Skip to content

Commit bdf7c85

Browse files
sbs2001sbs2001
authored
Merge pull request #301 from sbs2001/299-test-coverage-psql_and_nginx
Add tests for nginx and postgres importers
2 parents efe93f6 + d3c12d8 commit bdf7c85

5 files changed

Lines changed: 571 additions & 1 deletion

File tree

‎vulnerabilities/importers/nginx.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ def set_api(self):
5151
self.version_api = GitHubTagsAPI()
5252
asyncio.run(self.version_api.load_api(["nginx/nginx"]))
5353

54-
# For some reason nginx tags it's releases in the form of `release-1.2.3`
54+
# For some reason nginx tags it's releases are in the form of `release-1.2.3`
5555
# Chop off the `release-` part here.
5656
for index, version in enumerate(self.version_api.cache["nginx/nginx"]):
5757
self.version_api.cache["nginx/nginx"][index] = version.replace("release-", "")

‎vulnerabilities/tests/test_data/nginx/security_advisories.html‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
2+
<html><head></head>
3+
</p><p>
4+
Patches are signed using one of the
5+
<a href="pgp_keys.html">PGP public keys</a>.
6+
</p><ul>
7+
8+
9+
<li><p>Stack-based buffer overflow with specially crafted request<br>Severity: <b>major</b><br><a href="http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html">Advisory</a><br><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2028">CVE-2013-2028</a><br>Not vulnerable: 1.5.0+, 1.4.1+<br>Vulnerable: 1.3.9-1.4.0<br><a href="/download/patch.2013.chunked.txt">The patch</a>  <a href="/download/patch.2013.chunked.txt.asc">pgp</a></p></li>
10+
11+
<!-- Use this -->
12+
<li><p>Vulnerabilities with Windows directory aliases<br>Severity: medium<br><a href="http://mailman.nginx.org/pipermail/nginx-announce/2012/000086.html">Advisory</a><br><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4963">CVE-2011-4963</a><br>Not vulnerable: 1.3.1+, 1.2.1+<br>Vulnerable: nginx/Windows 0.7.52-1.3.0</p></li>
13+
14+
15+
<!-- Use this -->
16+
<li><p>Vulnerabilities with invalid UTF-8 sequence on Windows<br>Severity: <b>major</b><br><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2266">CVE-2010-2266</a><br>Not vulnerable: 0.8.41+, 0.7.67+<br>Vulnerable: nginx/Windows 0.7.52-0.8.40</p></li>
17+
18+
19+
<!-- Use this -->
20+
<li><p>An error log data are not sanitized<br>Severity: none<br><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4487">CVE-2009-4487</a><br>Not vulnerable: none<br>Vulnerable: all</p></li>
21+
22+
23+
<li><p>The renegotiation vulnerability in SSL protocol<br>Severity: <b>major</b><br><a href="http://www.kb.cert.org/vuls/id/120541">VU#120541</a>  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555">CVE-2009-3555</a><br>Not vulnerable: 0.8.23+, 0.7.64+<br>Vulnerable: 0.1.0-0.8.22<br><a href="/download/patch.cve-2009-3555.txt">The patch</a>  <a href="/download/patch.cve-2009-3555.txt.asc">pgp</a></p></li>
24+
25+
<li><p>Directory traversal vulnerability<br>Severity: minor<br><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3898">CVE-2009-3898</a><br>Not vulnerable: 0.8.17+, 0.7.63+<br>Vulnerable: 0.1.0-0.8.16</p></li>
26+
/patch.null.pointer.txt">The patch</a>  <a href="/download/patch.null.pointer.txt.asc">pgp</a></p></li>
27+
28+
</ul></div></div></body></html>

