Skip to content

Commit 6827f2d

Browse files
authored
feat(detector/vuls2): amazon linux by vuls2 (#2441)
* feat(detector/vuls2): amazon linux by vuls2 * remove goval-dictionary related code * remove ovalDict from config and code * update integration
1 parent 14c63ea commit 6827f2d

File tree

22 files changed

+33
-1913
lines changed

22 files changed

+33
-1913
lines changed

.github/dependabot.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ updates:
4747
- "github.com/vulsio/go-kev"
4848
- "github.com/vulsio/go-msfdb"
4949
- "github.com/vulsio/gost"
50-
- "github.com/vulsio/goval-dictionary"
5150
trivy:
5251
patterns:
5352
- "github.com/aquasecurity/trivy"
@@ -65,7 +64,6 @@ updates:
6564
- "github.com/vulsio/go-kev"
6665
- "github.com/vulsio/go-msfdb"
6766
- "github.com/vulsio/gost"
68-
- "github.com/vulsio/goval-dictionary"
6967
- "github.com/aquasecurity/trivy"
7068
- "github.com/aquasecurity/trivy-db"
7169
- "github.com/aquasecurity/trivy-java-db"

config/config.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ type Config struct {
3939

4040
// report
4141
CveDict GoCveDictConf `json:"cveDict,omitzero"`
42-
OvalDict GovalDictConf `json:"ovalDict,omitzero"`
4342
Gost GostConf `json:"gost,omitzero"`
4443
Exploit ExploitConf `json:"exploit,omitzero"`
4544
Metasploit MetasploitConf `json:"metasploit,omitzero"`
@@ -190,7 +189,6 @@ func (c *Config) ValidateOnReport() bool {
190189

191190
for _, cnf := range []VulnDictInterface{
192191
&Conf.CveDict,
193-
&Conf.OvalDict,
194192
&Conf.Gost,
195193
&Conf.Exploit,
196194
&Conf.Metasploit,

config/tomlloader.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ func (c TOMLLoader) Load(pathToToml string) error {
3939

4040
for _, cnf := range []VulnDictInterface{
4141
&Conf.CveDict,
42-
&Conf.OvalDict,
4342
&Conf.Gost,
4443
&Conf.Exploit,
4544
&Conf.Metasploit,

config/vulnDictConf.go

Lines changed: 0 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -146,33 +146,6 @@ func (cnf VulnDict) CheckHTTPHealth() error {
146146
return nil
147147
}
148148

149-
// GovalDictConf is goval-dictionary config
150-
type GovalDictConf struct {
151-
VulnDict
152-
}
153-
154-
const govalType = "OVALDB_TYPE"
155-
const govalURL = "OVALDB_URL"
156-
const govalPATH = "OVALDB_SQLITE3_PATH"
157-
158-
// Init set options with the following priority.
159-
// 1. Environment variable
160-
// 2. config.toml
161-
func (cnf *GovalDictConf) Init() {
162-
cnf.Name = "ovalDict"
163-
if os.Getenv(govalType) != "" {
164-
cnf.Type = os.Getenv(govalType)
165-
}
166-
if os.Getenv(govalURL) != "" {
167-
cnf.URL = os.Getenv(govalURL)
168-
}
169-
if os.Getenv(govalPATH) != "" {
170-
cnf.SQLite3Path = os.Getenv(govalPATH)
171-
}
172-
cnf.setDefault("oval.sqlite3")
173-
cnf.DebugSQL = Conf.DebugSQL
174-
}
175-
176149
// ExploitConf is exploit config
177150
type ExploitConf struct {
178151
VulnDict

detector/detector.go

Lines changed: 8 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ import (
2020
"github.com/future-architect/vuls/gost"
2121
"github.com/future-architect/vuls/logging"
2222
"github.com/future-architect/vuls/models"
23-
"github.com/future-architect/vuls/oval"
2423
"github.com/future-architect/vuls/reporter"
2524
"github.com/future-architect/vuls/util"
2625
cvemodels "github.com/vulsio/go-cve-dictionary/models"
@@ -51,7 +50,7 @@ func Detect(rs []models.ScanResult, dir string) ([]models.ScanResult, error) {
5150
return nil, xerrors.Errorf("Failed to fill with Library dependency: %w", err)
5251
}
5352

54-
if err := DetectPkgCves(&r, config.Conf.OvalDict, config.Conf.Gost, config.Conf.Vuls2, config.Conf.LogOpts, config.Conf.NoProgress); err != nil {
53+
if err := DetectPkgCves(&r, config.Conf.Gost, config.Conf.Vuls2, config.Conf.LogOpts, config.Conf.NoProgress); err != nil {
5554
return nil, xerrors.Errorf("Failed to detect Pkg CVE: %w", err)
5655
}
5756

