Remove added_advisories method and

assign cve to empty string if its
N/A

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

Author: tushar912

vulnerabilities/importer_yielder.py

@@ -249,17 +249,15 @@
         },
     },
     {
-        'name': 'apache_tomcat',
+        'name': 'apache_kafka',
         'license': '',
         'last_run': None,
-        'data_source': 'ApacheTomcatDataSource',
-        'data_source_cfg': {
-            "etags": {}
-        },
+        'data_source': 'ApacheKafkaDataSource',
+        'data_source_cfg': {},
     },
     {
         'name': 'istio',
-        'license': '',
+        'license': 'apache-2.0',
         'last_run': None,
         'data_source': 'IstioDataSource',
         'data_source_cfg': {

vulnerabilities/importers/istio.py

@@ -56,26 +56,16 @@ def updated_advisories(self) -> Set[Advisory]:
                 advisories.extend(processed_data)
         return self.batch_advisories(advisories)
 
-    def added_advisories(self) -> Set[Advisory]:
-        files = self._added_files
-        advisories = []
-        for f in files:
-            processed_data = self.process_file(f)
-            if processed_data:
-                advisories.extend(processed_data)
-        return self.batch_advisories(advisories)
-
-    def get_versions_for_pkg_from_range_list(self, version_range_list):
+    def get_pkg_versions_from_ranges(self, version_range_list):
         """Takes a list of version ranges(affected) of a package
         as parameter and returns a tuple of safe package versions and
         vulnerable package versions"""
-
+        all_version = self.version_api.get("istio/istio")
+        # if not version_range_list:
+        #     return all_version, []
         safe_pkg_versions = []
         vuln_pkg_versions = []
-        all_version = self.version_api.get("istio/istio")
-        if not version_range_list:
-            return all_version, []
-        version_ranges = {RangeSpecifier(r) for r in version_range_list}
+        version_ranges = [RangeSpecifier(r) for r in version_range_list]
         for version in all_version:
             if any([version in v for v in version_ranges]):
                 vuln_pkg_versions.append(version)
@@ -113,9 +103,9 @@ def get_yaml_lines(self, lines):
         ,'cves: [CVE-2019-12243]']
         """
 
-        for line in lines:
+        for index, line in enumerate(lines):
             line = line.strip()
-            if line.startswith("---"):
+            if line.startswith("---") and index == 0:
                 continue
             elif line.endswith("---"):
                 break
@@ -131,36 +121,40 @@ def process_file(self, path):
         releases = []
         if data.get("releases"):
             for release in data["releases"]:
-                release = release.strip()
-                release = release.split(" ")
-                if len(release) > 2:
+                # If it is of form "All versions prior to x"
+                if "All releases" in release:
+                    release = release.strip()
+                    release = release.split(" ")
+                    releases.append("<" + release[4])
+                # If it is of form "a to b"
+                elif "to" in release:
+                    release = release.strip()
+                    release = release.split(" ")
                     lbound = ">=" + release[0]
                     ubound = "<=" + release[2]
                     releases.append(lbound + "," + ubound)
+                # If it is a single release
+                elif isinstance(release, int):
+                    releases.append(release)
 
-        data["releases"] = releases
+        data["release_ranges"] = releases
 
         if not data.get("cves"):
             data["cves"] = [""]
 
         for cve_id in data["cves"]:
 
             if not cve_id.startswith("CVE"):
-                continue
+                cve_id = ""
 
             safe_pkg_versions = []
             vuln_pkg_versions = []
 
-            if not data.get("releases"):
-                data["releases"] = []
-
-            safe_pkg_versions, vuln_pkg_versions = self.get_versions_for_pkg_from_range_list(
-                data["releases"])
-
-            safe_purls = []
-            vuln_purls = []
+            if not data.get("release_ranges"):
+                data["release_ranges"] = []
 
