Skip to content

Commit

Permalink
feat(vuln): include pkg identifier on detected vulnerabilities (#5439)
Browse files Browse the repository at this point in the history 
Signed-off-by: juan131 <jariza@vmware.com>
Signed-off-by: knqyf263 <knqyf263@gmail.com>
Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>
Co-authored-by: Nikita Pivkin <nikita.pivkin@smartforce.io>
Co-authored-by: knqyf263 <knqyf263@gmail.com>
  • Loading branch information
@juan131 @DmitriyLewen
@nikpivkin @knqyf263
5 people authored Dec 27, 2023
1 parent 4cdff0e commit 1f0d629
Show file tree
Hide file tree
Showing 126 changed files with 4,728 additions and 1,963 deletions.
2 changes: 1 addition & 1 deletion integration/client_server_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -539,7 +539,7 @@ func TestClientServerWithRedis(t *testing.T) {
// Run Trivy client
err := execute(osArgs)
require.Error(t, err)
assert.Contains(t, err.Error(), "connect: connection refused")
assert.Contains(t, err.Error(), "unable to store cache")
})
}

Expand Down
54 changes: 42 additions & 12 deletions integration/sbom_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,15 @@ func TestSBOM(t *testing.T) {
{
Target: "testdata/fixtures/sbom/centos-7-cyclonedx.json (centos 7.6.1810)",
Vulnerabilities: []types.DetectedVulnerability{
{PkgRef: "pkg:rpm/centos/bash@4.2.46-31.el7?arch=x86_64&distro=centos-7.6.1810"},
{PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
{PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
{
PkgRef: "pkg:rpm/centos/bash@4.2.46-31.el7?arch=x86_64&distro=centos-7.6.1810",
},
{
PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810",
},
{
PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810",
},
},
},
},
Expand Down Expand Up @@ -82,9 +88,15 @@ func TestSBOM(t *testing.T) {
{
Target: "testdata/fixtures/sbom/centos-7-cyclonedx.intoto.jsonl (centos 7.6.1810)",
Vulnerabilities: []types.DetectedVulnerability{
{PkgRef: "pkg:rpm/centos/bash@4.2.46-31.el7?arch=x86_64&distro=centos-7.6.1810"},
{PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
{PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
{
PkgRef: "pkg:rpm/centos/bash@4.2.46-31.el7?arch=x86_64&distro=centos-7.6.1810",
},
{
PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810",
},
{
PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810",
},
},
},
},
Expand All @@ -105,9 +117,15 @@ func TestSBOM(t *testing.T) {
{
Target: "testdata/fixtures/sbom/centos-7-spdx.txt (centos 7.6.1810)",
Vulnerabilities: []types.DetectedVulnerability{
{PkgRef: "pkg:rpm/centos/bash@4.2.46-31.el7?arch=x86_64&distro=centos-7.6.1810"},
{PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
{PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
{
PkgRef: "pkg:rpm/centos/bash@4.2.46-31.el7?arch=x86_64&distro=centos-7.6.1810",
},
{
PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810",
},
{
PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810",
},
},
},
},
Expand All @@ -128,9 +146,15 @@ func TestSBOM(t *testing.T) {
{
Target: "testdata/fixtures/sbom/centos-7-spdx.json (centos 7.6.1810)",
Vulnerabilities: []types.DetectedVulnerability{
{PkgRef: "pkg:rpm/centos/bash@4.2.46-31.el7?arch=x86_64&distro=centos-7.6.1810"},
{PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
{PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
{
PkgRef: "pkg:rpm/centos/bash@4.2.46-31.el7?arch=x86_64&distro=centos-7.6.1810",
},
{
PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810",
},
{
PkgRef: "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64&epoch=1&distro=centos-7.6.1810",
},
},
},
},
Expand Down Expand Up @@ -200,6 +224,12 @@ func compareSBOMReports(t *testing.T, wantFile, gotFile string, overrideWant typ
want.Results[i].Target = result.Target
for j, vuln := range result.Vulnerabilities {
want.Results[i].Vulnerabilities[j].PkgRef = vuln.PkgRef
if vuln.PkgIdentifier.Empty() {
continue
}
want.Results[i].Vulnerabilities[j].PkgIdentifier = ftypes.PkgIdentifier{
PURL: vuln.PkgIdentifier.PURL,
}
}
}

Expand Down
3 changes: 3 additions & 0 deletions integration/testdata/almalinux-8.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,9 @@
