Skip to content

Commit 6322aea

Browse files
sbs2001sbs2001
committed
Refactor ubuntu
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
1 parent bacb25e commit 6322aea

2 files changed

Lines changed: 89 additions & 101 deletions

File tree

‎vulnerabilities/data_source.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -565,7 +565,7 @@ def get_data_from_xml_doc(self, xml_doc: ET.ElementTree, pkg_metadata={}) -> Lis
565565
pkg_version=version,
566566
pkg_data=pkg_metadata,
567567
)
568-
if version in affected_version_range:
568+
if version_class(version) in affected_version_range:
569569
affected_purls.append(purl)
570570
else:
571571
safe_purls.append(purl)

‎vulnerabilities/tests/test_ubuntu.py‎

Lines changed: 88 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
from vulnerabilities.importers.ubuntu import UbuntuDataSource
1313
from vulnerabilities.data_source import Advisory
1414
from vulnerabilities.data_source import Reference
15+
from vulnerabilities.helpers import AffectedPackageWithPatchedPackage
1516

1617

1718
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
@@ -187,114 +188,101 @@ def setUpClass(cls):
187188
def test_get_data_from_xml_doc(self, mock_write):
188189
expected_advisories = [
189190
Advisory(
190-
summary=(
191-
"Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had "
192-
"internal functions that were entitled to expect that buf_t data had "
193-
"NUL termination, but the implementation of or/buffers.c did not "
194-
"ensure that NUL termination was present, which allows remote "
195-
"attackers to cause a denial of service (client, hidden "
196-
"service, relay, or authority crash) via crafted data."
197-
),
198-
impacted_package_urls={
199-
PackageURL(
200-
type="deb",
201-
namespace=None,
202-
name="tor",
203-
version="0.2.0",
204-
qualifiers=OrderedDict(),
205-
subpath=None,
206-
)
207-
},
208-
resolved_package_urls={
209-
PackageURL(
210-
type="deb",
211-
namespace=None,
212-
name="tor",
213-
version="0.3.0",
214-
qualifiers=OrderedDict(),
215-
subpath=None,
216-
),
217-
PackageURL(
218-
type="deb",
219-
namespace=None,
220-
name="tor",
221-
version="2.14-2",
222-
qualifiers=OrderedDict(),
223-
subpath=None,
224-
),
225-
},
226-
references=sorted(
227-
[
228-
Reference(url="http://www.openwall.com/lists/oss-security/2016/10/18/11"),
229-
Reference(
230-
url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8860"
191+
summary="Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8702.",
192+
vulnerability_id="CVE-2016-8703",
193+
affected_packages_with_patched_package=[
194+
AffectedPackageWithPatchedPackage(
195+
vulnerable_package=PackageURL(
196+
type="deb",
197+
name="potrace",
198+
version="0.2.0",
231199
),
232-
Reference(
233-
url="http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8860.html"
200+
patched_package=PackageURL(
201+
type="deb",
202+
name="potrace",
203+
version="2.14-2",
234204
),
235-
Reference(
236-
url="https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce"
205+
),
206+
AffectedPackageWithPatchedPackage(
207+
vulnerable_package=PackageURL(
208+
type="deb",
209+
name="potrace",
210+
version="0.3.0",
237211
),
238-
Reference(
239-
url="https://blog.torproject.org/blog/tor-0289-released-important-fixes"
212+
patched_package=PackageURL(
213+
type="deb",
214+
name="potrace",
215+
version="2.14-2",
240216
),
241-
Reference(url="https://trac.torproject.org/projects/tor/ticket/20384"),
242-
],
243-
key=lambda x: x.url,
244-
),
245-
vulnerability_id="CVE-2016-8860",
246-
),
247-
Advisory(
248-
summary=(
249-
"Heap-based buffer overflow in the bm_readbody_bmp function"
250-
" in bitmap_io.c in potrace before 1.13 allows remote attackers to "
251-
"have unspecified impact via a crafted BMP image, a different "
252-
"vulnerability than CVE-2016-8698, CVE-2016-8699, "
253-
"CVE-2016-8700, CVE-2016-8701, and CVE-2016-8702."
254-
),
255-
impacted_package_urls={
256-
PackageURL(
257-
type="deb",
258-
namespace=None,
259-
name="potrace",
260-
version="0.3.0",
261-
qualifiers=OrderedDict(),
262-
subpath=None,
263217
),
264-
PackageURL(
265-
type="deb",
266-
namespace=None,
267-
name="potrace",
268-
version="0.2.0",
269-
qualifiers=OrderedDict(),
270-
subpath=None,
218+
],
219+
references=[
220+
Reference(
221+
reference_id="",
222+
url="http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8703.html",
223+
severities=[],
271224
),
272-
},
273-
resolved_package_urls={
274-
PackageURL(
275-
type="deb",
276-
namespace=None,
277-
name="potrace",
278-
version="2.14-2",
279-
qualifiers=OrderedDict(),
280-
subpath=None,
281-
)
282-
},
283-
references=sorted(
284-
[
285-
Reference(
286-
url="http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8703.html"
287-
),
288-
Reference(
289-
url="https://blogs.gentoo.org/ago/2016/08/08/potrace-multiplesix-heap-based-buffer-overflow-in-bm_readbody_bmp-bitmap_io-c/"
225+
Reference(
226+
reference_id="",
227+
url="https://blogs.gentoo.org/ago/2016/08/08/potrace-multiplesix-heap-based-buffer-overflow-in-bm_readbody_bmp-bitmap_io-c/",
228+
severities=[],
229+
),
230+
Reference(
231+
reference_id="",
232+
url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8703",
233+
severities=[],
234+
),
235+
],
236+
),
237+
Advisory(
238+
summary="Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.",
239+
vulnerability_id="CVE-2016-8860",
240+
affected_packages_with_patched_package=[
241+
AffectedPackageWithPatchedPackage(
242+
vulnerable_package=PackageURL(
243+
type="deb",
244+
name="tor",
245+
version="0.2.0",
290246
),
291-
Reference(
292-
url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8703"
247+
patched_package=PackageURL(
248+
type="deb",
249+
name="tor",
250+
version="0.3.0",
293251
),
294-
],
295-
key=lambda x: x.url,
296-
),
297-
vulnerability_id="CVE-2016-8703",
252+
)
253+
],
254+
references=[
255+
Reference(
256+
reference_id="",
257+
url="http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8860.html",
258+
severities=[],
259+
),
260+
Reference(
261+
reference_id="",
262+
url="http://www.openwall.com/lists/oss-security/2016/10/18/11",
263+
severities=[],
264+
),
265+
Reference(
266+
reference_id="",
267+
url="https://blog.torproject.org/blog/tor-0289-released-important-fixes",
268+
severities=[],
269+
),
270+
Reference(
271+
reference_id="",
272+
url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8860",
273+
severities=[],
274+
),
275+
Reference(
276+
reference_id="",
277+
url="https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce",
278+
severities=[],
279+
),
280+
Reference(
281+
reference_id="",
282+
url="https://trac.torproject.org/projects/tor/ticket/20384",
283+
severities=[],
284+
),
285+
],
298286
),
299287
]
300288

0 commit comments

Comments
 (0)