diff --git a/CHANGELOG.rst b/CHANGELOG.rst index a5ac3e847..603554deb 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -2,6 +2,12 @@ Release notes ============= +Next release +---------------- + +- We re-enabled support for the mozilla vulnerabilities advisories importer. + + Version v31.1.1 --------------- diff --git a/vulnerabilities/importers/__init__.py b/vulnerabilities/importers/__init__.py index 2831c1060..b1ac00bd4 100644 --- a/vulnerabilities/importers/__init__.py +++ b/vulnerabilities/importers/__init__.py @@ -14,6 +14,7 @@ from vulnerabilities.importers import debian_oval from vulnerabilities.importers import github from vulnerabilities.importers import gitlab +from vulnerabilities.importers import mozilla from vulnerabilities.importers import nginx from vulnerabilities.importers import npm from vulnerabilities.importers import nvd @@ -43,6 +44,7 @@ npm.NpmImporter, retiredotnet.RetireDotnetImporter, apache_httpd.ApacheHTTPDImporter, + mozilla.MozillaImporter, ] IMPORTERS_REGISTRY = {x.qualified_name: x for x in IMPORTERS_REGISTRY} diff --git a/vulnerabilities/importers/mozilla.py b/vulnerabilities/importers/mozilla.py index cf53d2499..1cdaac357 100644 --- a/vulnerabilities/importers/mozilla.py +++ b/vulnerabilities/importers/mozilla.py @@ -7,73 +7,74 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import logging import re +from pathlib import Path +from typing import Iterable from typing import List -from typing import Set import yaml from bs4 import BeautifulSoup from markdown import markdown from packageurl import PackageURL +from univers.versions import SemverVersion from vulnerabilities import severity_systems from vulnerabilities.importer import AdvisoryData -from vulnerabilities.importer import GitImporter +from vulnerabilities.importer import AffectedPackage +from vulnerabilities.importer import Importer from vulnerabilities.importer import Reference from vulnerabilities.importer import VulnerabilitySeverity from vulnerabilities.utils import is_cve from vulnerabilities.utils import split_markdown_front_matter -REPOSITORY = "mozilla/foundation-security-advisories" MFSA_FILENAME_RE = re.compile(r"mfsa(\d{4}-\d{2,3})\.(md|yml)$") +logger = logging.getLogger(__name__) -class MozillaImporter(GitImporter): - def __enter__(self): - super(MozillaImporter, self).__enter__() +class MozillaImporter(Importer): + spdx_license_expression = "MPL-2.0" + license_url = "https://github.com/mozilla/foundation-security-advisories/blob/master/LICENSE" + repo_url = "git+https://github.com/mozilla/foundation-security-advisories/" - if not getattr(self, "_added_files", None): - self._added_files, self._updated_files = self.file_changes( - recursive=True, subdir="announce" - ) - - def updated_advisories(self) -> Set[AdvisoryData]: - files = self._updated_files.union(self._added_files) - files = [ - f for f in files if f.endswith(".md") or f.endswith(".yml") - ] # skip irrelevant files + def advisory_data(self) -> Iterable[AdvisoryData]: + try: + self.clone(self.repo_url) + path = Path(self.vcs_response.dest_dir) - advisories = [] - for path in files: - advisories.extend(to_advisories(path)) + vuln = path / "announce" + paths = list(vuln.glob("**/*.yml")) + list(vuln.glob("**/*.md")) + for file_path in paths: + yield from to_advisories(file_path) + finally: + if self.vcs_response: + self.vcs_response.delete() - return self.batch_advisories(advisories) - -def to_advisories(path: str) -> List[AdvisoryData]: +def to_advisories(path: Path) -> List[AdvisoryData]: """ Convert a file to corresponding advisories. This calls proper method to handle yml/md files. """ + path = str(path) mfsa_id = mfsa_id_from_filename(path) if not mfsa_id: return [] with open(path) as lines: if path.endswith(".md"): - return get_advisories_from_md(mfsa_id, lines) + yield from get_advisories_from_md(mfsa_id, lines) if path.endswith(".yml"): - return get_advisories_from_yml(mfsa_id, lines) + yield from get_advisories_from_yml(mfsa_id, lines) return [] def get_advisories_from_yml(mfsa_id, lines) -> List[AdvisoryData]: - advisories = [] data = yaml.safe_load(lines) data["mfsa_id"] = mfsa_id - fixed_package_urls = get_package_urls(data.get("fixed_in")) + affected_packages = get_affected_packages(data.get("fixed_in") or []) references = get_yml_references(data) if not data.get("advisories"): @@ -82,18 +83,13 @@ def get_advisories_from_yml(mfsa_id, lines) -> List[AdvisoryData]: for cve, advisory in data["advisories"].items(): # These may contain HTML tags summary = BeautifulSoup(advisory.get("description", ""), features="lxml").get_text() - - advisories.append( - AdvisoryData( + if is_cve(cve): + yield AdvisoryData( summary=summary, - vulnerability_id=cve if is_cve(cve) else "", - impacted_package_urls=[], - resolved_package_urls=fixed_package_urls, + aliases=[cve], references=references, + affected_packages=list(affected_packages), ) - ) - - return advisories def get_advisories_from_md(mfsa_id, lines) -> List[AdvisoryData]: @@ -101,28 +97,21 @@ def get_advisories_from_md(mfsa_id, lines) -> List[AdvisoryData]: data = yaml.safe_load(yamltext) data["mfsa_id"] = mfsa_id - fixed_package_urls = get_package_urls(data.get("fixed_in")) + affected_packages = get_affected_packages(data.get("fixed_in") or []) references = get_yml_references(data) cves = re.findall(r"CVE-\d+-\d+", yamltext + mdtext, re.IGNORECASE) + description = html_get_p_under_h3(markdown(mdtext), "description") for cve in cves: - references.append( - Reference( - reference_id=cve, - url=f"https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve}", - ) + cve_ref = Reference( + reference_id=cve, + url=f"https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve}", ) - - description = html_get_p_under_h3(markdown(mdtext), "description") - - return [ - AdvisoryData( + yield AdvisoryData( summary=description, - vulnerability_id="", - impacted_package_urls=[], - resolved_package_urls=fixed_package_urls, - references=references, + aliases=[cve], + affected_packages=list(affected_packages), + references=references + [cve_ref], ) - ] def html_get_p_under_h3(html, h3: str): @@ -146,18 +135,28 @@ def mfsa_id_from_filename(filename): return None -def get_package_urls(pkgs: List[str]) -> List[PackageURL]: - package_urls = [ - PackageURL( - type="mozilla", +def get_affected_packages(pkgs: List[str]) -> List[PackageURL]: + for pkg in pkgs: + if not pkg: + continue # pkg is of the form "Firefox ESR 1.21" or "Thunderbird 2.21" - name=pkg.rsplit(None, 1)[0], - version=pkg.rsplit(None, 1)[1], - ) - for pkg in pkgs - if pkg - ] - return package_urls + name, _, version = pkg.rpartition(" ") + if version and name: + try: + # count no of "." in version + # if 3, then it is not a valid semver version + if version.count(".") == 3: + continue + fixed_version = SemverVersion(version) + yield AffectedPackage( + package=PackageURL( + type="mozilla", + name=name, + ), + fixed_version=fixed_version, + ) + except Exception: + logger.exception(f"Error parsing version {version} for {name}") def get_yml_references(data: any) -> List[Reference]: diff --git a/vulnerabilities/tests/conftest.py b/vulnerabilities/tests/conftest.py index 945af0ea6..392b1312d 100644 --- a/vulnerabilities/tests/conftest.py +++ b/vulnerabilities/tests/conftest.py @@ -32,7 +32,6 @@ def no_rmtree(monkeypatch): "test_gentoo.py", "test_istio.py", "test_models.py", - "test_mozilla.py", "test_msr2019.py", "test_package_managers.py", "test_ruby.py", diff --git a/vulnerabilities/tests/test_data/mozilla.zip b/vulnerabilities/tests/test_data/mozilla.zip deleted file mode 100644 index a572c4e9a..000000000 Binary files a/vulnerabilities/tests/test_data/mozilla.zip and /dev/null differ diff --git a/vulnerabilities/tests/test_data/mozilla/expected-md.json b/vulnerabilities/tests/test_data/mozilla/expected-md.json new file mode 100644 index 000000000..8dd75f930 --- /dev/null +++ b/vulnerabilities/tests/test_data/mozilla/expected-md.json @@ -0,0 +1,41 @@ +[ + { + "aliases": [ + "CVE-2006-0294" + ], + "summary": "Dynamically changing the style of an element from position:relative\nto position:static can cause Gecko to operate on freed memory.