strings": ["libsrtp 1.5.4"]}, + {"product": "libsrtp", "version": "2.3.0", "version_strings": ["libsrtp2 2.3.0"]}, +] + +package_test_data = [ + { + "url": "https://rpmfind.net/linux/centos/8-stream/AppStream/aarch64/os/Packages/", + "package_name": "libsrtp-1.5.4-8.el8.aarch64.rpm", + "product": "libsrtp", + "version": "1.5.4", + }, + { + "url": "https://rpmfind.net/linux/centos-stream/9-stream/AppStream/aarch64/os/Packages/", + "package_name": "libsrtp-2.3.0-7.el9.aarch64.rpm", + "product": "libsrtp", + "version": "2.3.0", + }, +]