Skip to content

Commit a3e98c2

Browse files
authored
Merge pull request #336 from tushar912/istio
Add istio importer and tests
2 parents d8ce30e + 72e461c commit a3e98c2

5 files changed

Lines changed: 449 additions & 14 deletions

File tree

vulnerabilities/importer_yielder.py

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -102,10 +102,7 @@
102102
"license": "",
103103
"last_run": None,
104104
"data_source": "SUSEBackportsDataSource",
105-
"data_source_cfg": {
106-
"url": "http://ftp.suse.com/pub/projects/security/yaml/",
107-
"etags": {},
108-
},
105+
"data_source_cfg": {"url": "http://ftp.suse.com/pub/projects/security/yaml/", "etags": {}},
109106
},
110107
{
111108
"name": "suse_scores",
@@ -119,10 +116,7 @@
119116
"license": "",
120117
"last_run": None,
121118
"data_source": "DebianOvalDataSource",
122-
"data_source_cfg": {
123-
"etags": {},
124-
"releases": ["wheezy", "stretch", "jessie", "buster"],
125-
},
119+
"data_source_cfg": {"etags": {}, "releases": ["wheezy", "stretch", "jessie", "buster"]},
126120
},
127121
{
128122
"name": "redhat",
@@ -136,9 +130,7 @@
136130
"license": "",
137131
"last_run": None,
138132
"data_source": "NVDDataSource",
139-
"data_source_cfg": {
140-
"etags": {},
141-
},
133+
"data_source_cfg": {"etags": {}},
142134
},
143135
{
144136
"name": "gentoo",
@@ -235,16 +227,21 @@
235227
"data_source": "ApacheKafkaDataSource",
236228
"data_source_cfg": {},
237229
},
230+
{
231+
"name": "istio",
232+
"license": "apache-2.0",
233+
"last_run": None,
234+
"data_source": "IstioDataSource",
235+
"data_source_cfg": {"repository_url": "https://github.com/istio/istio.io"},
236+
},
238237
]
239238

240239

241240
def load_importers():
242241

243242
for importer in IMPORTER_REGISTRY:
244243
imp, created = Importer.objects.get_or_create(
245-
name=importer["name"],
246-
data_source=importer["data_source"],
247-
license=importer["license"],
244+
name=importer["name"], data_source=importer["data_source"], license=importer["license"]
248245
)
249246

250247
if created:

vulnerabilities/importers/__init__.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,4 @@
4848
from vulnerabilities.importers.ubuntu import UbuntuDataSource
4949
from vulnerabilities.importers.ubuntu_usn import UbuntuUSNDataSource
5050
from vulnerabilities.importers.apache_tomcat import ApacheTomcatDataSource
51+
from vulnerabilities.importers.istio import IstioDataSource