\nIt may be possible to exploit this in order to run arbitrary\ncode.This flaw was introduced during Firefox 1.5 and SeaMonkey 1.0\ndevelopment and does not affect Firefox 1.0 or the Mozilla Suite 1.7Thunderbird 1.5 could be vulnerable if JavaScript is\nenabled in mail. This is not the default setting and we strongly\ndiscourage users from turning on JavaScript in mail. Thunderbird\nis not vulnerable in its default configuration.Update (13 April 2006)\nThis flaw has been fixed in Thunderbird 1.5.0.2", + "affected_packages": [ + { + "package": { + "type": "mozilla", + "namespace": null, + "name": "SeaMonkey", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "1.0.0" + } + ], + "references": [ + { + "reference_id": "mfsa2006-02", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2006-02", + "severities": [ + { + "system": "generic_textual", + "value": "none", + "scoring_elements": "" + } + ] + }, + { + "reference_id": "CVE-2006-0294", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0294", + "severities": [] + } + ], + "date_published": null + } +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/mozilla/expected-yml.json b/vulnerabilities/tests/test_data/mozilla/expected-yml.json new file mode 100644 index 000000000..0ff310fc7 --- /dev/null +++ b/vulnerabilities/tests/test_data/mozilla/expected-yml.json @@ -0,0 +1,414 @@ +[ + { + "aliases": [ + "CVE-2022-22746" + ], + "summary": "A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.*This bug only affects Firefox for Windows. Other operating systems are unaffected.*\n", + "affected_packages": [ + { + "package": { + "type": "mozilla", + "namespace": null, + "name": "Firefox", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "96.0.0" + } + ], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22743" + ], + "summary": "When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22742" + ], + "summary": "When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22741" + ], + "summary": "When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22740" + ], + "summary": "Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22738" + ], + "summary": "Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22737" + ], + "summary": "Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2021-4140" + ], + "summary": "It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22750" + ], + "summary": "By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged process should not have access to.*This bug only affects Firefox for Windows and MacOS. Other operating systems are unaffected.*\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22749" + ], + "summary": "When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.*This bug only affects Firefox for Android. Other operating systems are unaffected.*\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22748" + ], + "summary": "Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22745" + ], + "summary": "Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22744" + ], + "summary": "The constructed curl command from the \"Copy as curl\" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.*This bug only affects Firefox for Windows. Other operating systems are unaffected.*\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22763" + ], + "summary": "When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22747" + ], + "summary": "After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22736" + ], + "summary": "If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.*This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.*\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22739" + ], + "summary": "Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22751" + ], + "summary": "Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + }, + { + "aliases": [ + "CVE-2022-22752" + ], + "summary": "Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.\n", + "affected_packages": [], + "references": [ + { + "reference_id": "mfsa2022-01", + "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-01", + "severities": [ + { + "system": "generic_textual", + "value": "high", + "scoring_elements": "" + } + ] + } + ], + "date_published": null + } +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/mozilla/mfsa2006-02.md b/vulnerabilities/tests/test_data/mozilla/mfsa2006-02.md new file mode 100644 index 000000000..4c3c0165a --- /dev/null +++ b/vulnerabilities/tests/test_data/mozilla/mfsa2006-02.md @@ -0,0 +1,43 @@ +--- +announced: February 1, 2006 +fixed_in: +- Firefox 1.5.0.1 +- SeaMonkey 1.0 +- Thunderbird 1.5.0.2 +impact: Moderate +reporter: Martijn Wargers +title: Changing position:relative to static corrupts memory +--- + +