‎vulnerabilities/tests/test_data/postgresql/advisories.html‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
<!doctype html>
2+
<html lang="en">
3+
<head>
4+
<title>PostgreSQL: Security Information</title>
5+
6+
</head>
7+
<body>
8+
<div class="container-fluid">
9+
<div class="row justify-content-center pg-shout-box">
10+
<div class="col text-white text-center">12th November 2020: <a href="https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/">
11+
PostgreSQL 13.1, 12.5, 11.10, 10.15, 9.6.20, &amp; 9.5.24 Released</a>!
12+
13+
</div>
14+
</div>
15+
</div>
16+
17+
<div class="container-fluid margin">
18+
<div class="row">
19+
<div class="col-lg-2">
20+
<div id="pgSideWrap">
21+
22+
<div id="pgSideNav">
23+
<h2>Quick Links</h2>
24+
25+
<ul>
26+
27+
28+
<li><a href="/support/">Support</a>
29+
30+
31+
32+
</li>
33+
<li><a href="/support/versioning/">Versioning Policy</a>
34+
35+
36+
37+
</li>
38+
<li><a href="/support/security/">Security</a>
39+
40+
41+
42+
</li>
43+
<li><a href="/support/professional_support/">Professional Services</a>
44+
45+
46+
47+
</li>
48+
<li><a href="/support/professional_hosting/">Hosting Solutions</a>
49+
50+
51+
52+
</li>
53+
<li class="last-child"><a href="/account/submitbug/">Report a Bug</a>
54+
55+
56+
</li>
57+
58+
59+
</ul>
60+
61+
</div>
62+
63+
</div> <!-- pgSideWrap -->
64+
</div>
65+
<div class="col-lg-10">
66+
<div id="pgContentWrap">
67+
68+
69+
<h1>Security Information <i class="fas fa-lock"></i></h1>
70+
71+
<p>
72+
If you wish to report a new security vulnerability in PostgreSQL, please
73+
send an email to
74+
<a href="mailto:security@postgresql.org">security@postgresql.org</a>.
75+
For reporting non-security bugs, please see the <a href="/account/submitbug/">Report a Bug</a> page.
76+
</p>
77+
78+
79+
<h2>Known security issues in all supported versions</h2>
80+
<p>
81+
You can filter the view of patches to show just patches for version:<br/>
82+
83+
<a href="/support/security/13/">13</a> -
84+
85+
<a href="/support/security/12/">12</a> -
86+
87+
<a href="/support/security/11/">11</a> -
88+
89+
<a href="/support/security/10/">10</a> -
90+
91+
<a href="/support/security/9.6/">9.6</a> -
92+
93+
<a href="/support/security/9.5/">9.5</a>
94+
95+
- <a href="/support/security/">all</a>
96+
</p>
97+
98+
<table class="table table-striped">
99+
<thead class="thead-light">
100+
<tr>
101+
<th>Reference</th>
102+
<th>Affected</th>
103+
<th>Fixed</th>
104+
<th><a href="#comp">Component</a> & CVSS v3 Base Score</th>
105+
<th>Description</th>
106+
</tr>
107+
</thead>
108+
<tbody>
109+
110+
<tr>
111+
<td>
112+
<nobr>CVE-2020-10733</nobr><br/>
113+
<a href="/about/news/postgresql-123-118-1013-9618-and-9522-released-2038/">Announcement</a><br/>
114+
</td>
115+
<td>9.5</td>
116+
<td>9.5.22</td>
117+
<td>packaging<br/>
118+
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H">6.7</a><br/><span class="cvssvector">AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H</span>
119+
</td>
120+
<td>Windows installer runs executables from uncontrolled directories</td>
121+
</tr>
122+
123+
<tr>
124+
<td>
125+
<nobr><a href="https://access.redhat.com/security/cve/CVE-2020-1720">CVE-2020-1720</a></nobr><br/>
126+
<a href="/about/news/postgresql-122-117-1012-9617-9521-and-9426-released-2011/">Announcement</a><br/>
127+
</td>
128+
<td>11, 12</td>
129+
<td></td>
130+
<td>core server<br/>
131+
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N">3.1</a><br/><span class="cvssvector">AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N</span>
132+
</td>
133+
<td>ALTER ... DEPENDS ON EXTENSION is missing authorization checks.</td>
134+
</tr>
135+
136+
</tbody>
137+
</table>
138+
139+
<h3>Unsupported versions</h3>
140+
<p>
141+
You can also view archived security patches for unsupported versions. Note that no further
142+
security patches are made available for these versions as they are end of life.<br/>
143+
144+
<a href="/support/security/9.4/">9.4</a> -
145+
146+
<a href="/support/security/9.3/">9.3</a> -
147+
148+
<a href="/support/security/9.2/">9.2</a> -
149+
150+
<a href="/support/security/9.1/">9.1</a> -
151+
152+
<a href="/support/security/9.0/">9.0</a> -
153+
154+
<a href="/support/security/8.4/">8.4</a> -
155+
156+
<a href="/support/security/8.3/">8.3</a> -
157+
158+
<a href="/support/security/8.2/">8.2</a> -
159+
160+
<a href="/support/security/8.1/">8.1</a> -
161+
162+
<a href="/support/security/8.0/">8.0</a> -
163+
164+
<a href="/support/security/7.4/">7.4</a> -
165+
166+
<a href="/support/security/7.3/">7.3</a>
167+
168+
</p>
169+
170+
171+
<a name="comp"></a>
172+
<h2>Components</h2>
173+
<p>
174+
The following component references are used in the above table:
175+
</p>
176+
177+
<table class="table table-striped">
178+
<thead class="thead-light">
179+
<tr>
180+
<th>Component</th>
181+
<th>Description</th>
182+
</tr>
183+
</thead>
184+
<tbody>
185+
<tr>
186+
<td>core server</td>
187+
<td>This vulnerability exists in the core server product.</td>
188+
</tr>
189+
190+
<tr>
191+
<td>client</td>
192+
<td>This vulnerability exists in a client library or client application only.</td>
193+
</tr>
194+
195+
<tr>
196+
<td>contrib module</td>
197+
<td>This vulnerability exists in a contrib module. Contrib modules are not installed by default when PostgreSQL is installed from source. They may be installed by binary packages.</td>
198+
</tr>
199+
200+
<tr>
201+
<td>client contrib module</td>
202+
<td>This vulnerability exists in a contrib module used on the client only.</td>
203+
</tr>
204+
205+
<tr>
206+
<td>packaging</td>
207+
<td>This vulnerability exists in PostgreSQL binary packaging, e.g. an installer or RPM.</td>
208+
</tr>
209+
</tbody>
210+
</table>
211+
212+
213+
214+
</div> <!-- pgContentWrap -->
215+
</div>
216+
</div>
217+
</div>
218+
219+
<!-- Footer -->
220+
<footer id="footer">
221+
<!-- Copyright -->
222+
<div class="container">
223+
<a href="/about/policies/">Policies</a> |
224+
<a href="/about/policies/coc/">Code of Conduct</a> |
225+
<a href="/about/">About PostgreSQL</a> |
226+
<a href="/about/contact/">Contact</a><br/>
227+
<p>Copyright &copy; 1996-2020 The PostgreSQL Global Development Group</p>
228+
</div>
229+
</footer>
230+
</body>
231+
</html>

0 commit comments

Comments
 (0)