vulnerabilities/importers/istio.py

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
# Copyright (c) nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software tool from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
import asyncio
24+
import re
25+
from typing import List, Set
26+
27+
import yaml
28+
29+
from dephell_specifier import RangeSpecifier
30+
from packageurl import PackageURL
31+
from vulnerabilities.data_source import Advisory, GitDataSource, Reference
32+
from vulnerabilities.package_managers import GitHubTagsAPI
33+
34+
35+
class IstioDataSource(GitDataSource):
36+
def __enter__(self):
37+
super(IstioDataSource, self).__enter__()
38+
39+
if not getattr(self, "_added_files", None):
40+
self._added_files, self._updated_files = self.file_changes(
41+
recursive=True, file_ext="md", subdir="./content/en/news/security"
42+
)
43+
self.version_api = GitHubTagsAPI()
44+
self.set_api()
45+
46+
def set_api(self):
47+
asyncio.run(self.version_api.load_api(["istio/istio"]))
48+
49+
def updated_advisories(self) -> Set[Advisory]:
50+
files = self._updated_files
51+
advisories = []
52+
for f in files:
53+
processed_data = self.process_file(f)
54+
if processed_data:
55+
advisories.extend(processed_data)
56+
return self.batch_advisories(advisories)
57+
58+
def get_pkg_versions_from_ranges(self, version_range_list):
59+
"""Takes a list of version ranges(affected) of a package
60+
as parameter and returns a tuple of safe package versions and
61+
vulnerable package versions"""
62+
all_version = self.version_api.get("istio/istio")
63+
safe_pkg_versions = []
64+
vuln_pkg_versions = []
65+
version_ranges = [RangeSpecifier(r) for r in version_range_list]
66+
for version in all_version:
67+
if any([version in v for v in version_ranges]):
68+
vuln_pkg_versions.append(version)
69+
70+
safe_pkg_versions = set(all_version) - set(vuln_pkg_versions)
71+
return safe_pkg_versions, vuln_pkg_versions
72+
73+
def get_data_from_yaml_lines(self, yaml_lines):
74+
"""Return a mapping of data from a iterable of yaml_lines
75+
for example :
76+
['title: ISTIO-SECURITY-2019-001',
77+
'description: Incorrect access control.','cves: [CVE-2019-12243]']
78+
79+
would give {'title':'ISTIO-SECURITY-2019-001',
80+
'description': 'Incorrect access control.',
81+
'cves': '[CVE-2019-12243]'}
82+
"""
83+
84+
return yaml.safe_load("\n".join(yaml_lines))
85+
86+
def get_yaml_lines(self, lines):
87+
"""The istio advisory file contains lines similar to yaml format .
88+
This function extracts those lines and return an iterable of lines
89+
90+
for example :
91+
lines =
92+
---
93+
title: ISTIO-SECURITY-2019-001
94+
description: Incorrect access control.
95+
cves: [CVE-2019-12243]
96+
---
97+
98+
get_yaml_lines(lines) would return
99+
['title: ISTIO-SECURITY-2019-001','description: Incorrect access control.'
100+
,'cves: [CVE-2019-12243]']
101+
"""
102+
103+
for index, line in enumerate(lines):
104+
line = line.strip()
105+
if line.startswith("---") and index == 0:
106+
continue
107+
elif line.endswith("---"):
108+
break
109+
else:
110+
yield line
111+
112+
def process_file(self, path):
113+
114+
advisories = []
115+
116+
data = self.get_data_from_md(path)
117+
118+
releases = []
119+
if data.get("releases"):
120+
for release in data["releases"]:
121+
# If it is of form "All versions prior to x"
122+
if "All releases" in release:
123+
release = release.strip()
124+
release = release.split(" ")
125+
releases.append("<" + release[4])
126+
# If it is of form "a to b"
127+
elif "to" in release:
128+
release = release.strip()
129+
release = release.split(" ")
130+
lbound = ">=" + release[0]
131+
ubound = "<=" + release[2]
132+
releases.append(lbound + "," + ubound)
133+
# If it is a single release
134+
elif is_release(release):
135+
releases.append(release)
136+
137+
data["release_ranges"] = releases
138+
139+
if not data.get("cves"):
140+
data["cves"] = [""]
141+
142+
for cve_id in data["cves"]:
143+
144+
if not cve_id.startswith("CVE"):
145+
cve_id = ""
146+
147+
safe_pkg_versions = []
148+
vuln_pkg_versions = []
149+
150+
if not data.get("release_ranges"):
151+
data["release_ranges"] = []
152+
153+
