Skip to content

Commit 365b5e6

Browse files
sajal-wrsajal-wr
committed
feat(wrlinux): Add Wind River Linux vulnerability data (#177)
Signed-off-by: Sakib Sajal <[email protected]>
1 parent 1a6f713 commit 365b5e6

10 files changed

+626
-2
lines changed

‎.github/workflows/update.yml

+4
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ jobs:
9999
name: CBL-Mariner Vulnerability Data
100100
run: ./vuln-list-update -target mariner
101101

102+
- if: always()
103+
name: WindRiver CVE Tracker
104+
run: ./vuln-list-update -target wrlinux
105+
102106
- if: always()
103107
name: OSV Database
104108
run: ./vuln-list-update -target osv

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ https://github.com/aquasecurity/vuln-list/
2020
$ vuln-list-update -h
2121
Usage of vuln-list-update:
2222
-target string
23-
update target (nvd, alpine, alpine-unfixed, redhat, redhat-oval, debian, debian-oval, ubuntu, amazon, oracle-oval, suse-cvrf, photon, arch-linux, ghsa, glad, cwe, osv, go-vulndb, mariner, kevc)
23+
update target (nvd, alpine, alpine-unfixed, redhat, redhat-oval, debian, debian-oval, ubuntu, amazon, oracle-oval, suse-cvrf, photon, arch-linux, ghsa, glad, cwe, osv, go-vulndb, mariner, kevc, wrlinux)
2424
-years string
2525
update years (only redhat)
2626
```

‎main.go

+7-1
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ import (
3939
susecvrf "github.com/aquasecurity/vuln-list-update/suse/cvrf"
4040
"github.com/aquasecurity/vuln-list-update/ubuntu"
4141
"github.com/aquasecurity/vuln-list-update/utils"
42+
"github.com/aquasecurity/vuln-list-update/wrlinux"
4243
)
4344

4445
const (
@@ -49,7 +50,7 @@ const (
4950

5051
var (
5152
target = flag.String("target", "", "update target (nvd, alpine, alpine-unfixed, redhat, redhat-oval, "+
52-
"debian, debian-oval, ubuntu, amazon, oracle-oval, suse-cvrf, photon, arch-linux, ghsa, glad, cwe, osv, go-vulndb, mariner, kevc, wolfi)")
53+
"debian, debian-oval, ubuntu, amazon, oracle-oval, suse-cvrf, photon, arch-linux, ghsa, glad, cwe, osv, go-vulndb, mariner, kevc, wolfi, wrlinux)")
5354
years = flag.String("years", "", "update years (only redhat)")
5455
targetUri = flag.String("target-uri", "", "alternative repository URI (only glad)")
5556
targetBranch = flag.String("target-branch", "", "alternative repository branch (only glad)")
@@ -235,6 +236,11 @@ func run() error {
235236
return xerrors.Errorf("Wolfi update error: %w", err)
236237
}
237238
commitMsg = "Wolfi Issue Tracker"
239+
case "wrlinux":
240+
if err := wrlinux.Update(); err != nil {
241+
return xerrors.Errorf("WRLinux update error: %w", err)
242+
}
243+
commitMsg = "Wind River CVE Tracker"
238244
default:
239245
return xerrors.New("unknown target")
240246
}

‎wrlinux/testdata/multiple_multiline_note

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
Candidate: CVE-2012-0880
2+
PublicDate: 2017-08-08
3+
Description:
4+
Apache Xerces-C++ allows remote attackers to cause a denial of
5+
service (CPU consumption) via a crafted message sent to an XML
6+
service that causes hash table collisions.
7+
Notes:
8+
note 1 line 1
9+
note 1 line 2
10+
note 2 line 1
11+
note 2 line 2
12+
Priority: high
13+
Bugs:
14+
LIN10-1106
15+
16+
Patches_xerces:
17+
10.17.41.1_xerces: released (10.17.41.1)
18+
10.18.44.1_xerces: ignored (will not fix)
19+
10.19.45.1_xerces: ignored (will not fix)

‎wrlinux/testdata/multiple_packages

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
Candidate: CVE-2015-8985
2+
PublicDate: 2017-03-20
3+
Description:
4+
The pop_fail_stack function in the GNU C Library (aka glibc or
5+
libc6) allows context-dependent attackers to cause a denial of
6+
service (assertion failure and application crash) via vectors
7+
related to extended regular expression processing.
8+
Notes:
9+
glibc
10+
Priority: medium
11+
Bugs:
12+
13+
Patches_glibc:
14+
10.18.44.1_glibc: pending
15+
10.19.45.1_glibc: pending
16+
17+
Patches_eglibc:
18+
10.18.44.1_eglibc: pending
19+
10.19.45.1_eglibc: pending

‎wrlinux/testdata/multiple_references_and_notes

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
Candidate: CVE-2021-39648
2+
PublicDate: 2021-12-15
3+
Description:
4+
In gadget_dev_desc_UDC_show of configfs.c, there is a possible
5+
disclosure of kernel heap memory due to a race condition.
6+
References:
7+
Upstream kernel
8+
Upstream linux
9+
Notes:
10+
This could lead to local information disclosure with System execution privileges needed.
11+
User interaction is not needed for exploitation.
12+
Priority: medium
13+
Bugs:
14+
LINCD-7525
15+
LIN1021-2165
16+
LIN1019-7478
17+
LIN1018-8466
18+
Patches_linux:
19+
10.20.6.0_linux: not-affected
20+
10.21.20.1_linux: not-affected
21+
10.19.45.1_linux: released (10.19.45.21)
22+
10.18.44.1_linux: released (10.18.44.25)

‎wrlinux/testdata/no_references_or_notes

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
Candidate: CVE-2020-24241
2+
PublicDate: 2020-08-25
3+
Description:
4+
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free
5+
in saa_wbytes in nasmlib/saa.c.
6+
Priority: medium
7+
Bugs:
8+
LINCD-2974
9+
LIN1019-5289
10+
LIN1018-6614
11+
LIN10-7689
12+
13+
Patches_nasm:
14+
10.20.6.0_nasm: not-affected
15+
10.19.45.1_nasm: pending
16+
10.18.44.1_nasm: ignored
17+
10.17.41.1_nasm: released (10.17.41.22)

‎wrlinux/testdata/with_comments_and_line_breaks

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
Candidate: CVE-2022-3134
2+
3+
PublicDate: 2022-09-06
4+
5+
Description:
6+
Use After Free in GitHub repository vim/vim prior to 9.0.0389.
7+
8+
Notes:
9+
10+
Priority: high
11+
12+
Bugs:
13+
LINCD-10301
14+
LIN1022-1711
15+
LIN1021-4364
16+
LIN1019-8796
17+
LIN1018-9727
18+
19+
# fixes/patches for different WRLinux releases
20+
# <vulnerable_release>_<package>: <status> [(<fixed_release>)]
21+
Patches_vim:
22+
10.20.6.0_vim: not-affected
23+
10.22.33.1_vim: not-affected
24+
# the following have releases have been fixed
25+
10.21.20.1_vim: released (10.21.20.14)
26+
10.19.45.1_vim: released (10.19.45.26)
27+
28+
10.18.44.1_vim: released (10.18.44.28)

0 commit comments

Comments
 (0)