From 502d85c058b7284e53df89617aab37a267bb0bd0 Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Mon, 12 Dec 2022 14:55:59 -0800 Subject: [PATCH 01/10] Modify apache_kafka.py and related tests for migration #972 Reference: https://github.com/nexB/vulnerablecode/issues/972 Signed-off-by: John M. Horan --- vulnerabilities/importers/apache_kafka.py | 345 +++++++++++++---- vulnerabilities/tests/test_apache_kafka.py | 158 ++++---- .../apache_kafka/cve-list-2022-12-06.html | 362 ++++++++++++++++++ .../apache_kafka/cve-list-changed-cve.html | 47 +++ .../cve-list-changed-fixed-versions.html | 47 +++ .../cve-list-changed-versions-affected.html | 47 +++ .../test_data/apache_kafka/jmh-test-01.txt | 84 ++++ .../apache_kafka/test-advisories.json | 200 ++++++++++ .../to-advisory-apache_kafka-expected.json | 200 ++++++++++ 9 files changed, 1336 insertions(+), 154 deletions(-) create mode 100644 vulnerabilities/tests/test_data/apache_kafka/cve-list-2022-12-06.html create mode 100644 vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-cve.html create mode 100644 vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-fixed-versions.html create mode 100644 vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-versions-affected.html create mode 100644 vulnerabilities/tests/test_data/apache_kafka/jmh-test-01.txt create mode 100644 vulnerabilities/tests/test_data/apache_kafka/test-advisories.json create mode 100644 vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json diff --git a/vulnerabilities/importers/apache_kafka.py b/vulnerabilities/importers/apache_kafka.py index f3d99362d..61a021c83 100644 --- a/vulnerabilities/importers/apache_kafka.py +++ b/vulnerabilities/importers/apache_kafka.py @@ -9,118 +9,321 @@ import asyncio +# to test json print +import json + import requests from bs4 import BeautifulSoup from packageurl import PackageURL -from univers.version_range import VersionRange + +# import VersionConstraint to experiment +from univers.version_constraint import VersionConstraint +from univers.version_range import MavenVersionRange from univers.versions import MavenVersion from vulnerabilities.importer import AdvisoryData +from vulnerabilities.importer import AffectedPackage from vulnerabilities.importer import Importer from vulnerabilities.importer import Reference from vulnerabilities.package_managers import GitHubTagsAPI -from vulnerabilities.utils import nearest_patched_package -GH_PAGE_URL = "https://raw.githubusercontent.com/apache/kafka-site/asf-site/cve-list.html" -ASF_PAGE_URL = "https://kafka.apache.org/cve-list" +affected_version_range_mapping = { + "CVE-2022-34917": { + "action": "include", + "2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.1": "affected", + "2.8.2, 3.0.2, 3.1.2, 3.2.3": "fixed", + "affected_version_range": "vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3", + }, + "CVE-2022-23302": { + "action": "omit", + }, + "CVE-2022-23305": { + "action": "omit", + }, + "CVE-2022-23307": { + "action": "omit", + }, + "CVE-2021-45046": { + "action": "omit", + }, + "CVE-2021-44228": { + "action": "omit", + }, + "CVE-2021-4104": { + "action": "omit", + }, + "CVE-2021-38153": { + "action": "include", + "2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, 2.8.0.": "affected", + "2.6.3, 2.7.2, 2.8.1, 3.0.0 and later": "fixed", + "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0", + }, + "CVE-2019-12399": { + "action": "include", + "2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0": "affected", + "2.2.2, 2.3.1 and later": "fixed", + "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1", + }, + "CVE-2018-17196": { + "action": "include", + "0.11.0.0 to 2.1.0": "affected", + "2.1.1 and later": "fixed", + "affected_version_range": "vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1", + }, + "CVE-2018-1288": { + "action": "include", + "0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, 1.0.0": "affected", + "0.10.2.2, 0.11.0.3, 1.0.1, 1.1.0": "fixed", + "affected_version_range": "vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0", + }, + "CVE-2017-12610": { + "action": "include", + "0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.1": "affected", + "0.10.2.2, 0.11.0.2, 1.0.0": "fixed", + "affected_version_range": "vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0", + }, +} class ApacheKafkaImporter(Importer): + + GH_PAGE_URL = "https://raw.githubusercontent.com/apache/kafka-site/asf-site/cve-list.html" + ASF_PAGE_URL = "https://kafka.apache.org/cve-list" + spdx_license_expression = "Apache-2.0" + license_url = "https://www.apache.org/licenses/" + @staticmethod - def fetch_advisory_page(): - page = requests.get(GH_PAGE_URL) + def fetch_advisory_page(self): + page = requests.get(self.GH_PAGE_URL) return page.content - def set_api(self): - self.version_api = GitHubTagsAPI() - asyncio.run(self.version_api.load_api(["apache/kafka"])) + # For now, don't use the GH API + # def set_api(self): + # self.version_api = GitHubTagsAPI() + # asyncio.run(self.version_api.load_api(["apache/kafka"])) def updated_advisories(self): advisory_page = self.fetch_advisory_page() - self.set_api() + # For now, don't use the GH API + # self.set_api() + parsed_data = self.to_advisory(advisory_page) return self.batch_advisories(parsed_data) def to_advisory(self, advisory_page): advisories = [] + advisory_page = BeautifulSoup(advisory_page, features="lxml") cve_section_beginnings = advisory_page.find_all("h2") for cve_section_beginning in cve_section_beginnings: - cve_id = cve_section_beginning.text.split("\n")[0] + # This sometimes includes text that follows the CVE on the same line -- sometimes there is a carriage return, sometimes there is not + # cve_id = cve_section_beginning.text.split("\n")[0] + # This is superior, gets only the cve id and no following text. + cve_id = cve_section_beginning.get("id") + cve_description_paragraph = cve_section_beginning.find_next_sibling("p") + + stripped_cve_description_paragraph = str(cve_description_paragraph.get_text()) + stripped_cve_description_paragraph = stripped_cve_description_paragraph.replace( + "\n", "" + ) + stripped_cve_description_paragraph = " ".join( + stripped_cve_description_paragraph.split() + ) + cve_data_table = cve_section_beginning.find_next_sibling("table") cve_data_table_rows = cve_data_table.find_all("tr") affected_versions_row = cve_data_table_rows[0] fixed_versions_row = cve_data_table_rows[1] - affected_version_ranges = to_version_ranges( - affected_versions_row.find_all("td")[1].text - ) - fixed_version_ranges = to_version_ranges(fixed_versions_row.find_all("td")[1].text) - - fixed_packages = [ - PackageURL(type="apache", name="kafka", version=version) - for version in self.version_api.get("apache/kafka").valid_versions - if any( - [ - MavenVersion(version) in version_range - for version_range in fixed_version_ranges - ] - ) + + affected_versions_string = affected_versions_row.find_all("td")[1].text + fixed_versions_string = fixed_versions_row.find_all("td")[1].text + + # Remove leading white space after initial comma + affected_versions_string_split_SPLIT = [ + substring.strip() + for substring in affected_versions_string.split(",") + if not substring.isspace() + ] + fixed_versions_string_split_SPLIT = [ + substring.strip() + for substring in fixed_versions_string.split(",") + if not substring.isspace() ] - affected_packages = [ - PackageURL(type="apache", name="kafka", version=version) - for version in self.version_api.get("apache/kafka").valid_versions - if any( - [ - MavenVersion(version) in version_range - for version_range in affected_version_ranges - ] + # This throws a KeyError if the opening h2 tag `id` data changes or is not in the + # hard-coded affected_version_range_mapping dictionary. + if affected_version_range_mapping[cve_id]["action"] == "include": + + # print("\ncve_id = {}".format(cve_id)) + + # These 2 variables (not used elsewhere) trigger the KeyError for changed/missing data. + check_affected_versions_key = affected_version_range_mapping[cve_id][ + affected_versions_string + ] + check_fixed_versions_key = affected_version_range_mapping[cve_id][ + fixed_versions_string + ] + + # This calculates/prints the correct univers version value, which we can then use in the mapping dictionary. + # We'll delete this and to_version_ranges_test() when no longer needed. + affected_version_ranges_TEST = self.to_version_ranges_test( + affected_versions_string_split_SPLIT, fixed_versions_string_split_SPLIT ) - ] + # print("\naffected_version_ranges_TEST = {}".format(affected_version_ranges_TEST)) + # print("\naffected_versions_string = {}".format(affected_versions_string)) + # print("\nfixed_versions_string = {}".format(fixed_versions_string)) + + references = [ + Reference(url=self.ASF_PAGE_URL), + Reference( + url=f"https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve_id}", + reference_id=cve_id, + ), + ] - advisories.append( - AdvisoryData( - vulnerability_id=cve_id, - summary=cve_description_paragraph.text, - affected_packages=nearest_patched_package(affected_packages, fixed_packages), - references=[ - Reference(url=ASF_PAGE_URL), - Reference( - url=f"https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve_id}", - reference_id=cve_id, - ), + affected_packages = [] + affected_package = AffectedPackage( + package=PackageURL( + name="apache_kafka", + type="maven", + ), + affected_version_range=affected_version_range_mapping[cve_id][ + "affected_version_range" ], ) - ) + affected_packages.append(affected_package) + + advisories.append( + AdvisoryData( + aliases=[cve_id], + summary=stripped_cve_description_paragraph, + affected_packages=affected_packages, + references=references, + ) + ) + + # print("\nadvisories[-1] = {}".format(advisories[-1])) + # print("\nadvisories[-1].to_dict() = {}".format(advisories[-1].to_dict())) + + # print("\n========================================") + + # Print