-            cve_id = cve_id
+            safe_pkg_versions, vuln_pkg_versions = self.get_pkg_versions_from_ranges(
+                                                   data["release_ranges"])
 
             safe_purls_golang = {
                 PackageURL(type="golang", name="istio", version=version)
@@ -171,7 +165,7 @@ def process_file(self, path):
                 PackageURL(type="github", name="istio", version=version)
                 for version in safe_pkg_versions
             }
-            safe_purls = safe_purls_github | safe_purls_golang
+            safe_purls = safe_purls_github.union(safe_purls_golang)
 
             vuln_purls_golang = {
                 PackageURL(type="golang", name="istio", version=version)
@@ -182,14 +176,14 @@ def process_file(self, path):
                 PackageURL(type="github", name="istio", version=version)
                 for version in vuln_pkg_versions
             }
-            vuln_purls = vuln_purls_github | vuln_purls_golang
+            vuln_purls = vuln_purls_github.union(vuln_purls_golang)
 
             advisories.append(
                 Advisory(
                     summary=data["description"],
                     impacted_package_urls=vuln_purls,
                     resolved_package_urls=safe_purls,
-                    cve_id=cve_id,
+                    vulnerability_id=cve_id,
                 )
             )
 

vulnerabilities/tests/test_data/istio/test_file.md

@@ -7,4 +7,50 @@ cvss: "8.9"
 vector: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:H/RL:O/RC:C"
 releases: ["1.1 to 1.1.15", "1.2 to 1.2.6", "1.3 to 1.3.1"]
 publishdate: 2019-05-28
+
 ---
+
+{{< security_bulletin >}}
+
+During review of the [Istio 1.1.7](/news/releases/1.1.x/announcing-1.1.7) release notes, we realized that [issue 13868](https://github.com/istio/istio/issues/13868),
+which is fixed in the release, actually represents a security vulnerability.
+
+Initially we thought the bug was impacting the [TCP Authorization](/about/feature-stages/#security-and-policy-enforcement) feature advertised
+as alpha stability, which would not have required invoking this security advisory process, but we later realized that the
+[Deny Checker](https://istio.io/v1.6/docs/reference/config/policy-and-telemetry/adapters/denier/) and
+[List Checker](https://istio.io/v1.6/docs/reference/config/policy-and-telemetry/adapters/list/) feature were affected and those are considered stable features.
+We are revisiting our processes to flag vulnerabilities that are initially reported as bugs instead of through the
+[private disclosure process](/about/security-vulnerabilities/).
+
+We tracked the bug to a code change introduced in Istio 1.1 and affecting all releases up to 1.1.6.
+
+## Impact and detection
+
+Since Istio 1.1, In the default Istio installation profile, policy enforcement is disabled by default.
+
+You can check the status of policy enforcement for your mesh with the following command:
+
+{{< text bash >}}
+$ kubectl -n istio-system get cm istio -o jsonpath="{@.data.mesh}" | grep disablePolicyChecks
+disablePolicyChecks: true
+{{< /text >}}
+
+You are not impacted by this vulnerability if `disablePolicyChecks` is set to true.
+
+You are impacted by the vulnerability issue if the following conditions are all true:
+
+* You are running one of the affected Istio releases.
+* `disablePolicyChecks` is set to false (follow the steps mentioned above to check)
+* Your workload is NOT using HTTP, HTTP/2, or gRPC protocols
+* A mixer adapter (e.g., Deny Checker, List Checker) is used to provide authorization for your backend TCP service.
+
+## Mitigation
+
+* Users of Istio 1.0.x are not affected.
+* For Istio 1.1.x deployments: update to [Istio 1.1.7](/news/releases/1.1.x/announcing-1.1.7) or later.
+
+## Credit
+
+The Istio team would like to thank `Haim Helman` for the original bug report.
+
+{{< boilerplate "security-vulnerability" >}}

vulnerabilities/tests/test_istio.py

@@ -173,7 +173,7 @@ def test_process_file(self):
                         version="1.1.0-rc.6",
                     ),
                 },
-                cve_id="CVE-2019-12243",
+                vulnerability_id="CVE-2019-12243",
             )
         ]