"VulnerabilityID": "CVE-2021-3712",
"PkgID": "openssl-libs@1.1.1k-4.el8.x86_64",
"PkgName": "openssl-libs",
"PkgIdentifier": {
"PURL": "pkg:rpm/alma/openssl-libs@1.1.1k-4.el8?arch=x86_64\u0026distro=alma-8.5\u0026epoch=1"
},
"InstalledVersion": "1:1.1.1k-4.el8",
"FixedVersion": "1:1.1.1k-5.el8_5",
"Status": "fixed",
Expand Down
12 changes: 12 additions & 0 deletions integration/testdata/alpine-310-registry.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,9 @@
"VulnerabilityID": "CVE-2019-1549",
"PkgID": "libcrypto1.1@1.1.1c-r0",
"PkgName": "libcrypto1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libcrypto1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2"
},
"InstalledVersion": "1.1.1c-r0",
"FixedVersion": "1.1.1d-r0",
"Status": "fixed",
Expand Down Expand Up @@ -133,6 +136,9 @@
"VulnerabilityID": "CVE-2019-1551",
"PkgID": "libcrypto1.1@1.1.1c-r0",
"PkgName": "libcrypto1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libcrypto1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2"
},
"InstalledVersion": "1.1.1c-r0",
"FixedVersion": "1.1.1d-r2",
"Status": "fixed",
Expand Down Expand Up @@ -212,6 +218,9 @@
"VulnerabilityID": "CVE-2019-1549",
"PkgID": "libssl1.1@1.1.1c-r0",
"PkgName": "libssl1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libssl1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2"
},
"InstalledVersion": "1.1.1c-r0",
"FixedVersion": "1.1.1d-r0",
"Status": "fixed",
Expand Down Expand Up @@ -281,6 +290,9 @@
"VulnerabilityID": "CVE-2019-1551",
"PkgID": "libssl1.1@1.1.1c-r0",
"PkgName": "libssl1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libssl1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2"
},
"InstalledVersion": "1.1.1c-r0",
"FixedVersion": "1.1.1d-r2",
"Status": "fixed",
Expand Down
12 changes: 12 additions & 0 deletions integration/testdata/alpine-310.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,9 @@
"VulnerabilityID": "CVE-2019-1549",
"PkgID": "libcrypto1.1@1.1.1c-r0",
"PkgName": "libcrypto1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libcrypto1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2"
},
"InstalledVersion": "1.1.1c-r0",
"FixedVersion": "1.1.1d-r0",
"Status": "fixed",
Expand Down Expand Up @@ -127,6 +130,9 @@
"VulnerabilityID": "CVE-2019-1551",
"PkgID": "libcrypto1.1@1.1.1c-r0",
"PkgName": "libcrypto1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libcrypto1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2"
},
"InstalledVersion": "1.1.1c-r0",
"FixedVersion": "1.1.1d-r2",
"Status": "fixed",
Expand Down Expand Up @@ -206,6 +212,9 @@
"VulnerabilityID": "CVE-2019-1549",
"PkgID": "libssl1.1@1.1.1c-r0",
"PkgName": "libssl1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libssl1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2"
},
"InstalledVersion": "1.1.1c-r0",
"FixedVersion": "1.1.1d-r0",
"Status": "fixed",
Expand Down Expand Up @@ -275,6 +284,9 @@
"VulnerabilityID": "CVE-2019-1551",
"PkgID": "libssl1.1@1.1.1c-r0",
"PkgName": "libssl1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libssl1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2"
},
"InstalledVersion": "1.1.1c-r0",
"FixedVersion": "1.1.1d-r2",
"Status": "fixed",
Expand Down
6 changes: 6 additions & 0 deletions integration/testdata/alpine-39-high-critical.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,9 @@
"VulnerabilityID": "CVE-2019-14697",
"PkgID": "musl@1.1.20-r4",
"PkgName": "musl",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/musl@1.1.20-r4?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.20-r4",
"FixedVersion": "1.1.20-r5",
"Status": "fixed",
Expand Down Expand Up @@ -100,6 +103,9 @@
"VulnerabilityID": "CVE-2019-14697",
"PkgID": "musl-utils@1.1.20-r4",
"PkgName": "musl-utils",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/musl-utils@1.1.20-r4?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.20-r4",
"FixedVersion": "1.1.20-r5",
"Status": "fixed",
Expand Down
6 changes: 6 additions & 0 deletions integration/testdata/alpine-39-ignore-cveids.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,9 @@