a dict of the advisories. + # result = [data.to_dict() for data in advisories] + # print("result = \n") + # print(json.dumps(result, indent=4, sort_keys=False)) + return advisories + # We use this to calculate the ranges for the hard-coded affected_version_range_mapping. + # We'' delete this when no longer needed. + def to_version_ranges_test(self, versions_data, fixed_versions): + constraints = [] -def to_version_ranges(version_range_text): - version_ranges = [] - range_expressions = version_range_text.split(",") - for range_expression in range_expressions: - if "to" in range_expression: - # eg range_expression == "3.2.0 to 3.2.1" - lower_bound, upper_bound = range_expression.split("to") - lower_bound = f">={lower_bound}" - upper_bound = f"<={upper_bound}" - version_ranges.append( - VersionRange.from_scheme_version_spec_string( - "maven", f"{lower_bound},{upper_bound}" + for version_item in versions_data: + if "to" in version_item: + version_item_split = version_item.split(" ") + + constraints.append( + VersionConstraint( + comparator=">=", + version=MavenVersion(version_item_split[0]), + ) + ) + constraints.append( + VersionConstraint( + comparator="<=", + version=MavenVersion(version_item_split[-1]), + ) ) - ) - elif "and later" in range_expression: - # eg range_expression == "2.1.1 and later" - range_expression = range_expression.replace("and later", "") - version_ranges.append( - VersionRange.from_scheme_version_spec_string("maven", f">={range_expression}") - ) + elif "-" in version_item: + version_item_split = version_item.split(" ") - else: - # eg range_expression == "3.0.0" - version_ranges.append( - VersionRange.from_scheme_version_spec_string("maven", range_expression) - ) - return version_ranges + constraints.append( + VersionConstraint( + comparator=">=", + version=MavenVersion(version_item_split[0]), + ) + ) + constraints.append( + VersionConstraint( + comparator="<=", + version=MavenVersion(version_item_split[-1]), + ) + ) + + elif "and later" in version_item: + version_item_split = version_item.split(" ") + + constraints.append( + VersionConstraint( + comparator=">=", + version=MavenVersion(version_item_split[0]), + ) + ) + + else: + version_item_split = version_item.split(" ") + + constraints.append( + VersionConstraint( + comparator="=", + version=MavenVersion(version_item_split[0]), + ) + ) + + for fixed_item in fixed_versions: + if "to" in fixed_item: + fixed_item_split = fixed_item.split(" ") + + constraints.append( + VersionConstraint( + comparator=">=", + version=MavenVersion(fixed_item_split[0]), + ).invert() + ) + constraints.append( + VersionConstraint( + comparator="<=", + version=MavenVersion(fixed_item_split[-1]), + ).invert() + ) + + elif "-" in fixed_item: + fixed_item_split = fixed_item.split(" ") + + constraints.append( + VersionConstraint( + comparator=">=", + version=MavenVersion(fixed_item_split[0]), + ).invert() + ) + constraints.append( + VersionConstraint( + comparator="<=", + version=MavenVersion(fixed_item_split[-1]), + ).invert() + ) + + elif "and later" in fixed_item: + fixed_item_split = fixed_item.split(" ") + + constraints.append( + VersionConstraint( + comparator=">=", + version=MavenVersion(fixed_item_split[0]), + ).invert() + ) + + else: + fixed_item_split = fixed_item.split(" ") + + constraints.append( + VersionConstraint( + comparator="=", + version=MavenVersion(fixed_item_split[0]), + ).invert() + ) + + return MavenVersionRange(constraints=constraints) diff --git a/vulnerabilities/tests/test_apache_kafka.py b/vulnerabilities/tests/test_apache_kafka.py index 017d6ba7f..1888bcc8d 100644 --- a/vulnerabilities/tests/test_apache_kafka.py +++ b/vulnerabilities/tests/test_apache_kafka.py @@ -7,92 +7,84 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +# temporarily import json to create output to analyze +import json import os -from unittest import TestCase -from packageurl import PackageURL -from univers.version_range import VersionRange +import pytest -from vulnerabilities.importer import AdvisoryData -from vulnerabilities.importer import Reference from vulnerabilities.importers.apache_kafka import ApacheKafkaImporter -from vulnerabilities.importers.apache_kafka import to_version_ranges -from vulnerabilities.package_managers import GitHubTagsAPI -from vulnerabilities.package_managers import Version -from vulnerabilities.utils import AffectedPackage + +# from vulnerabilities.package_managers import GitHubTagsAPI +from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) -TEST_DATA = os.path.join(BASE_DIR, "test_data", "apache_kafka", "cve-list.html") - - -class TestApacheKafkaImporter(TestCase): - def test_to_version_ranges(self): - # Check single version - assert [ - VersionRange.from_scheme_version_spec_string("maven", "=3.2.2") - ] == to_version_ranges("3.2.2") - - # Check range with lower and upper bounds - assert [ - VersionRange.from_scheme_version_spec_string("maven", ">=3.2.2, <=3.2.3") - ] == to_version_ranges("3.2.2 to 3.2.3") - - # Check range with "and later" - assert [ - VersionRange.from_scheme_version_spec_string("maven", ">=3.2.2") - ] == to_version_ranges("3.2.2 and later") - - # Check combination of above cases - assert [ - VersionRange.from_scheme_version_spec_string("maven", ">=3.2.2"), - VersionRange.from_scheme_version_spec_string("maven", ">=3.2.2, <=3.2.3"), - VersionRange.from_scheme_version_spec_string("maven", "==3.2.2"), - ] == to_version_ranges("3.2.2 and later, 3.2.2 to 3.2.3, 3.2.2") - - def test_to_advisory(self): - data_source = ApacheKafkaImporter(batch_size=1) - data_source.version_api = GitHubTagsAPI( - cache={"apache/kafka": [Version("2.1.2"), Version("0.10.2.2")]} - ) - expected_advisories = [ - Advisory( - summary="In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually\n craft a Produce request which bypasses transaction/idempotent ACL validation.\n Only authenticated clients with Write permission on the respective topics are\n able to exploit this vulnerability. Users should upgrade to 2.1.1 or later\n where this vulnerability has been fixed.", - vulnerability_id="CVE-2018-17196", - affected_packages=[ - AffectedPackage( - vulnerable_package=PackageURL( - type="apache", - namespace=None, - name="kafka", - version="0.10.2.2", - qualifiers={}, - subpath=None, - ), - patched_package=PackageURL( - type="apache", - namespace=None, - name="kafka", - version="2.1.2", - qualifiers={}, - subpath=None, - ), - ) - ], - references=[ - Reference( - reference_id="", url="https://kafka.apache.org/cve-list", severities=[] - ), - Reference( - reference_id="CVE-2018-17196", - url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196", - severities=[], - ), - ], - ) - ] - with open(TEST_DATA) as f: - found_advisories = data_source.to_advisory(f) - - found_advisories = list(map(Advisory.normalized, found_advisories)) - expected_advisories = list(map(Advisory.normalized, expected_advisories)) - assert sorted(found_advisories) == sorted(expected_advisories) +# Created cve-list-2022-12-06.html with a full copy of https://raw.githubusercontent.com/apache/kafka-site/asf-site/cve-list.html +TEST_DATA = os.path.join( + BASE_DIR, + "test_data/apache_kafka", +) + + +def test_to_advisory(): + with open(os.path.join(TEST_DATA, "cve-list-2022-12-06.html")) as f: + raw_data = f.read() + advisories = ApacheKafkaImporter().to_advisory(raw_data) + result = [data.to_dict() for data in advisories] + + # TODO: We need to finish this test including the REGEN step. 2022-12-12 Monday 14:48:05. Done. + expected_file = os.path.join(TEST_DATA, f"to-advisory-apache_kafka-expected.json") + util_tests.check_results_against_json(result, expected_file) + + # We generate these 2 files solely to vet the output and adjust the importer code. + # with open(os.path.join(TEST_DATA, "jmh-test-01.txt"), "w") as f1: + # for advisory_object in result: + # f1.write(f"{advisory_object}\n\n") + # for k, v in advisory_object.items(): + # f1.write(f"{k}: {v}\n\n") + # f1.write(f"=================================================\n\n") + + # with open(os.path.join(TEST_DATA, "test-advisories.json"), "w", encoding="utf-8") as f: + # json.dump(result, f, ensure_ascii=False, indent=4) + + +# Check for an unknown CVE value. +def to_advisory_changed_cve(): + with open(os.path.join(TEST_DATA, "cve-list-changed-cve.html")) as f: + raw_data = f.read() + advisories = ApacheKafkaImporter().to_advisory(raw_data) + + +def test_to_advisory_changed_cve_exception(): + with pytest.raises(KeyError) as excinfo: + to_advisory_changed_cve() + + assert "CVE-2022-34918" in str(excinfo.value) + + +# Check for an unknown "Versions affected" value. +def to_advisory_changed_versions_affected(): + with open(os.path.join(TEST_DATA, "cve-list-changed-versions-affected.html")) as f: + raw_data = f.read() + advisories = ApacheKafkaImporter().to_advisory(raw_data) + + +def test_to_advisory_changed_versions_affected_exception(): + with pytest.raises(KeyError) as excinfo: + to_advisory_changed_versions_affected() + + assert "2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.2" in str(excinfo.value) + + +# Check for an unknown "Fixed versions" value. +def to_advisory_changed_fixed_versions(): + with open(os.path.join(TEST_DATA, "cve-list-changed-fixed-versions.html")) as f: + raw_data = f.read() + advisories = ApacheKafkaImporter().to_advisory(raw_data) + + +def test_to_advisory_changed_fixed_versions_exception(): + with pytest.raises(KeyError) as excinfo: + to_advisory_changed_fixed_versions() + + assert "2.8.2, 3.0.2, 3.1.2, 3.2.4" in str(excinfo.value) diff --git a/vulnerabilities/tests/test_data/apache_kafka/cve-list-2022-12-06.html b/vulnerabilities/tests/test_data/apache_kafka/cve-list-2022-12-06.html new file mode 100644 index 000000000..02763f7cb --- /dev/null +++ b/vulnerabilities/tests/test_data/apache_kafka/cve-list-2022-12-06.html @@ -0,0 +1,362 @@ + + + + +
+ +
+ +

