Skip to content

ROX-25981: use VEX for RPMs #12452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RTann merged 11 commits into from
Oct 5, 2024
Merged

ROX-25981: use VEX for RPMs #12452

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
d7d0905
ROX-25981: VEX for RPMs
RTann Aug 19, 2024
c741e58
remove vuln stop date explanation
RTann Sep 20, 2024
5689406
CHANGELOG wording
RTann Sep 25, 2024
233d87a
revert vuln URL change
RTann Sep 26, 2024
f596cdd
address PR comments
RTann Sep 30, 2024
293992e
bump vuln version
RTann Sep 30, 2024
43634ae
forgot to revert one thing
RTann Sep 30, 2024
088096e
update CHANGELOG
RTann Oct 2, 2024
b7ad236
add nolint
RTann Oct 3, 2024
29278a7
bump claircore to version with rpm module support
RTann Oct 4, 2024
61310af
replace unused function with nolint comment
RTann Oct 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,13 @@ Please avoid adding duplicate information across this changelog and JIRA/doc inp
- Node.js 20 moves from Active to Maintenance status on 2024-10-22
- ROX-20578: Sensor will now store pull secrets by secret name and registry host (instead of only registry host). This will reduce Delegated Scanning authentication failures when multiple secrets exist for the same registry within a namespace and more closely aligns with k8s secret handling.
- Setting `ROX_SENSOR_PULL_SECRETS_BY_NAME` to `false` on Sensor will disable this feature and cause secrets to be stored by only registry host.
- ROX-25981: Scanner V4 now fetches vulnerability data from [Red Hat's VEX files](https://security.access.redhat.com/data/csaf/v2/vex/) instead of [Red Hat's OVAL feed](https://security.access.redhat.com/data/oval/v2/) for RPMs installed in RHEL-based image containers.
- Fixed vulnerabilities affecting RHEL-based images are no longer identified by the respective RHSA, RHBA, nor RHEA. Instead, they will be identified by CVE.
- This will also apply to vulnerabilities obtained from the [CVE map](https://security.access.redhat.com/data/metrics/cvemap.xml) (used for container-first scanning).
- This may potentially disrupt policies created around RHSAs.
- Scanner V4 now only considers vulnerabilities affecting Red Hat products dated back to 2014.
- Previously when reading Red Hat's OVAL data, the vulnerabilities dated back to pre-2000, but ClairCore only reads back to 2014.
- Scanner V4 DB requires less space for vulnerability data, and its initialization time has improved from about 1 hour on SSD to about 10 minutes.

## [4.5.0]

Expand Down
19 changes: 10 additions & 9 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ require (
github.com/jackc/pgx/v5 v5.6.0
github.com/jeremywohl/flatten v1.0.1
github.com/joshdk/go-junit v1.0.0
github.com/klauspost/compress v1.17.9
github.com/klauspost/compress v1.17.10
github.com/lib/pq v1.10.9
github.com/machinebox/graphql v0.2.2
github.com/mailru/easyjson v0.7.7
Expand All @@ -101,10 +101,10 @@ require (
github.com/pkg/errors v0.9.1
github.com/planetscale/vtprotobuf v0.6.0
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
github.com/prometheus/client_golang v1.20.2
github.com/prometheus/client_golang v1.20.4
github.com/prometheus/client_model v0.6.1
github.com/prometheus/common v0.57.0
github.com/quay/claircore v1.5.29-0.20240812155114-de6d8475516c
github.com/quay/claircore v1.5.32
github.com/quay/claircore/toolkit v1.2.4
github.com/quay/goval-parser v0.8.8
github.com/quay/zlog v1.1.8
Expand Down Expand Up @@ -141,7 +141,7 @@ require (
golang.org/x/sys v0.25.0
golang.org/x/text v0.18.0
golang.org/x/time v0.6.0
golang.org/x/tools v0.24.0
golang.org/x/tools v0.25.0
golang.stackrox.io/grpc-http1 v0.3.12
google.golang.org/api v0.194.0
google.golang.org/genproto v0.0.0-20240814211410-ddb44dafa142
Expand Down Expand Up @@ -393,6 +393,7 @@ require (
github.com/opencontainers/runtime-spec v1.2.0 // indirect
github.com/opentracing/opentracing-go v1.2.0 // indirect
github.com/operator-framework/operator-lib v0.14.0 // indirect
github.com/package-url/packageurl-go v0.1.3 // indirect
github.com/pelletier/go-toml v1.9.5 // indirect
github.com/pelletier/go-toml/v2 v2.2.2 // indirect
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
Expand Down Expand Up @@ -455,17 +456,17 @@ require (
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
go.opentelemetry.io/otel v1.28.0 // indirect
go.opentelemetry.io/otel v1.30.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
go.opentelemetry.io/otel/metric v1.28.0 // indirect
go.opentelemetry.io/otel/metric v1.30.0 // indirect
go.opentelemetry.io/otel/sdk v1.28.0 // indirect
go.opentelemetry.io/otel/trace v1.28.0 // indirect
go.opentelemetry.io/otel/trace v1.30.0 // indirect
go.opentelemetry.io/proto/otlp v1.0.0 // indirect
go.starlark.net v0.0.0-20230612165344-9532f5667272 // indirect
go.step.sm/crypto v0.44.2 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/mod v0.20.0 // indirect
golang.org/x/mod v0.21.0 // indirect
golang.org/x/term v0.24.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240814211410-ddb44dafa142 // indirect
Expand All @@ -482,7 +483,7 @@ require (
modernc.org/libc v1.55.3 // indirect
modernc.org/mathutil v1.6.0 // indirect
modernc.org/memory v1.8.0 // indirect
modernc.org/sqlite v1.32.0 // indirect
modernc.org/sqlite v1.33.1 // indirect
modernc.org/strutil v1.2.0 // indirect
modernc.org/token v1.1.0 // indirect
nhooyr.io/websocket v1.8.11 // indirect
Expand Down
38 changes: 20 additions & 18 deletions go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