Description

+ +

Dynamically changing the style of an element from position:relative +to position:static can cause Gecko to operate on freed memory. +It may be possible to exploit this in order to run arbitrary +code.

+ +

This flaw was introduced during Firefox 1.5 and SeaMonkey 1.0 +development and does not affect Firefox 1.0 or the Mozilla Suite 1.7

+ +

Thunderbird 1.5 could be vulnerable if JavaScript is +enabled in mail. This is not the default setting and we strongly +discourage users from turning on JavaScript in mail. Thunderbird +is not vulnerable in its default configuration.

+ +

Update (13 April 2006)
+This flaw has been fixed in Thunderbird 1.5.0.2

+ +

Workaround

+ +

Upgrade to the fixed versions. Do not enable JavaScript in Thunderbird +or SeaMonkey mail.

+ +

References

+ + + + diff --git a/vulnerabilities/tests/test_data/mozilla/mfsa2022-01.yml b/vulnerabilities/tests/test_data/mozilla/mfsa2022-01.yml new file mode 100644 index 000000000..246b44d5a --- /dev/null +++ b/vulnerabilities/tests/test_data/mozilla/mfsa2022-01.yml @@ -0,0 +1,161 @@ +## mfsa2022-01.yml +announced: January 11, 2022 +impact: high +fixed_in: +- Firefox 96 +title: Security Vulnerabilities fixed in Firefox 96 +advisories: + CVE-2022-22746: + title: Calling into reportValidity could have lead to fullscreen window spoof + impact: high + reporter: Irvan Kurniawan + description: | + A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.
*This bug only affects Firefox for Windows. Other operating systems are unaffected.* + bugs: + - url: 1735071 + CVE-2022-22743: + title: Browser window spoof using fullscreen mode + impact: high + reporter: Irvan Kurniawan + description: | + When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. + bugs: + - url: 1739220 + CVE-2022-22742: + title: Out-of-bounds memory access when inserting text in edit mode + impact: high + reporter: Irvan Kurniawan + description: | + When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. + bugs: + - url: 1739923 + CVE-2022-22741: + title: Browser window spoof using fullscreen mode + impact: high + reporter: Irvan Kurniawan + description: | + When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. + bugs: + - url: 1740389 + CVE-2022-22740: + title: 'Use-after-free of ChannelEventQueue::mOwner' + impact: high + reporter: bo13oy of Cyber Kunlun Lab + description: | + Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. + bugs: + - url: 1742334 + CVE-2022-22738: + title: Heap-buffer-overflow in blendGaussianBlur + impact: high + reporter: Atte Kettunen + description: | + Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. + bugs: + - url: 1742382 + CVE-2022-22737: + title: Race condition when playing audio files + impact: high + reporter: bo13oy of Cyber Kunlun Lab + description: | + Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. + bugs: + - url: 1745874 + CVE-2021-4140: + title: Iframe sandbox bypass with XSLT + impact: high + reporter: Peter Van der Beken + description: | + It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. + bugs: + - url: 1746720 + CVE-2022-22750: + title: IPC passing of resource handles could have lead to sandbox bypass + impact: moderate + reporter: Jed Davis + description: | + By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged process should not have access to.
*This bug only affects Firefox for Windows and MacOS. Other operating systems are unaffected.* + bugs: + - url: 1566608 + CVE-2022-22749: + title: Lack of URL restrictions when scanning QR codes + impact: moderate + reporter: Wladimir Palant working with Include Security + description: | + When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.
*This bug only affects Firefox for Android. Other operating systems are unaffected.* + bugs: + - url: 1705094 + CVE-2022-22748: + title: Spoofed origin on external protocol launch dialog + impact: moderate + reporter: Alesandro Ortiz + description: | + Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. + bugs: + - url: 1705211 + CVE-2022-22745: + title: Leaking cross-origin URLs through securitypolicyviolation event + impact: moderate + reporter: Jannis Rautenstrauch + description: | + Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations + bugs: + - url: 1735856 + CVE-2022-22744: + title: The 'Copy as curl' feature in DevTools did not fully escape website-controlled data, potentially leading to command injection + impact: moderate + reporter: Mattias Jacobsson + description: | + The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.
*This bug only affects Firefox for Windows. Other operating systems are unaffected.* + bugs: + - url: 1737252 + CVE-2022-22763: + title: Script Execution during invalid object state + impact: moderate + reporter: Mozilla Fuzzing Team + description: | + When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. + bugs: + - url: 1740534 + CVE-2022-22747: + title: Crash when handling empty pkcs7 sequence + impact: low + reporter: Tavis Ormandy + description: | + After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. + bugs: + - url: 1735028 + CVE-2022-22736: + title: Potential local privilege escalation when loading modules from the install directory. + impact: low + reporter: Toshihito Kikuchi + description: | + If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.