Apache Kafka Security Vulnerabilities

+ + This page lists all security vulnerabilities fixed in released versions of Apache Kafka. + +

CVE-2022-34917 Unauthenticated clients may cause OutOfMemoryError on brokers

+ +

This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and + causing denial of service.

+ + + + + + + + + + + + + + + + + + + + +
Versions affected2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.1
Fixed versions2.8.2, 3.0.2, 3.1.2, 3.2.3
ImpactExample scenarios in which attacker can cause OutOfMemoryError on brokers
+ - Kafka cluster without authentication: Any clients able to establish + a network connection to a broker can trigger the issue.
+ - Kafka cluster with SASL authentication: Any clients able to + establish a network connection to a broker, without the need for valid + SASL credentials, can trigger the issue.
+ - Kafka cluster with TLS authentication: Only clients able to + successfully authenticate via TLS can trigger the issue.
+
Issue announced19 Sep 2022
+ +

CVE-2022-23302 Deserialization of Untrusted Data Flaw in JMSSink of Apache Log4j logging library in versions 1.x

+ +

This CVE identified a flaw where it allows the attacker to provide a TopicConnectionFactoryBindingName configuration that will cause JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104.

+ + + + + + + + + + + + + + + + + + + + +
Versions affectedAll AK versions
Fixed versionsIn the absence of a new log4j 1.x release, one can remove JMSSink class from the log4j-1.2.17.jar artifact.
ImpactWhen the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a configuration causing JMSSink to perform JNDI requests that result in remote code execution.
Issue announced18 Jan 2022
+ +

CVE-2022-23305 SQL injection Flaw in Apache Log4j logging library in versions 1.x

+ +

This CVE identified a flaw where it allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain interpolation tokens.

+ + + + + + + + + + + + + + + + + + + + +
Versions affectedAll AK versions
Fixed versionsIn the absence of a new log4j 1.x release, one can remove JDBCAppender class from the log4j-1.2.17.jar artifact.
ImpactThis issue could result in a SQL injection attack when the application is configured to use JDBCAppender.
Issue announced18 Jan 2022
+ +

CVE-2022-23307 Deserialization of Untrusted Data Flaw in Apache Log4j logging library in versions 1.x

+ +

This CVE identified a flaw where it allows an attacker to send a malicious request with serialized data to the component running log4j 1.x to be deserialized when the chainsaw component is run. Chainsaw is a standalone GUI for viewing log entries in log4j. An attacker not only needs to be able to generate malicious log entries, but also, have the necessary access and permissions to start chainsaw (or if it is already enabled by a customer / consumer of Apache Kafka).

+ + + + + + + + + + + + + + + + + + + + +
Versions affectedAll AK versions
Fixed versionsIn the absence of a new log4j 1.x release, one can remove Chainsaw from the log4j-1.2.17.jar artifact.
ImpactWhen an attacker has the ability to start Chainsaw and is able to generate malicious log entries it allows deserialization of untrusted data.
Issue announced18 Jan 2022
+ +

CVE-2021-45046 + Flaw in Apache Log4j logging library in versions from 2.0-beta9 through 2.12.1 and from 2.13.0 through 2.15.0

+ +

Some components in Apache Kafka use Log4j-v1.2.17 there is no dependence on Log4j v2.*. Check with the vendor of any connector plugin that includes a Log4J 2.x JAR file.

+ +

Users should NOT be impacted by this vulnerability

+ + + + + + + + + + + + + + + + + + + + +
Versions affectedNA
Fixed versionsNA
ImpactNA
Issue announced14 Dec 2021
+ +

CVE-2021-44228 + Flaw in Apache Log4j logging library in versions from 2.0.0 and before 2.15.0

+ +

Some components in Apache Kafka use Log4j-v1.2.17 there is no dependence on Log4j v2.*. Check with the vendor of any connector plugin that includes a Log4J 2.x JAR file.

+ +

Lookups feature was introduced in Log4j v2.x in order to allow specifying Log4j configuration parameters in arbitrary locations (even outside of the configuration files). Log4j v1.x does not offer the same functionality and thus is not vulnerable to CVE-2021-44228.

+

Users should NOT be impacted by this vulnerability

+ + + + + + + + + + + + + + + + + + + + +
Versions affectedNA
Fixed versionsNA
ImpactNA
Issue announced09 Dec 2021
+ +

CVE-2021-4104 + Flaw in Apache Log4j logging library in versions 1.x

+ +

The following components in Apache Kafka use Log4j-v1.2.17: broker, controller, zookeeper, connect, mirrormaker and tools. Clients may also be configured to use Log4j-v1.x.

+ +

Version 1.x of Log4J can be configured to use JMS Appender, which publishes log events to a JMS Topic. Log4j 1.x is vulnerable if the deployed application is configured to use JMSAppender.

+ + + + + + + + + + + + + + + + + + + + +
Versions affectedAll versions
Fixed versions + In the absence of a new log4j 1.x release, one can remove JMSAppender + from the log4j-1.2.17.jar artifact. Commands are listed in the + page http://slf4j.org/log4shell.html. +
+
+ We also recommend that configuration files be protected against write access as stated in http://slf4j.org/log4shell.html. +
ImpactThis issue could result in a remote code execution attack when the application is configured to use JMSAppender AND the attacker has access to directly modify the TopicBindingName or TopicConnectionFactoryBindingName configuration variables in property files which is typically an unlikely exploitation scenario.
Issue announced09 Dec 2021
+ +

CVE-2021-38153 + Timing Attack Vulnerability for Apache Kafka Connect and Clients

+ +

Some components in Apache Kafka use Arrays.equals to validate a password or key, + which is vulnerable to timing attacks that make brute force attacks for such credentials + more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher + where this vulnerability has been fixed.

+ + + + + + + + + + + + + + + + + + + + +
Versions affected2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, 2.8.0.
Fixed versions2.6.3, 2.7.2, 2.8.1, 3.0.0 and later
ImpactThis issue could result in privilege escalation.
Issue announced21 Sep 2021
+ +

CVE-2019-12399 + Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint

+ +

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are + configured with one or more config providers, and a connector is created/updated on + that Connect cluster to use an externalized secret variable in a substring of a + connector configuration property value (the externalized secret variable is not the + whole configuration property value), then any client can issue a request to + the same Connect cluster to obtain the connector's task configurations and + the response will contain the plaintext secret rather than the externalized secrets variable. + Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher + where this vulnerability has been fixed.

+ + + + + + + + + + + + + + + + + + + + +
Versions affected2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0
Fixed versions2.2.2, 2.3.1 and later
ImpactThis issue could result in exposing externalized connector secrets.
Issue announced13 Jan 2020
+ +

CVE-2018-17196 + Authenticated clients with Write permission may bypass transaction/idempotent ACL validation

+

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually + craft a Produce request which bypasses transaction/idempotent ACL validation. + Only authenticated clients with Write permission on the respective topics are + able to exploit this vulnerability. Users should upgrade to 2.1.1 or later + where this vulnerability has been fixed.

+ + + + + + + + + + + + + + + + + + + + +
Versions affected0.11.0.0 to 2.1.0
Fixed versions2.1.1 and later
ImpactThis issue could result in privilege escalation.
Issue announced10 July 2019
+ +

CVE-2018-1288 + Authenticated Kafka clients may interfere with data replication

+ +

Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request + interfering with data replication, resulting in data loss.

+ + + + + + + + + + + + + + + + + + + + +
Versions affected0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, 1.0.0
Fixed versions0.10.2.2, 0.11.0.3, 1.0.1, 1.1.0
ImpactThis issue could potentially lead to data loss.
Issue announced26 July 2018
+ + +

CVE-2017-12610 + Authenticated Kafka clients may impersonate other users

+ +

Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM + authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.

+ + + + + + + + + + + + + + + + + + + + +
Versions affected0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.1
Fixed versions0.10.2.2, 0.11.0.2, 1.0.0
ImpactThis issue could result in privilege escalation.
Issue announced26 July 2018
+ + + diff --git a/vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-cve.html b/vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-cve.html new file mode 100644 index 000000000..3e259fc51 --- /dev/null +++ b/vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-cve.html @@ -0,0 +1,47 @@ + + + + +
+ +
+ +

Apache Kafka Security Vulnerabilities

+ + This page lists all security vulnerabilities fixed in released versions of Apache Kafka. + +

CVE-2022-34917 Unauthenticated clients may cause OutOfMemoryError on brokers

+ +

This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and + causing denial of service.