safe_pkg_versions, vuln_pkg_versions = self.get_pkg_versions_from_ranges(
154+
data["release_ranges"]
155+
)
156+
157+
safe_purls_golang = {
158+
PackageURL(type="golang", name="istio", version=version)
159+
for version in safe_pkg_versions
160+
}
161+
162+
safe_purls_github = {
163+
PackageURL(type="github", name="istio", version=version)
164+
for version in safe_pkg_versions
165+
}
166+
safe_purls = safe_purls_github.union(safe_purls_golang)
167+
168+
vuln_purls_golang = {
169+
PackageURL(type="golang", name="istio", version=version)
170+
for version in vuln_pkg_versions
171+
}
172+
173+
vuln_purls_github = {
174+
PackageURL(type="github", name="istio", version=version)
175+
for version in vuln_pkg_versions
176+
}
177+
vuln_purls = vuln_purls_github.union(vuln_purls_golang)
178+
179+
advisories.append(
180+
Advisory(
181+
summary=data["description"],
182+
impacted_package_urls=vuln_purls,
183+
resolved_package_urls=safe_purls,
184+
vulnerability_id=cve_id,
185+
)
186+
)
187+
188+
return advisories
189+
190+
def get_data_from_md(self, path):
191+
"""Return a mapping of vulnerability data from istio . The data is
192+
in the form of yaml_lines inside a .md file.
193+
"""
194+
195+
with open(path) as f:
196+
yaml_lines = self.get_yaml_lines(f)
197+
return self.get_data_from_yaml_lines(yaml_lines)
198+
199+
is_release = re.compile(r"^[\d.]+$", re.IGNORECASE).match
Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
title: ISTIO-SECURITY-2019-001
3+
subtitle: Security Bulletin
4+
description: Incorrect access control.
5+
cves: [CVE-2019-12243]
6+
cvss: "8.9"
7+
vector: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:H/RL:O/RC:C"
8+
releases: ["1.1 to 1.1.15", "1.2 to 1.2.6", "1.3 to 1.3.1"]
9+
publishdate: 2019-05-28
10+
11+
---
12+
13+
{{< security_bulletin >}}
14+
15+
During review of the [Istio 1.1.7](/news/releases/1.1.x/announcing-1.1.7) release notes, we realized that [issue 13868](https://github.com/istio/istio/issues/13868),
16+
which is fixed in the release, actually represents a security vulnerability.
17+
18+
Initially we thought the bug was impacting the [TCP Authorization](/about/feature-stages/#security-and-policy-enforcement) feature advertised
19+
as alpha stability, which would not have required invoking this security advisory process, but we later realized that the
20+
[Deny Checker](https://istio.io/v1.6/docs/reference/config/policy-and-telemetry/adapters/denier/) and
21+
[List Checker](https://istio.io/v1.6/docs/reference/config/policy-and-telemetry/adapters/list/) feature were affected and those are considered stable features.
22+
We are revisiting our processes to flag vulnerabilities that are initially reported as bugs instead of through the
23+
[private disclosure process](/about/security-vulnerabilities/).
24+
25+
We tracked the bug to a code change introduced in Istio 1.1 and affecting all releases up to 1.1.6.
26+
27+
## Impact and detection
28+
29+
Since Istio 1.1, In the default Istio installation profile, policy enforcement is disabled by default.
30+
31+
You can check the status of policy enforcement for your mesh with the following command:
32+
33+
{{< text bash >}}
34+
$ kubectl -n istio-system get cm istio -o jsonpath="{@.data.mesh}" | grep disablePolicyChecks
35+
disablePolicyChecks: true
36+
{{< /text >}}
37+
38+
You are not impacted by this vulnerability if `disablePolicyChecks` is set to true.
39+
40+
You are impacted by the vulnerability issue if the following conditions are all true:
41+
42+
* You are running one of the affected Istio releases.
43+
* `disablePolicyChecks` is set to false (follow the steps mentioned above to check)
44+
* Your workload is NOT using HTTP, HTTP/2, or gRPC protocols
45+
* A mixer adapter (e.g., Deny Checker, List Checker) is used to provide authorization for your backend TCP service.
46+
47+
## Mitigation
48+
49+
* Users of Istio 1.0.x are not affected.
50+
* For Istio 1.1.x deployments: update to [Istio 1.1.7](/news/releases/1.1.x/announcing-1.1.7) or later.
51+
52+
## Credit
53+
54+
The Istio team would like to thank `Haim Helman` for the original bug report.
55+
56+
{{< boilerplate "security-vulnerability" >}}

0 commit comments

Comments
 (0)