30 changes: 16 additions & 14 deletions pkg/scannerv4/mappers/mappers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ import (
"github.com/facebookincubator/nvdtools/cvss2"
"github.com/facebookincubator/nvdtools/cvss3"
"github.com/quay/claircore"
"github.com/quay/claircore/pkg/cpe"
"github.com/quay/claircore/rhel/vex"
"github.com/quay/claircore/toolkit/types/cpe"
"github.com/quay/zlog"
v4 "github.com/stackrox/rox/generated/internalapi/scanner/v4"
"github.com/stackrox/rox/generated/storage"
Expand Down Expand Up @@ -46,15 +47,18 @@ var (
// Updater patterns are used to determine the security updater the
// vulnerability was detected.

awsUpdaterPrefix = `aws-`
osvUpdaterPrefix = `osv/`
rhelUpdaterPattern = regexp.MustCompile(`^RHEL\d+-`)
awsUpdaterPrefix = `aws-`
osvUpdaterPrefix = `osv/`
// TODO(ROX-21539): Remove once scanner/updater/rhel is deleted.
rhelUpdaterPattern = regexp.MustCompile(`^RHEL\d+-`) //nolint:unused
rhelUpdaterName = (*vex.Updater)(nil).Name()

// Name patterns are regexes to match against vulnerability fields to
// extract their name according to their updater.

awsVulnNamePattern = regexp.MustCompile(`ALAS\d*-\d{4}-\d+`)
rhelVulnNamePattern = regexp.MustCompile(`(RHSA|RHBA|RHEA)-\d{4}:\d+`)
awsVulnNamePattern = regexp.MustCompile(`ALAS\d*-\d{4}-\d+`)
// TODO(ROX-21539): Remove once scanner/updater/rhel is deleted.
rhelVulnNamePattern = regexp.MustCompile(`(RHSA|RHBA|RHEA)-\d{4}:\d+`) //nolint:unused

// vulnNamePatterns is a default prioritized list of regexes to match
// vulnerability names.
Expand Down Expand Up @@ -427,7 +431,7 @@ func toDigestString(digest claircore.Digest) string {
}

func toClairCoreCPE(s string) (cpe.WFN, error) {
c, err := cpe.UnbindFS(s)
c, err := cpe.Unbind(s)
if err != nil {
return c, fmt.Errorf("%q: %s", s, strings.TrimPrefix(err.Error(), "cpe: "))
}
Expand Down Expand Up @@ -651,14 +655,13 @@ func pkgFixedBy(enrichments map[string][]json.RawMessage) (map[string]string, er
// however, the returned slice of metrics will still be populated with any successfully gathered metrics.
// It is up to the caller to ensure the returned slice is populated prior to using it.
func cvssMetrics(_ context.Context, vuln *claircore.Vulnerability, nvdVuln *nvdschema.CVEAPIJSON20CVEItem) ([]*v4.VulnerabilityReport_Vulnerability_CVSS, error) {

var metrics []*v4.VulnerabilityReport_Vulnerability_CVSS

var preferredCVSS *v4.VulnerabilityReport_Vulnerability_CVSS
var preferredErr error
switch {
case rhelUpdaterPattern.MatchString(vuln.Updater):
preferredCVSS, preferredErr = rhelCVSS(vuln)
case strings.EqualFold(vuln.Updater, rhelUpdaterName):
preferredCVSS, preferredErr = vulnCVSS(vuln, v4.VulnerabilityReport_Vulnerability_CVSS_SOURCE_RED_HAT)
case strings.HasPrefix(vuln.Updater, osvUpdaterPrefix) && !isOSVDBSpecificSeverity(vuln.Severity):
preferredCVSS, preferredErr = vulnCVSS(vuln, v4.VulnerabilityReport_Vulnerability_CVSS_SOURCE_OSV)
case strings.EqualFold(vuln.Updater, constants.ManualUpdaterName):
Expand Down Expand Up @@ -694,6 +697,9 @@ type cvssValues struct {
url string
}

// TODO(ROX-21539): Remove once scanner/updater/rhel is deleted.
//
//nolint:unused
func rhelCVSS(vuln *claircore.Vulnerability) (*v4.VulnerabilityReport_Vulnerability_CVSS, error) {
if vuln.Severity == "" {
return nil, errors.New("severity is empty")
Expand Down Expand Up @@ -882,10 +888,6 @@ func nvdCVSS(v *nvdschema.CVEAPIJSON20CVEItem) (*v4.VulnerabilityReport_Vulnerab
func vulnerabilityName(vuln *claircore.Vulnerability) string {
// Attempt per-updater patterns.
switch {
case rhelUpdaterPattern.MatchString(vuln.Updater):
if v, ok := findName(vuln, rhelVulnNamePattern); ok {
return v
}
case strings.HasPrefix(vuln.Updater, awsUpdaterPrefix):
if v, ok := findName(vuln, awsVulnNamePattern); ok {
return v
Expand Down
Loading