+ + + + + + + + + + + + + + + + + + + + +
Versions affected2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.1
Fixed versions2.8.2, 3.0.2, 3.1.2, 3.2.3
ImpactExample scenarios in which attacker can cause OutOfMemoryError on brokers
+ - Kafka cluster without authentication: Any clients able to establish + a network connection to a broker can trigger the issue.
+ - Kafka cluster with SASL authentication: Any clients able to + establish a network connection to a broker, without the need for valid + SASL credentials, can trigger the issue.
+ - Kafka cluster with TLS authentication: Only clients able to + successfully authenticate via TLS can trigger the issue.
+
Issue announced19 Sep 2022
+ + diff --git a/vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-fixed-versions.html b/vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-fixed-versions.html new file mode 100644 index 000000000..838d0732d --- /dev/null +++ b/vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-fixed-versions.html @@ -0,0 +1,47 @@ + + + + +
+ +
+ +

Apache Kafka Security Vulnerabilities

+ + This page lists all security vulnerabilities fixed in released versions of Apache Kafka. + +

CVE-2022-34917 Unauthenticated clients may cause OutOfMemoryError on brokers

+ +

This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and + causing denial of service.

+ + + + + + + + + + + + + + + + + + + + +
Versions affected2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.1
Fixed versions2.8.2, 3.0.2, 3.1.2, 3.2.4
ImpactExample scenarios in which attacker can cause OutOfMemoryError on brokers
+ - Kafka cluster without authentication: Any clients able to establish + a network connection to a broker can trigger the issue.
+ - Kafka cluster with SASL authentication: Any clients able to + establish a network connection to a broker, without the need for valid + SASL credentials, can trigger the issue.
+ - Kafka cluster with TLS authentication: Only clients able to + successfully authenticate via TLS can trigger the issue.
+
Issue announced19 Sep 2022
+ + diff --git a/vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-versions-affected.html b/vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-versions-affected.html new file mode 100644 index 000000000..7991d2cf5 --- /dev/null +++ b/vulnerabilities/tests/test_data/apache_kafka/cve-list-changed-versions-affected.html @@ -0,0 +1,47 @@ + + + + +
+ +
+ +

Apache Kafka Security Vulnerabilities

+ + This page lists all security vulnerabilities fixed in released versions of Apache Kafka. + +

CVE-2022-34917 Unauthenticated clients may cause OutOfMemoryError on brokers

+ +

This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and + causing denial of service.