@@ -318,19 +317,14 @@ func Detect(rs []models.ScanResult, dir string) ([]models.ScanResult, error) {
318317
}
319318

320319
// DetectPkgCves detects OS pkg cves
321-
// pass 3 configs
322-
func DetectPkgCves(r *models.ScanResult, ovalCnf config.GovalDictConf, gostCnf config.GostConf, vuls2Conf config.Vuls2Conf, logOpts logging.LogOpts, noProgress bool) error {
320+
func DetectPkgCves(r *models.ScanResult, gostCnf config.GostConf, vuls2Conf config.Vuls2Conf, logOpts logging.LogOpts, noProgress bool) error {
323321
if isPkgCvesDetactable(r) {
324322
switch r.Family {
325-
case constant.RedHat, constant.CentOS, constant.Fedora, constant.Alma, constant.Rocky, constant.Oracle, constant.Alpine, constant.Ubuntu,
323+
case constant.RedHat, constant.CentOS, constant.Fedora, constant.Alma, constant.Rocky, constant.Oracle, constant.Alpine, constant.Amazon, constant.Ubuntu,
326324
constant.OpenSUSE, constant.OpenSUSELeap, constant.SUSEEnterpriseServer, constant.SUSEEnterpriseDesktop:
327325
if err := vuls2.Detect(r, vuls2Conf, noProgress); err != nil {
328326
return xerrors.Errorf("Failed to detect CVE with Vuls2: %w", err)
329327
}
330-
case constant.Amazon:
331-
if err := detectPkgsCvesWithOval(ovalCnf, r, logOpts); err != nil {
332-
return xerrors.Errorf("Failed to detect CVE with OVAL: %w", err)
333-
}
334328
case constant.Debian, constant.Raspbian, constant.Windows:
335329
// gost(Debian Security Tracker) does not support Package for Raspbian, so skip it.
336330
if r.Family == constant.Raspbian {
@@ -375,27 +369,27 @@ func DetectPkgCves(r *models.ScanResult, ovalCnf config.GovalDictConf, gostCnf c
375369
return nil
376370
}
377371

378-
// isPkgCvesDetactable checks whether CVEs is detactable with gost and oval from the result
372+
// isPkgCvesDetactable checks whether CVEs is detactable with gost and vuls2 from the result
379373
func isPkgCvesDetactable(r *models.ScanResult) bool {
380374
switch r.Family {
381375
case constant.FreeBSD, constant.MacOSX, constant.MacOSXServer, constant.MacOS, constant.MacOSServer, constant.ServerTypePseudo:
382-
logging.Log.Infof("%s type. Skip OVAL, gost and vuls2 detection", r.Family)
376+
logging.Log.Infof("%s type. Skip gost and vuls2 detection", r.Family)
383377
return false
384378
case constant.Windows:
385379
return true
386380
default:
387381
if r.ScannedVia == "trivy" {
388-
logging.Log.Infof("r.ScannedVia is trivy. Skip OVAL, gost and vuls2 detection")
382+
logging.Log.Infof("r.ScannedVia is trivy. Skip gost and vuls2 detection")
389383
return false
390384
}
391385

392386
if r.Release == "" {
393-
logging.Log.Infof("r.Release is empty. Skip OVAL, gost and vuls2 detection")
387+
logging.Log.Infof("r.Release is empty. Skip gost and vuls2 detection")
394388
return false
395389
}
396390

397391
if len(r.Packages)+len(r.SrcPackages) == 0 {
398-
logging.Log.Infof("Number of packages is 0. Skip OVAL, gost and vuls2 detection")
392+
logging.Log.Infof("Number of packages is 0. Skip gost and vuls2 detection")
399393
return false
400394
}
401395
return true
@@ -538,43 +532,6 @@ func fillCertAlerts(cvedetail *cvemodels.CveDetail) (dict models.AlertDict) {
538532
return dict
539533
}
540534