*This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.* + bugs: + - url: 1742692 + CVE-2022-22739: + title: Missing throttling on external protocol launch dialog + impact: low + reporter: Alesandro Ortiz + description: | + Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. + bugs: + - url: 1744158 + CVE-2022-22751: + title: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5 + impact: high + reporter: Mozilla developers and community + description: | + Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. + bugs: + - url: 1664149, 1737816, 1739366, 1740274, 1740797, 1741201, 1741869, 1743221, 1743515, 1745373, 1746011 + desc: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5 + CVE-2022-22752: + title: Memory safety bugs fixed in Firefox 96 + impact: moderate + reporter: Mozilla developers and community + description: | + Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. + bugs: + - url: 1741210, 1742770 + desc: Memory safety bugs fixed in Firefox 96 \ No newline at end of file diff --git a/vulnerabilities/tests/test_mozilla.py b/vulnerabilities/tests/test_mozilla.py index 870529888..3a242c699 100644 --- a/vulnerabilities/tests/test_mozilla.py +++ b/vulnerabilities/tests/test_mozilla.py @@ -8,97 +8,23 @@ # import os -import shutil -import tempfile -import zipfile -from unittest.mock import patch -from django.test import TestCase - -from vulnerabilities import models -from vulnerabilities.import_runner import ImportRunner +from vulnerabilities.importers.mozilla import to_advisories +from vulnerabilities.tests import util_tests BASE_DIR = os.path.dirname(os.path.abspath(__file__)) -TEST_DATA = os.path.join(BASE_DIR, "test_data/") - - -@patch("vulnerabilities.importers.MozillaImporter._update_from_remote") -class MozillaImportTest(TestCase): - - tempdir = None - - @classmethod - def setUpClass(cls) -> None: - cls.tempdir = tempfile.mkdtemp() - zip_path = os.path.join(TEST_DATA, "mozilla.zip") - - with zipfile.ZipFile(zip_path, "r") as zip_ref: - zip_ref.extractall(cls.tempdir) - - cls.importer = models.Importer.objects.create( - name="mozilla_unittests", - license="", - last_run=None, - data_source="MozillaImporter", - data_source_cfg={ - "repository_url": "https://example.git", - "working_directory": os.path.join(cls.tempdir, "mozilla_test"), - "create_working_directory": False, - "remove_working_directory": False, - }, - ) - - @classmethod - def tearDownClass(cls) -> None: - # Make sure no requests for unexpected package names have been made during the tests. - shutil.rmtree(cls.tempdir) - - def test_import(self, _): - runner = ImportRunner(self.importer, 100) - - # Remove if we don't need set_api in MozillaImporter - # with patch("vulnerabilities.importers.MozillaImporter.versions", new=MOCK_VERSION_API): - # with patch("vulnerabilities.importers.MozillaImporter.set_api"): - # runner.run() - runner.run() - - assert models.Vulnerability.objects.count() == 9 - assert models.VulnerabilityReference.objects.count() == 10 - assert models.VulnerabilitySeverity.objects.count() == 9 - assert models.PackageRelatedVulnerability.objects.filter(is_vulnerable=False).count() == 16 - - assert models.Package.objects.count() == 12 - - self.assert_for_package("Firefox ESR", "mfsa2021-06", "78.7.1") - self.assert_for_package("Firefox ESR", "mfsa2021-04", "78.7", "CVE-2021-23953") - self.assert_for_package("Firefox for Android", "mfsa2021-01", "84.1.3", "CVE-2020-16044") - self.assert_for_package("Thunderbird", "mfsa2014-30", "24.4") - self.assert_for_package("Thunderbird", "mfsa2014-30", "24.4") - self.assert_for_package("Mozilla Suite", "mfsa2005-29", "1.7.6") - - def assert_for_package( - self, - package_name, - mfsa_id, - resolved_version, - vulnerability_id=None, - impacted_version=None, - ): - - pkg = models.Package.objects.get(name=package_name, version=resolved_version) - vuln = pkg.vulnerabilities.first() - - if vulnerability_id: - assert vuln.vulnerability_id == vulnerability_id +TEST_DATA = os.path.join(BASE_DIR, "test_data/mozilla/") - ref_url = f"https://www.mozilla.org/en-US/security/advisories/{mfsa_id}" - assert models.VulnerabilityReference.objects.get(url=ref_url, vulnerability=vuln) - assert models.PackageRelatedVulnerability.objects.filter( - package=pkg, vulnerability=vuln, is_vulnerable=False - ) +def test_import_md(): + md_file = os.path.join(TEST_DATA, "mfsa2006-02.md") + expected_file_md = os.path.join(TEST_DATA, "expected-md.json") + advisories_from_md = [adv.to_dict() for adv in to_advisories(md_file)] + util_tests.check_results_against_json(advisories_from_md, expected_file_md) -def test_categorize_versions_ranges(): - # Populate if impacted version is filled - pass +def test_import_yml(): + yml_file = os.path.join(TEST_DATA, "mfsa2022-01.yml") + expected_file_yml = os.path.join(TEST_DATA, "expected-yml.json") + advisories_from_yml = [adv.to_dict() for adv in to_advisories(yml_file)] + util_tests.check_results_against_json(advisories_from_yml, expected_file_yml)