+ + + + + + + + + + + + + + + + + + + + +
Versions affected2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.2
Fixed versions2.8.2, 3.0.2, 3.1.2, 3.2.3
ImpactExample scenarios in which attacker can cause OutOfMemoryError on brokers
+ - Kafka cluster without authentication: Any clients able to establish + a network connection to a broker can trigger the issue.
+ - Kafka cluster with SASL authentication: Any clients able to + establish a network connection to a broker, without the need for valid + SASL credentials, can trigger the issue.
+ - Kafka cluster with TLS authentication: Only clients able to + successfully authenticate via TLS can trigger the issue.
+
Issue announced19 Sep 2022
+ + diff --git a/vulnerabilities/tests/test_data/apache_kafka/jmh-test-01.txt b/vulnerabilities/tests/test_data/apache_kafka/jmh-test-01.txt new file mode 100644 index 000000000..e2aeed12f --- /dev/null +++ b/vulnerabilities/tests/test_data/apache_kafka/jmh-test-01.txt @@ -0,0 +1,84 @@ +{'aliases': ['CVE-2022-34917'], 'summary': 'This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2022-34917', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917', 'severities': []}], 'date_published': None} + +aliases: ['CVE-2022-34917'] + +summary: This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. + +affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3', 'fixed_version': None}] + +references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2022-34917', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917', 'severities': []}] + +date_published: None + +================================================= + +{'aliases': ['CVE-2021-38153'], 'summary': 'Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2021-38153', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38153', 'severities': []}], 'date_published': None} + +aliases: ['CVE-2021-38153'] + +summary: Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. + +affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0', 'fixed_version': None}] + +references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2021-38153', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38153', 'severities': []}] + +date_published: None + +================================================= + +{'aliases': ['CVE-2019-12399'], 'summary': "When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value (the externalized secret variable is not the whole configuration property value), then any client can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret rather than the externalized secrets variable. Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher where this vulnerability has been fixed.", 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2019-12399', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12399', 'severities': []}], 'date_published': None} + +aliases: ['CVE-2019-12399'] + +summary: When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value (the externalized secret variable is not the whole configuration property value), then any client can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret rather than the externalized secrets variable. Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher where this vulnerability has been fixed. + +affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1', 'fixed_version': None}] + +references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2019-12399', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12399', 'severities': []}] + +date_published: None + +================================================= + +{'aliases': ['CVE-2018-17196'], 'summary': 'In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2018-17196', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196', 'severities': []}], 'date_published': None} + +aliases: ['CVE-2018-17196'] + +summary: In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed. + +affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1', 'fixed_version': None}] + +references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2018-17196', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196', 'severities': []}] + +date_published: None + +================================================= + +{'aliases': ['CVE-2018-1288'], 'summary': 'Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2018-1288', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1288', 'severities': []}], 'date_published': None} + +aliases: ['CVE-2018-1288'] + +summary: Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss. + +affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0', 'fixed_version': None}] + +references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2018-1288', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1288', 'severities': []}] + +date_published: None + +================================================= + +{'aliases': ['CVE-2017-12610'], 'summary': 'Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2017-12610', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12610', 'severities': []}], 'date_published': None} + +aliases: ['CVE-2017-12610'] + +summary: Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka. + +affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0', 'fixed_version': None}] + +references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2017-12610', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12610', 'severities': []}] + +date_published: None + +================================================= + diff --git a/vulnerabilities/tests/test_data/apache_kafka/test-advisories.json b/vulnerabilities/tests/test_data/apache_kafka/test-advisories.json new file mode 100644 index 000000000..ccf707541 --- /dev/null +++ b/vulnerabilities/tests/test_data/apache_kafka/test-advisories.json @@ -0,0 +1,200 @@ +[ + { + "aliases": [ + "CVE-2022-34917" + ], + "summary": "This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2021-38153" + ], + "summary": "Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2021-38153", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38153", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2019-12399" + ], + "summary": "When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value (the externalized secret variable is not the whole configuration property value), then any client can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret rather than the externalized secrets variable. Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher where this vulnerability has been fixed.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2019-12399", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12399", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2018-17196" + ], + "summary": "In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-17196", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2018-1288" + ], + "summary": "Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1288", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2017-12610" + ], + "summary": "Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2017-12610", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12610", + "severities": [] + } + ], + "date_published": null + } +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json new file mode 100644 index 000000000..a95a7e835 --- /dev/null +++ b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json @@ -0,0 +1,200 @@ +[ + { + "aliases": [ + "CVE-2022-34917" + ], + "summary": "This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2021-38153" + ], + "summary": "Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2021-38153", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38153", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2019-12399" + ], + "summary": "When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value (the externalized secret variable is not the whole configuration property value), then any client can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret rather than the externalized secrets variable. Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher where this vulnerability has been fixed.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2019-12399", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12399", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2018-17196" + ], + "summary": "In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-17196", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2018-1288" + ], + "summary": "Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1288", + "severities": [] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2017-12610" + ], + "summary": "Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": null, + "name": "apache_kafka", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0", + "fixed_version": null + } + ], + "references": [ + { + "reference_id": "", + "url": "https://kafka.apache.org/cve-list", + "severities": [] + }, + { + "reference_id": "CVE-2017-12610", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12610", + "severities": [] + } + ], + "date_published": null + } +] \ No newline at end of file From 3602fe9a0fbe70f69b9b7235e60b3b295f1645a2 Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Tue, 3 Jan 2023 16:29:58 -0800 Subject: [PATCH 02/10] Remove unneeded comments and test files, add changelog entry for apache_kafka #972 Reference: https://github.com/nexB/vulnerablecode/issues/972 Signed-off-by: John M. Horan --- CHANGELOG.rst | 6 + vulnerabilities/importers/apache_kafka.py | 150 +----------------- vulnerabilities/tests/test_apache_kafka.py | 21 +-- .../test_data/apache_kafka/jmh-test-01.txt | 84 ---------- 4 files changed, 9 insertions(+), 252 deletions(-) delete mode 100644 vulnerabilities/tests/test_data/apache_kafka/jmh-test-01.txt diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 2879dcf89..db8fa91dd 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -2,6 +2,12 @@ Release notes ============= +Next Release +------------ + +- We re-enabled support for the Apache Kafka vulnerabilities advisories importer. + + Version v32.0.0rc2 -------------------- diff --git a/vulnerabilities/importers/apache_kafka.py b/vulnerabilities/importers/apache_kafka.py index 61a021c83..a238f0eb1 100644 --- a/vulnerabilities/importers/apache_kafka.py +++ b/vulnerabilities/importers/apache_kafka.py @@ -7,16 +7,10 @@ # See https://aboutcode.org for more information about nexB OSS projects. # -import asyncio - -# to test json print -import json import requests from bs4 import BeautifulSoup from packageurl import PackageURL - -# import VersionConstraint to experiment from univers.version_constraint import VersionConstraint from univers.version_range import MavenVersionRange from univers.versions import MavenVersion @@ -25,8 +19,9 @@ from vulnerabilities.importer import AffectedPackage from vulnerabilities.importer import Importer from vulnerabilities.importer import Reference -from vulnerabilities.package_managers import GitHubTagsAPI +# The entries below with `"action": "omit"` have no useful/reportable fixed or affected version data. +# See https://kafka.apache.org/cve-list affected_version_range_mapping = { "CVE-2022-34917": { "action": "include", @@ -97,15 +92,8 @@ def fetch_advisory_page(self): page = requests.get(self.GH_PAGE_URL) return page.content - # For now, don't use the GH API - # def set_api(self): - # self.version_api = GitHubTagsAPI() - # asyncio.run(self.version_api.load_api(["apache/kafka"])) - def updated_advisories(self): advisory_page = self.fetch_advisory_page() - # For now, don't use the GH API - # self.set_api() parsed_data = self.to_advisory(advisory_page) return self.batch_advisories(parsed_data) @@ -155,8 +143,6 @@ def to_advisory(self, advisory_page): # hard-coded affected_version_range_mapping dictionary. if affected_version_range_mapping[cve_id]["action"] == "include": - # print("\ncve_id = {}".format(cve_id)) - # These 2 variables (not used elsewhere) trigger the KeyError for changed/missing data. check_affected_versions_key = affected_version_range_mapping[cve_id][ affected_versions_string @@ -165,15 +151,6 @@ def to_advisory(self, advisory_page): fixed_versions_string ] - # This calculates/prints the correct univers version value, which we can then use in the mapping dictionary. - # We'll delete this and to_version_ranges_test() when no longer needed. - affected_version_ranges_TEST = self.to_version_ranges_test( - affected_versions_string_split_SPLIT, fixed_versions_string_split_SPLIT - ) - # print("\naffected_version_ranges_TEST = {}".format(affected_version_ranges_TEST)) - # print("\naffected_versions_string = {}".format(affected_versions_string)) - # print("\nfixed_versions_string = {}".format(fixed_versions_string)) - references = [ Reference(url=self.ASF_PAGE_URL), Reference( @@ -203,127 +180,4 @@ def