541-
func detectPkgsCvesWithOval(cnf config.GovalDictConf, r *models.ScanResult, logOpts logging.LogOpts) error {
542-
client, err := oval.NewOVALClient(r.Family, cnf, logOpts)
543-
if err != nil {
544-
return xerrors.Errorf("Failed to new OVAL client. err: %w", err)
545-
}
546-
defer func() {
547-
if err := client.CloseDB(); err != nil {
548-
logging.Log.Errorf("Failed to close the OVAL DB. err: %+v", err)
549-
}
550-
}()
551-
552-
logging.Log.Debugf("Check if oval fetched: %s %s", r.Family, r.Release)
553-
ok, err := client.CheckIfOvalFetched(r.Family, r.Release)
554-
if err != nil {
555-
return xerrors.Errorf("Failed to check if oval fetched: %w", err)
556-
}
557-
if !ok {
558-
return xerrors.Errorf("OVAL entries of %s %s are not found. Fetch OVAL before reporting. For details, see `https://github.com/vulsio/goval-dictionary#usage`", r.Family, r.Release)
559-
}
560-
561-
logging.Log.Debugf("Check if oval fresh: %s %s", r.Family, r.Release)
562-
_, err = client.CheckIfOvalFresh(r.Family, r.Release)
563-
if err != nil {
564-
return xerrors.Errorf("Failed to check if oval fresh: %w", err)
565-
}
566-
567-
logging.Log.Debugf("Fill with oval: %s %s", r.Family, r.Release)
568-
nCVEs, err := client.FillWithOval(r)
569-
if err != nil {
570-
return xerrors.Errorf("Failed to fill with oval: %w", err)
571-
}
572-
573-
logging.Log.Infof("%s: %d CVEs are detected with OVAL", r.FormatServerName(), nCVEs)
574-
575-
return nil
576-
}
577-
578535
func detectPkgsCvesWithGost(cnf config.GostConf, r *models.ScanResult, logOpts logging.LogOpts) error {
579536
client, err := gost.NewGostClient(cnf, r.Family, logOpts)
580537
if err != nil {

detector/util.go

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ import (
1717
"github.com/future-architect/vuls/gost"
1818
"github.com/future-architect/vuls/logging"
1919
"github.com/future-architect/vuls/models"
20-
"github.com/future-architect/vuls/oval"
2120
"golang.org/x/xerrors"
2221
)
2322

@@ -264,7 +263,7 @@ func loadOneServerScanResult(jsonFile string) (*models.ScanResult, error) {
264263
}
265264

266265
// ValidateDBs checks if the databases are accessible and can be closed properly
267-
func ValidateDBs(cveConf config.GoCveDictConf, ovalConf config.GovalDictConf, gostConf config.GostConf, exploitConf config.ExploitConf, metasploitConf config.MetasploitConf, kevulnConf config.KEVulnConf, ctiConf config.CtiConf, logOpts logging.LogOpts) error {
266+
func ValidateDBs(cveConf config.GoCveDictConf, gostConf config.GostConf, exploitConf config.ExploitConf, metasploitConf config.MetasploitConf, kevulnConf config.KEVulnConf, ctiConf config.CtiConf, logOpts logging.LogOpts) error {
268267
cvec, err := newGoCveDictClient(&cveConf, logOpts)
269268
if err != nil {
270269
return xerrors.Errorf("Failed to new CVE client. err: %w", err)
@@ -273,14 +272,6 @@ func ValidateDBs(cveConf config.GoCveDictConf, ovalConf config.GovalDictConf, go
273272
return xerrors.Errorf("Failed to close CVE DB. err: %w", err)
274273
}
275274

276-
ovalc, err := oval.NewOVALClient(constant.ServerTypePseudo, ovalConf, logOpts)
277-
if err != nil {
278-
return xerrors.Errorf("Failed to new OVAL client. err: %w", err)
279-
}
280-
if err := ovalc.CloseDB(); err != nil {
281-
return xerrors.Errorf("Failed to close OVAL DB. err: %w", err)
282-
}
283-
284275
gostc, err := gost.NewGostClient(gostConf, constant.ServerTypePseudo, logOpts)
285276
if err != nil {
286277
return xerrors.Errorf("Failed to new gost client. err: %w", err)