to_advisory(self, advisory_page): ) ) - # print("\nadvisories[-1] = {}".format(advisories[-1])) - # print("\nadvisories[-1].to_dict() = {}".format(advisories[-1].to_dict())) - - # print("\n========================================") - - # Print a dict of the advisories. - # result = [data.to_dict() for data in advisories] - # print("result = \n") - # print(json.dumps(result, indent=4, sort_keys=False)) - return advisories - - # We use this to calculate the ranges for the hard-coded affected_version_range_mapping. - # We'' delete this when no longer needed. - def to_version_ranges_test(self, versions_data, fixed_versions): - constraints = [] - - for version_item in versions_data: - if "to" in version_item: - version_item_split = version_item.split(" ") - - constraints.append( - VersionConstraint( - comparator=">=", - version=MavenVersion(version_item_split[0]), - ) - ) - constraints.append( - VersionConstraint( - comparator="<=", - version=MavenVersion(version_item_split[-1]), - ) - ) - - elif "-" in version_item: - version_item_split = version_item.split(" ") - - constraints.append( - VersionConstraint( - comparator=">=", - version=MavenVersion(version_item_split[0]), - ) - ) - constraints.append( - VersionConstraint( - comparator="<=", - version=MavenVersion(version_item_split[-1]), - ) - ) - - elif "and later" in version_item: - version_item_split = version_item.split(" ") - - constraints.append( - VersionConstraint( - comparator=">=", - version=MavenVersion(version_item_split[0]), - ) - ) - - else: - version_item_split = version_item.split(" ") - - constraints.append( - VersionConstraint( - comparator="=", - version=MavenVersion(version_item_split[0]), - ) - ) - - for fixed_item in fixed_versions: - if "to" in fixed_item: - fixed_item_split = fixed_item.split(" ") - - constraints.append( - VersionConstraint( - comparator=">=", - version=MavenVersion(fixed_item_split[0]), - ).invert() - ) - constraints.append( - VersionConstraint( - comparator="<=", - version=MavenVersion(fixed_item_split[-1]), - ).invert() - ) - - elif "-" in fixed_item: - fixed_item_split = fixed_item.split(" ") - - constraints.append( - VersionConstraint( - comparator=">=", - version=MavenVersion(fixed_item_split[0]), - ).invert() - ) - constraints.append( - VersionConstraint( - comparator="<=", - version=MavenVersion(fixed_item_split[-1]), - ).invert() - ) - - elif "and later" in fixed_item: - fixed_item_split = fixed_item.split(" ") - - constraints.append( - VersionConstraint( - comparator=">=", - version=MavenVersion(fixed_item_split[0]), - ).invert() - ) - - else: - fixed_item_split = fixed_item.split(" ") - - constraints.append( - VersionConstraint( - comparator="=", - version=MavenVersion(fixed_item_split[0]), - ).invert() - ) - - return MavenVersionRange(constraints=constraints) diff --git a/vulnerabilities/tests/test_apache_kafka.py b/vulnerabilities/tests/test_apache_kafka.py index 1888bcc8d..5646b5554 100644 --- a/vulnerabilities/tests/test_apache_kafka.py +++ b/vulnerabilities/tests/test_apache_kafka.py @@ -7,19 +7,15 @@ # See https://aboutcode.org for more information about nexB OSS projects. # -# temporarily import json to create output to analyze -import json import os import pytest from vulnerabilities.importers.apache_kafka import ApacheKafkaImporter - -# from vulnerabilities.package_managers import GitHubTagsAPI from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) -# Created cve-list-2022-12-06.html with a full copy of https://raw.githubusercontent.com/apache/kafka-site/asf-site/cve-list.html + TEST_DATA = os.path.join( BASE_DIR, "test_data/apache_kafka", @@ -32,23 +28,10 @@ def test_to_advisory(): advisories = ApacheKafkaImporter().to_advisory(raw_data) result = [data.to_dict() for data in advisories] - # TODO: We need to finish this test including the REGEN step. 2022-12-12 Monday 14:48:05. Done. expected_file = os.path.join(TEST_DATA, f"to-advisory-apache_kafka-expected.json") util_tests.check_results_against_json(result, expected_file) - # We generate these 2 files solely to vet the output and adjust the importer code. - # with open(os.path.join(TEST_DATA, "jmh-test-01.txt"), "w") as f1: - # for advisory_object in result: - # f1.write(f"{advisory_object}\n\n") - # for k, v in advisory_object.items(): - # f1.write(f"{k}: {v}\n\n") - # f1.write(f"=================================================\n\n") - - # with open(os.path.join(TEST_DATA, "test-advisories.json"), "w", encoding="utf-8") as f: - # json.dump(result, f, ensure_ascii=False, indent=4) - -# Check for an unknown CVE value. def to_advisory_changed_cve(): with open(os.path.join(TEST_DATA, "cve-list-changed-cve.html")) as f: raw_data = f.read() @@ -62,7 +45,6 @@ def test_to_advisory_changed_cve_exception(): assert "CVE-2022-34918" in str(excinfo.value) -# Check for an unknown "Versions affected" value. def to_advisory_changed_versions_affected(): with open(os.path.join(TEST_DATA, "cve-list-changed-versions-affected.html")) as f: raw_data = f.read() @@ -76,7 +58,6 @@ def test_to_advisory_changed_versions_affected_exception(): assert "2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.2" in str(excinfo.value) -# Check for an unknown "Fixed versions" value. def to_advisory_changed_fixed_versions(): with open(os.path.join(TEST_DATA, "cve-list-changed-fixed-versions.html")) as f: raw_data = f.read() diff --git a/vulnerabilities/tests/test_data/apache_kafka/jmh-test-01.txt b/vulnerabilities/tests/test_data/apache_kafka/jmh-test-01.txt deleted file mode 100644 index e2aeed12f..000000000 --- a/vulnerabilities/tests/test_data/apache_kafka/jmh-test-01.txt +++ /dev/null @@ -1,84 +0,0 @@ -{'aliases': ['CVE-2022-34917'], 'summary': 'This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2022-34917', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917', 'severities': []}], 'date_published': None} - -aliases: ['CVE-2022-34917'] - -summary: This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. - -affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3', 'fixed_version': None}] - -references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2022-34917', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917', 'severities': []}] - -date_published: None - -================================================= - -{'aliases': ['CVE-2021-38153'], 'summary': 'Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2021-38153', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38153', 'severities': []}], 'date_published': None} - -aliases: ['CVE-2021-38153'] - -summary: Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. - -affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0', 'fixed_version': None}] - -references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2021-38153', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38153', 'severities': []}] - -date_published: None - -================================================= - -{'aliases': ['CVE-2019-12399'], 'summary': "When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value (the externalized secret variable is not the whole configuration property value), then any client can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret rather than the externalized secrets variable. Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher where this vulnerability has been fixed.", 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2019-12399', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12399', 'severities': []}], 'date_published': None} - -aliases: ['CVE-2019-12399'] - -summary: When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value (the externalized secret variable is not the whole configuration property value), then any client can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret rather than the externalized secrets variable. Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher where this vulnerability has been fixed. - -affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1', 'fixed_version': None}] - -references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2019-12399', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12399', 'severities': []}] - -date_published: None - -================================================= - -{'aliases': ['CVE-2018-17196'], 'summary': 'In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2018-17196', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196', 'severities': []}], 'date_published': None} - -aliases: ['CVE-2018-17196'] - -summary: In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed. - -affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1', 'fixed_version': None}] - -references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2018-17196', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196', 'severities': []}] - -date_published: None - -================================================= - -{'aliases': ['CVE-2018-1288'], 'summary': 'Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2018-1288', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1288', 'severities': []}], 'date_published': None} - -aliases: ['CVE-2018-1288'] - -summary: Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss. - -affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0', 'fixed_version': None}] - -references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2018-1288', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1288', 'severities': []}] - -date_published: None - -================================================= - -{'aliases': ['CVE-2017-12610'], 'summary': 'Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.', 'affected_packages': [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0', 'fixed_version': None}], 'references': [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2017-12610', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12610', 'severities': []}], 'date_published': None} - -aliases: ['CVE-2017-12610'] - -summary: Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka. - -affected_packages: [{'package': {'type': 'maven', 'namespace': None, 'name': 'apache_kafka', 'version': None, 'qualifiers': None, 'subpath': None}, 'affected_version_range': 'vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0', 'fixed_version': None}] - -references: [{'reference_id': '', 'url': 'https://kafka.apache.org/cve-list', 'severities': []}, {'reference_id': 'CVE-2017-12610', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12610', 'severities': []}] - -date_published: None - -================================================= - From 01ffe7e83ee5cecca42fe0d892b78d436673ca8b Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Wed, 11 Jan 2023 13:32:19 -0800 Subject: [PATCH 03/10] Update `vers:` and package naming #972 Reference: https://github.com/nexB/vulnerablecode/issues/972 Signed-off-by: John M. Horan --- vulnerabilities/importers/apache_kafka.py | 16 ++++---- .../to-advisory-apache_kafka-expected.json | 38 +++++++++---------- 2 files changed, 27 insertions(+), 27 deletions(-) diff --git a/vulnerabilities/importers/apache_kafka.py b/vulnerabilities/importers/apache_kafka.py index a238f0eb1..b23cab0bf 100644 --- a/vulnerabilities/importers/apache_kafka.py +++ b/vulnerabilities/importers/apache_kafka.py @@ -27,7 +27,7 @@ "action": "include", "2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.1": "affected", "2.8.2, 3.0.2, 3.1.2, 3.2.3": "fixed", - "affected_version_range": "vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3", + "affected_version_range": "vers:apache/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3", }, "CVE-2022-23302": { "action": "omit", @@ -51,31 +51,31 @@ "action": "include", "2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, 2.8.0.": "affected", "2.6.3, 2.7.2, 2.8.1, 3.0.0 and later": "fixed", - "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0", + "affected_version_range": "vers:apache/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0", }, "CVE-2019-12399": { "action": "include", "2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0": "affected", "2.2.2, 2.3.1 and later": "fixed", - "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1", + "affected_version_range": "vers:apache/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1", }, "CVE-2018-17196": { "action": "include", "0.11.0.0 to 2.1.0": "affected", "2.1.1 and later": "fixed", - "affected_version_range": "vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1", + "affected_version_range": "vers:apache/>=0.11.0.0|<=2.1.0|<2.1.1", }, "CVE-2018-1288": { "action": "include", "0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, 1.0.0": "affected", "0.10.2.2, 0.11.0.3, 1.0.1, 1.1.0": "fixed", - "affected_version_range": "vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0", + "affected_version_range": "vers:apache/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0", }, "CVE-2017-12610": { "action": "include", "0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.1": "affected", "0.10.2.2, 