detector/vuls2/vendor.go

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -498,6 +498,23 @@ func advisoryReference(e ecosystemTypes.Ecosystem, s sourceTypes.SourceID, da mo
498498
Source: "SUSE",
499499
RefID: da.AdvisoryID,
500500
}, nil
501+
case ecosystemTypes.EcosystemTypeAmazon:
502+
return models.Reference{
503+
Link: func() string {
504+
switch {
505+
case strings.HasPrefix(da.AdvisoryID, "ALAS2023"):
506+
return fmt.Sprintf("https://alas.aws.amazon.com/AL2023/ALAS%s.html", strings.TrimPrefix(da.AdvisoryID, "ALAS2023"))
507+
case strings.HasPrefix(da.AdvisoryID, "ALAS2022"):
508+
return fmt.Sprintf("https://alas.aws.amazon.com/AL2022/ALAS%s.html", strings.TrimPrefix(da.AdvisoryID, "ALAS2022"))
509+
case strings.HasPrefix(da.AdvisoryID, "ALAS2"):
510+
return fmt.Sprintf("https://alas.aws.amazon.com/AL2/ALAS%s.html", strings.TrimPrefix(da.AdvisoryID, "ALAS2"))
511+
default:
512+
return fmt.Sprintf("https://alas.aws.amazon.com/ALAS%s.html", strings.TrimPrefix(da.AdvisoryID, "ALAS"))
513+
}
514+
}(),
515+
Source: "AMAZON",
516+
RefID: da.AdvisoryID,
517+
}, nil
501518
default:
502519
return models.Reference{}, xerrors.Errorf("unsupported family: %s", et)
503520
}
@@ -511,6 +528,8 @@ func cveContentSourceLink(ccType models.CveContentType, v vulnerabilityTypes.Vul
511528
return fmt.Sprintf("https://linux.oracle.com/cve/%s.html", v.Content.ID)
512529
case models.Alpine:
513530
return fmt.Sprintf("https://security.alpinelinux.org/vuln/%s", v.Content.ID)
531+
case models.Amazon:
532+
return fmt.Sprintf("https://explore.alas.aws.amazon.com/%s.html", v.Content.ID)
514533
case models.Ubuntu, models.UbuntuAPI:
515534
return fmt.Sprintf("https://ubuntu.com/security/%s", v.Content.ID)
516535
case models.Nvd:
@@ -846,7 +865,7 @@ func toVuls0Confidence(e ecosystemTypes.Ecosystem, s sourceTypes.SourceID) model
846865
DetectionMethod: models.DetectionMethod("EPELMatch"),
847866
SortOrder: 1,
848867
}
849-
case ecosystemTypes.EcosystemTypeRedHat, ecosystemTypes.EcosystemTypeFedora, ecosystemTypes.EcosystemTypeAlma, ecosystemTypes.EcosystemTypeRocky, ecosystemTypes.EcosystemTypeOracle, ecosystemTypes.EcosystemTypeAlpine,
868+
case ecosystemTypes.EcosystemTypeRedHat, ecosystemTypes.EcosystemTypeFedora, ecosystemTypes.EcosystemTypeAlma, ecosystemTypes.EcosystemTypeRocky, ecosystemTypes.EcosystemTypeOracle, ecosystemTypes.EcosystemTypeAlpine, ecosystemTypes.EcosystemTypeAmazon,
850869
ecosystemTypes.EcosystemTypeSUSELinuxEnterprise, ecosystemTypes.EcosystemTypeOpenSUSE, ecosystemTypes.EcosystemTypeOpenSUSELeap, ecosystemTypes.EcosystemTypeOpenSUSETumbleweed:
851870
return models.OvalMatch
852871
case ecosystemTypes.EcosystemTypeUbuntu:

go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,6 @@ require (
5757
github.com/vulsio/go-kev v0.4.4
5858
github.com/vulsio/go-msfdb v0.4.4
5959
github.com/vulsio/gost v0.7.2
60-
github.com/vulsio/goval-dictionary v0.15.1
6160
go.etcd.io/bbolt v1.4.3
6261
golang.org/x/oauth2 v0.35.0
6362
golang.org/x/sync v0.19.0
@@ -233,6 +232,7 @@ require (
233232
github.com/jmoiron/sqlx v1.4.0 // indirect
234233
github.com/json-iterator/go v1.1.12 // indirect
235234
github.com/jtolds/gls v4.20.0+incompatible // indirect
235+
github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88 // indirect
236236
github.com/kevinburke/ssh_config v1.4.0 // indirect
237237
github.com/klauspost/compress v1.18.4 // indirect
238238
github.com/klauspost/cpuid/v2 v2.3.0 // indirect

go.sum

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -898,8 +898,6 @@ github.com/vulsio/go-msfdb v0.4.4 h1:fcuuRuNwnUU1Z9ISBinWrbkWFPJrHluuNcUOpF9GkUM
898898
github.com/vulsio/go-msfdb v0.4.4/go.mod h1:9EOtT+xusFgeNG11D6EKpsM2Fijs7YhTxW3iBD5RDoQ=
899899
github.com/vulsio/gost v0.7.2 h1:COYQ7Y8mi+YK1CDdRyaXgwocP7ZrnCNkJ8jxFe1roPE=
900900
github.com/vulsio/gost v0.7.2/go.mod h1:DswLTXFo0CUQie9aI1JKhrJTbWM4jgEhmEHALsSKyTs=
901-
github.com/vulsio/goval-dictionary v0.15.1 h1:FgEp3LWeOJZ/UxSGUDhFGdd5CVDN1mRu9SvSscpk2IE=
902-
github.com/vulsio/goval-dictionary v0.15.1/go.mod h1:qAHEBdYTFqdAMyc49ZRlJANN3dmTa4m66Ao0hl94hkA=
903901
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
904902
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
905903
github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=

0 commit comments

Comments
 (0)