0.11.0.2, 1.0.0": "fixed", - "affected_version_range": "vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0", + "affected_version_range": "vers:apache/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0", }, } @@ -162,8 +162,8 @@ def to_advisory(self, advisory_page): affected_packages = [] affected_package = AffectedPackage( package=PackageURL( - name="apache_kafka", - type="maven", + name="kafka", + type="apache", ), affected_version_range=affected_version_range_mapping[cve_id][ "affected_version_range" diff --git a/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json index a95a7e835..5b6c51488 100644 --- a/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json +++ b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json @@ -7,14 +7,14 @@ "affected_packages": [ { "package": { - "type": "maven", + "type": "apache", "namespace": null, - "name": "apache_kafka", + "name": "kafka", "version": null, "qualifiers": null, "subpath": null }, - "affected_version_range": "vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3", + "affected_version_range": "vers:apache/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3", "fixed_version": null } ], @@ -40,14 +40,14 @@ "affected_packages": [ { "package": { - "type": "maven", + "type": "apache", "namespace": null, - "name": "apache_kafka", + "name": "kafka", "version": null, "qualifiers": null, "subpath": null }, - "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0", + "affected_version_range": "vers:apache/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0", "fixed_version": null } ], @@ -73,14 +73,14 @@ "affected_packages": [ { "package": { - "type": "maven", + "type": "apache", "namespace": null, - "name": "apache_kafka", + "name": "kafka", "version": null, "qualifiers": null, "subpath": null }, - "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1", + "affected_version_range": "vers:apache/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1", "fixed_version": null } ], @@ -106,14 +106,14 @@ "affected_packages": [ { "package": { - "type": "maven", + "type": "apache", "namespace": null, - "name": "apache_kafka", + "name": "kafka", "version": null, "qualifiers": null, "subpath": null }, - "affected_version_range": "vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1", + "affected_version_range": "vers:apache/>=0.11.0.0|<=2.1.0|<2.1.1", "fixed_version": null } ], @@ -139,14 +139,14 @@ "affected_packages": [ { "package": { - "type": "maven", + "type": "apache", "namespace": null, - "name": "apache_kafka", + "name": "kafka", "version": null, "qualifiers": null, "subpath": null }, - "affected_version_range": "vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0", + "affected_version_range": "vers:apache/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0", "fixed_version": null } ], @@ -172,14 +172,14 @@ "affected_packages": [ { "package": { - "type": "maven", + "type": "apache", "namespace": null, - "name": "apache_kafka", + "name": "kafka", "version": null, "qualifiers": null, "subpath": null }, - "affected_version_range": "vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0", + "affected_version_range": "vers:apache/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0", "fixed_version": null } ], @@ -197,4 +197,4 @@ ], "date_published": null } -] \ No newline at end of file +] From a9f48423c603fa396d8b14c7d1baa776e8e85d13 Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Mon, 23 Jan 2023 17:11:34 -0800 Subject: [PATCH 04/10] Prepare to run apache_kafka importer #972 Signed-off-by: John M. Horan --- vulnerabilities/importers/__init__.py | 2 ++ vulnerabilities/tests/conftest.py | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/vulnerabilities/importers/__init__.py b/vulnerabilities/importers/__init__.py index 435d940e6..4a2fd6ac7 100644 --- a/vulnerabilities/importers/__init__.py +++ b/vulnerabilities/importers/__init__.py @@ -9,6 +9,7 @@ from vulnerabilities.importers import alpine_linux from vulnerabilities.importers import apache_httpd +from vulnerabilities.importers import apache_kafka from vulnerabilities.importers import apache_tomcat from vulnerabilities.importers import archlinux from vulnerabilities.importers import debian @@ -63,6 +64,7 @@ xen.XenImporter, ubuntu_usn.UbuntuUSNImporter, fireeye.FireyeImporter, + apache_kafka.ApacheKafkaImporter, ] IMPORTERS_REGISTRY = {x.qualified_name: x for x in IMPORTERS_REGISTRY} diff --git a/vulnerabilities/tests/conftest.py b/vulnerabilities/tests/conftest.py index e759b1db6..de7bb560a 100644 --- a/vulnerabilities/tests/conftest.py +++ b/vulnerabilities/tests/conftest.py @@ -25,7 +25,6 @@ def no_rmtree(monkeypatch): # Step 2: Run test for importer only if it is activated (pytestmark = pytest.mark.skipif(...)) # Step 3: Migrate all the tests collect_ignore = [ - "test_apache_kafka.py", "test_models.py", "test_package_managers.py", "test_ruby.py", From bd69a8f9da35c30adeb850e0847da5caec818a05 Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Tue, 24 Jan 2023 13:41:00 -0800 Subject: [PATCH 05/10] Fix NotImplementedError #972 Reference: https://github.com/nexB/vulnerablecode/issues/972 Signed-off-by: John M. Horan --- vulnerabilities/importers/apache_kafka.py | 2 +- .../to-advisory-apache_kafka-expected.json | 20 ++++++++++++------- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/vulnerabilities/importers/apache_kafka.py b/vulnerabilities/importers/apache_kafka.py index b23cab0bf..5bcd9d1ae 100644 --- a/vulnerabilities/importers/apache_kafka.py +++ b/vulnerabilities/importers/apache_kafka.py @@ -92,7 +92,7 @@ def fetch_advisory_page(self): page = requests.get(self.GH_PAGE_URL) return page.content - def updated_advisories(self): + def advisory_data(self): advisory_page = self.fetch_advisory_page() parsed_data = self.to_advisory(advisory_page) diff --git a/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json index 5b6c51488..353c9504a 100644 --- a/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json +++ b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json @@ -30,7 +30,8 @@ "severities": [] } ], - "date_published": null + "date_published": null, + "weaknesses": [] }, { "aliases": [ @@ -63,7 +64,8 @@ "severities": [] } ], - "date_published": null + "date_published": null, + "weaknesses": [] }, { "aliases": [ @@ -96,7 +98,8 @@ "severities": [] } ], - "date_published": null + "date_published": null, + "weaknesses": [] }, { "aliases": [ @@ -129,7 +132,8 @@ "severities": [] } ], - "date_published": null + "date_published": null, + "weaknesses": [] }, { "aliases": [ @@ -162,7 +166,8 @@ "severities": [] } ], - "date_published": null + "date_published": null, + "weaknesses": [] }, { "aliases": [ @@ -195,6 +200,7 @@ "severities": [] } ], - "date_published": null + "date_published": null, + "weaknesses": [] } -] +] \ No newline at end of file From 33bf05a66376a96f6158f6125ec512d31d9e6865 Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Tue, 24 Jan 2023 14:22:16 -0800 Subject: [PATCH 06/10] Fix additional import errors #972 Reference: https://github.com/nexB/vulnerablecode/issues/972 Signed-off-by: John M. Horan --- vulnerabilities/importers/apache_kafka.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vulnerabilities/importers/apache_kafka.py b/vulnerabilities/importers/apache_kafka.py index 5bcd9d1ae..05ea82d20 100644 --- a/vulnerabilities/importers/apache_kafka.py +++ b/vulnerabilities/importers/apache_kafka.py @@ -93,10 +93,10 @@ def fetch_advisory_page(self): return page.content def advisory_data(self): - advisory_page = self.fetch_advisory_page() + advisory_page = self.fetch_advisory_page(self) parsed_data = self.to_advisory(advisory_page) - return self.batch_advisories(parsed_data) + return parsed_data def to_advisory(self, advisory_page): advisories = [] From daca89d570ba42674162ce69af3bad8863e169f5 Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Wed, 25 Jan 2023 10:00:44 -0800 Subject: [PATCH 07/10] Correct manual version range error #972 Reference: https://github.com/nexB/vulnerablecode/issues/972 Signed-off-by: John M. Horan --- vulnerabilities/importers/apache_kafka.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vulnerabilities/importers/apache_kafka.py b/vulnerabilities/importers/apache_kafka.py index 05ea82d20..0aac811d4 100644 --- a/vulnerabilities/importers/apache_kafka.py +++ b/vulnerabilities/importers/apache_kafka.py @@ -63,7 +63,7 @@ "action": "include", "0.11.0.0 to 2.1.0": "affected", "2.1.1 and later": "fixed", - "affected_version_range": "vers:apache/>=0.11.0.0|<=2.1.0|<2.1.1", + "affected_version_range": "vers:apache/>=0.11.0.0|<2.1.1", }, "CVE-2018-1288": { "action": "include", From 6b2cd15e56b1954b1d51683161a74ee7d0bc905d Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Wed, 25 Jan 2023 10:11:15 -0800 Subject: [PATCH 08/10] Fix failing test #972 Reference: https://github.com/nexB/vulnerablecode/issues/972 Signed-off-by: John M. Horan --- .../apache_kafka/to-advisory-apache_kafka-expected.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json index 353c9504a..59d962619 100644 --- a/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json +++ b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json @@ -116,7 +116,7 @@ "qualifiers": null, "subpath": null }, - "affected_version_range": "vers:apache/>=0.11.0.0|<=2.1.0|<2.1.1", + "affected_version_range": "vers:apache/>=0.11.0.0|<2.1.1", "fixed_version": null } ], From 2776cb28607b332c9b2d3b482a406daeac1606a8 Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Mon, 30 Jan 2023 14:49:59 -0800 Subject: [PATCH 09/10] Address PR comments including simplifying code #972 Reference: https://github.com/nexB/vulnerablecode/issues/972 Signed-off-by: John M. Horan --- vulnerabilities/importers/apache_kafka.py | 66 +++--- .../apache_kafka/test-advisories.json | 200 ------------------ .../to-advisory-apache_kafka-expected.json | 66 ++++-- 3 files changed, 84 insertions(+), 248 deletions(-) delete mode 100644 vulnerabilities/tests/test_data/apache_kafka/test-advisories.json diff --git a/vulnerabilities/importers/apache_kafka.py b/vulnerabilities/importers/apache_kafka.py index 0aac811d4..c1e76785b 100644 --- a/vulnerabilities/importers/apache_kafka.py +++ b/vulnerabilities/importers/apache_kafka.py @@ -8,12 +8,11 @@ # +import pytz import requests from bs4 import BeautifulSoup +from dateutil.parser import parse from packageurl import PackageURL -from univers.version_constraint import VersionConstraint -from univers.version_range import MavenVersionRange -from univers.versions import MavenVersion from vulnerabilities.importer import AdvisoryData from vulnerabilities.importer import AffectedPackage @@ -28,6 +27,7 @@ "2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.1": "affected", "2.8.2, 3.0.2, 3.1.2, 3.2.3": "fixed", "affected_version_range": "vers:apache/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3", + "Issue announced": "19 Sep 2022", }, "CVE-2022-23302": { "action": "omit", @@ -52,30 +52,35 @@ "2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, 2.8.0.": "affected", "2.6.3, 2.7.2, 2.8.1, 3.0.0 and later": "fixed", "affected_version_range": "vers:apache/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0", + "Issue announced": "21 Sep 2021", }, "CVE-2019-12399": { "action": "include", "2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0": "affected", "2.2.2, 2.3.1 and later": "fixed", "affected_version_range": "vers:apache/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1", + "Issue announced": "13 Jan 2020", }, "CVE-2018-17196": { "action": "include", "0.11.0.0 to 2.1.0": "affected", "2.1.1 and later": "fixed", "affected_version_range": "vers:apache/>=0.11.0.0|<2.1.1", + "Issue announced": "10 July 2019", }, "CVE-2018-1288": { "action": "include", "0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, 1.0.0": "affected", "0.10.2.2, 0.11.0.3, 1.0.1, 1.1.0": "fixed", "affected_version_range": "vers:apache/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0", + "Issue announced": "26 July 2018", }, "CVE-2017-12610": { "action": "include", "0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.1": "affected", "0.10.2.2, 0.11.0.2, 1.0.0": "fixed", "affected_version_range": "vers:apache/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0", + "Issue announced": "26 July 2018", }, } @@ -111,33 +116,24 @@ def to_advisory(self, advisory_page): cve_description_paragraph = cve_section_beginning.find_next_sibling("p") - stripped_cve_description_paragraph = str(cve_description_paragraph.get_text()) - stripped_cve_description_paragraph = stripped_cve_description_paragraph.replace( - "\n", "" - ) - stripped_cve_description_paragraph = " ".join( - stripped_cve_description_paragraph.split() - ) + description = str(cve_description_paragraph.get_text()) + description = " ".join(description.split()) cve_data_table = cve_section_beginning.find_next_sibling("table") cve_data_table_rows = cve_data_table.find_all("tr") affected_versions_row = cve_data_table_rows[0] fixed_versions_row = cve_data_table_rows[1] - affected_versions_string = affected_versions_row.find_all("td")[1].text - fixed_versions_string = fixed_versions_row.find_all("td")[1].text - # Remove leading white space after initial comma - affected_versions_string_split_SPLIT = [ - substring.strip() - for substring in affected_versions_string.split(",") - if not substring.isspace() - ] - fixed_versions_string_split_SPLIT = [ - substring.strip() - for substring in fixed_versions_string.split(",") - if not substring.isspace() - ] + affected_versions = affected_versions_row.find_all("td")[1].text + + affected_versions_clean = [v.strip() for v in affected_versions.split(",")] + affected_versions_clean = [v for v in affected_versions if v] + + fixed_versions = fixed_versions_row.find_all("td")[1].text + + fixed_versions_clean = [v.strip() for v in fixed_versions.split(",")] + fixed_versions_clean = [v for v in fixed_versions if v] # This throws a KeyError if the opening h2 tag `id` data changes or is not in the # hard-coded affected_version_range_mapping dictionary. @@ -145,16 +141,21 @@ def to_advisory(self, advisory_page): # These 2 variables (not used elsewhere) trigger the KeyError for changed/missing data. check_affected_versions_key = affected_version_range_mapping[cve_id][ - affected_versions_string - ] - check_fixed_versions_key = affected_version_range_mapping[cve_id][ - fixed_versions_string + affected_versions ] + check_fixed_versions_key = affected_version_range_mapping[cve_id][fixed_versions] references = [ - Reference(url=self.ASF_PAGE_URL), Reference( - url=f"https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve_id}", + url=self.ASF_PAGE_URL, + reference_id=cve_id, + ), + Reference( + url=f"{self.ASF_PAGE_URL}#{cve_id}", + reference_id=cve_id, + ), + Reference( + url=f"https://nvd.nist.gov/vuln/detail/{cve_id}", reference_id=cve_id, ), ] @@ -171,12 +172,17 @@ def to_advisory(self, advisory_page): ) affected_packages.append(affected_package) + date_published = parse( + affected_version_range_mapping[cve_id]["Issue announced"] + ).replace(tzinfo=pytz.UTC) + advisories.append( AdvisoryData( aliases=[cve_id], - summary=stripped_cve_description_paragraph, + summary=description, affected_packages=affected_packages, references=references, + date_published=date_published, ) ) diff --git a/vulnerabilities/tests/test_data/apache_kafka/test-advisories.json b/vulnerabilities/tests/test_data/apache_kafka/test-advisories.json deleted file mode 100644 index ccf707541..000000000 --- a/vulnerabilities/tests/test_data/apache_kafka/test-advisories.json +++ /dev/null @@ -1,200 +0,0 @@ -[ - { - "aliases": [ - "CVE-2022-34917" - ], - "summary": "This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service.", - "affected_packages": [ - { - "package": { - "type": "maven", - "namespace": null, - "name": "apache_kafka", - "version": null, - "qualifiers": null, - "subpath": null - }, - "affected_version_range": "vers:maven/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3", - "fixed_version": null - } - ], - "references": [ - { - "reference_id": "", - "url": "https://kafka.apache.org/cve-list", - "severities": [] - }, - { - "reference_id": "CVE-2022-34917", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917", - "severities": [] - } - ], - "date_published": null - }, - { - "aliases": [ - "CVE-2021-38153" - ], - "summary": "Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed.", - "affected_packages": [ - { - "package": { - "type": "maven", - "namespace": null, - "name": "apache_kafka", - "version": null, - "qualifiers": null, - "subpath": null - }, - "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0", - "fixed_version": null - } - ], - "references": [ - { - "reference_id": "", - "url": "https://kafka.apache.org/cve-list", - "severities": [] - }, - { - "reference_id": "CVE-2021-38153", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38153", - "severities": [] - } - ], - "date_published": null - }, - { - "aliases": [ - "CVE-2019-12399" - ], - "summary": "When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value (the externalized secret variable is not the whole configuration property value), then any client can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret rather than the externalized secrets variable. Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher where this vulnerability has been fixed.", - "affected_packages": [ - { - "package": { - "type": "maven", - "namespace": null, - "name": "apache_kafka", - "version": null, - "qualifiers": null, - "subpath": null - }, - "affected_version_range": "vers:maven/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1", - "fixed_version": null - } - ], - "references": [ - { - "reference_id": "", - "url": "https://kafka.apache.org/cve-list", - "severities": [] - }, - { - "reference_id": "CVE-2019-12399", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12399", - "severities": [] - } - ], - "date_published": null - }, - { - "aliases": [ - "CVE-2018-17196" - ], - "summary": "In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.", - "affected_packages": [ - { - "package": { - "type": "maven", - "namespace": null, - "name": "apache_kafka", - "version": null, - "qualifiers": null, - "subpath": null - }, - "affected_version_range": "vers:maven/>=0.11.0.0|<=2.1.0|<2.1.1", - "fixed_version": null - } - ], - "references": [ - { - "reference_id": "", - "url": "https://kafka.apache.org/cve-list", - "severities": [] - }, - { - "reference_id": "CVE-2018-17196", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196", - "severities": [] - } - ], - "date_published": null - }, - { - "aliases": [ - "CVE-2018-1288" - ], - "summary": "Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.", - "affected_packages": [ - { - "package": { - "type": "maven", - "namespace": null, - "name": "apache_kafka", - "version": null, - "qualifiers": null, - "subpath": null - }, - "affected_version_range": "vers:maven/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0", - "fixed_version": null - } - ], - "references": [ - { - "reference_id": "", - "url": "https://kafka.apache.org/cve-list", - "severities": [] - }, - { - "reference_id": "CVE-2018-1288", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1288", - "severities": [] - } - ], - "date_published": null - }, - { - "aliases": [ - "CVE-2017-12610" - ], - "summary": "Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.", - "affected_packages": [ - { - "package": { - "type": "maven", - "namespace": null, - "name": "apache_kafka", - "version": null, - "qualifiers": null, - "subpath": null - }, - "affected_version_range": "vers:maven/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0", - "fixed_version": null - } - ], - "references": [ - { - "reference_id": "", - "url": "https://kafka.apache.org/cve-list", - "severities": [] - }, - { - "reference_id": "CVE-2017-12610", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12610", - "severities": [] - } - ], - "date_published": null - } -] \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json index 59d962619..fa06164cf 100644 --- a/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json +++ b/vulnerabilities/tests/test_data/apache_kafka/to-advisory-apache_kafka-expected.json @@ -20,17 +20,22 @@ ], "references": [ { - "reference_id": "", + "reference_id": "CVE-2022-34917", "url": "https://kafka.apache.org/cve-list", "severities": [] }, { "reference_id": "CVE-2022-34917", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917", + "url": "https://kafka.apache.org/cve-list#CVE-2022-34917", + "severities": [] + }, + { + "reference_id": "CVE-2022-34917", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34917", "severities": [] } ], - "date_published": null, + "date_published": "2022-09-19T00:00:00+00:00", "weaknesses": [] }, { @@ -54,17 +59,22 @@ ], "references": [ { - "reference_id": "", + "reference_id": "CVE-2021-38153", "url": "https://kafka.apache.org/cve-list", "severities": [] }, { "reference_id": "CVE-2021-38153", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38153", + "url": "https://kafka.apache.org/cve-list#CVE-2021-38153", + "severities": [] + }, + { + "reference_id": "CVE-2021-38153", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38153", "severities": [] } ], - "date_published": null, + "date_published": "2021-09-21T00:00:00+00:00", "weaknesses": [] }, { @@ -88,17 +98,22 @@ ], "references": [ { - "reference_id": "", + "reference_id": "CVE-2019-12399", "url": "https://kafka.apache.org/cve-list", "severities": [] }, { "reference_id": "CVE-2019-12399", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12399", + "url": "https://kafka.apache.org/cve-list#CVE-2019-12399", + "severities": [] + }, + { + "reference_id": "CVE-2019-12399", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12399", "severities": [] } ], - "date_published": null, + "date_published": "2020-01-13T00:00:00+00:00", "weaknesses": [] }, { @@ -122,17 +137,22 @@ ], "references": [ { - "reference_id": "", + "reference_id": "CVE-2018-17196", "url": "https://kafka.apache.org/cve-list", "severities": [] }, { "reference_id": "CVE-2018-17196", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196", + "url": "https://kafka.apache.org/cve-list#CVE-2018-17196", + "severities": [] + }, + { + "reference_id": "CVE-2018-17196", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17196", "severities": [] } ], - "date_published": null, + "date_published": "2019-07-10T00:00:00+00:00", "weaknesses": [] }, { @@ -156,17 +176,22 @@ ], "references": [ { - "reference_id": "", + "reference_id": "CVE-2018-1288", "url": "https://kafka.apache.org/cve-list", "severities": [] }, { "reference_id": "CVE-2018-1288", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1288", + "url": "https://kafka.apache.org/cve-list#CVE-2018-1288", + "severities": [] + }, + { + "reference_id": "CVE-2018-1288", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1288", "severities": [] } ], - "date_published": null, + "date_published": "2018-07-26T00:00:00+00:00", "weaknesses": [] }, { @@ -190,17 +215,22 @@ ], "references": [ { - "reference_id": "", + "reference_id": "CVE-2017-12610", "url": "https://kafka.apache.org/cve-list", "severities": [] }, { "reference_id": "CVE-2017-12610", - "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12610", + "url": "https://kafka.apache.org/cve-list#CVE-2017-12610", + "severities": [] + }, + { + "reference_id": "CVE-2017-12610", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12610", "severities": [] } ], - "date_published": null, + "date_published": "2018-07-26T00:00:00+00:00", "weaknesses": [] } ] \ No newline at end of file From e33e18d7325137b66b5b20ce286c58014103bb49 Mon Sep 17 00:00:00 2001 From: "John M. Horan" Date: Wed, 8 Feb 2023 12:54:00 -0800 Subject: [PATCH 10/10] Replace long mapping reference with variable #972 Reference: https://github.com/nexB/vulnerablecode/issues/972 Signed-off-by: John M. Horan --- vulnerabilities/importers/apache_kafka.py | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/vulnerabilities/importers/apache_kafka.py b/vulnerabilities/importers/apache_kafka.py index c1e76785b..96b55748f 100644 --- a/vulnerabilities/importers/apache_kafka.py +++ b/vulnerabilities/importers/apache_kafka.py @@ -137,13 +137,11 @@ def to_advisory(self, advisory_page): # This throws a KeyError if the opening h2 tag `id` data changes or is not in the # hard-coded affected_version_range_mapping dictionary. - if affected_version_range_mapping[cve_id]["action"] == "include": - + cve_version_mapping = affected_version_range_mapping[cve_id] + if cve_version_mapping["action"] == "include": # These 2 variables (not used elsewhere) trigger the KeyError for changed/missing data. - check_affected_versions_key = affected_version_range_mapping[cve_id][ - affected_versions - ] - check_fixed_versions_key = affected_version_range_mapping[cve_id][fixed_versions] + check_affected_versions_key = cve_version_mapping[affected_versions] + check_fixed_versions_key = cve_version_mapping[fixed_versions] references = [ Reference( @@ -166,15 +164,13 @@ def to_advisory(self, advisory_page): name="kafka", type="apache", ), - affected_version_range=affected_version_range_mapping[cve_id][ - "affected_version_range" - ], + affected_version_range=cve_version_mapping["affected_version_range"], ) affected_packages.append(affected_package) - date_published = parse( - affected_version_range_mapping[cve_id]["Issue announced"] - ).replace(tzinfo=pytz.UTC) + date_published = parse(cve_version_mapping["Issue announced"]).replace( + tzinfo=pytz.UTC + ) advisories.append( AdvisoryData(