"VulnerabilityID": "CVE-2019-1551",
"PkgID": "libcrypto1.1@1.1.1b-r1",
"PkgName": "libcrypto1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libcrypto1.1@1.1.1b-r1?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.1b-r1",
"FixedVersion": "1.1.1d-r2",
"Status": "fixed",
Expand Down Expand Up @@ -137,6 +140,9 @@
"VulnerabilityID": "CVE-2019-1551",
"PkgID": "libssl1.1@1.1.1b-r1",
"PkgName": "libssl1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libssl1.1@1.1.1b-r1?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.1b-r1",
"FixedVersion": "1.1.1d-r2",
"Status": "fixed",
Expand Down
18 changes: 18 additions & 0 deletions integration/testdata/alpine-39.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,9 @@
"VulnerabilityID": "CVE-2019-1549",
"PkgID": "libcrypto1.1@1.1.1b-r1",
"PkgName": "libcrypto1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libcrypto1.1@1.1.1b-r1?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.1b-r1",
"FixedVersion": "1.1.1d-r0",
"Status": "fixed",
Expand Down Expand Up @@ -127,6 +130,9 @@
"VulnerabilityID": "CVE-2019-1551",
"PkgID": "libcrypto1.1@1.1.1b-r1",
"PkgName": "libcrypto1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libcrypto1.1@1.1.1b-r1?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.1b-r1",
"FixedVersion": "1.1.1d-r2",
"Status": "fixed",
Expand Down Expand Up @@ -206,6 +212,9 @@
"VulnerabilityID": "CVE-2019-1549",
"PkgID": "libssl1.1@1.1.1b-r1",
"PkgName": "libssl1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libssl1.1@1.1.1b-r1?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.1b-r1",
"FixedVersion": "1.1.1d-r0",
"Status": "fixed",
Expand Down Expand Up @@ -275,6 +284,9 @@
"VulnerabilityID": "CVE-2019-1551",
"PkgID": "libssl1.1@1.1.1b-r1",
"PkgName": "libssl1.1",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/libssl1.1@1.1.1b-r1?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.1b-r1",
"FixedVersion": "1.1.1d-r2",
"Status": "fixed",
Expand Down Expand Up @@ -354,6 +366,9 @@
"VulnerabilityID": "CVE-2019-14697",
"PkgID": "musl@1.1.20-r4",
"PkgName": "musl",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/musl@1.1.20-r4?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.20-r4",
"FixedVersion": "1.1.20-r5",
"Status": "fixed",
Expand Down Expand Up @@ -396,6 +411,9 @@
"VulnerabilityID": "CVE-2019-14697",
"PkgID": "musl-utils@1.1.20-r4",
"PkgName": "musl-utils",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/musl-utils@1.1.20-r4?arch=x86_64\u0026distro=3.9.4"
},
"InstalledVersion": "1.1.20-r4",
"FixedVersion": "1.1.20-r5",
"Status": "fixed",
Expand Down
3 changes: 3 additions & 0 deletions integration/testdata/alpine-distroless.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,9 @@
"VulnerabilityID": "CVE-2022-24765",
"PkgID": "git@2.35.1-r2",
"PkgName": "git",
"PkgIdentifier": {
"PURL": "pkg:apk/alpine/git@2.35.1-r2?arch=x86_64\u0026distro=3.16"
},
"InstalledVersion": "2.35.1-r2",
"FixedVersion": "2.35.2-r0",
"Status": "fixed",
Expand Down
3 changes: 3 additions & 0 deletions integration/testdata/amazon-1.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,9 @@
"VulnerabilityID": "CVE-2019-5481",
"PkgID": "curl@7.61.1-11.91.amzn1.x86_64",
"PkgName": "curl",
"PkgIdentifier": {
"PURL": "pkg:rpm/amazon/curl@7.61.1-11.91.amzn1?arch=x86_64\u0026distro=amazon-AMI+release+2018.03"
},
"InstalledVersion": "7.61.1-11.91.amzn1",
"FixedVersion": "7.61.1-12.93.amzn1",
"Status": "fixed",
Expand Down
6 changes: 6 additions & 0 deletions integration/testdata/amazon-2.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,9 @@
"VulnerabilityID": "CVE-2019-5481",
"PkgID": "curl@7.61.1-9.amzn2.0.1.x86_64",
"PkgName": "curl",
"PkgIdentifier": {
"PURL": "pkg:rpm/amazon/curl@7.61.1-9.amzn2.0.1?arch=x86_64\u0026distro=amazon-2+%28Karoo%29"
},
"InstalledVersion": "7.61.1-9.amzn2.0.1",
"FixedVersion": "7.61.1-12.amzn2.0.1",
"Status": "fixed",
Expand Down Expand Up @@ -125,6 +128,9 @@
"VulnerabilityID": "CVE-2019-5436",
"PkgID": "curl@7.61.1-9.amzn2.0.1.x86_64",
"PkgName": "curl",
"PkgIdentifier": {
"PURL": "pkg:rpm/amazon/curl@7.61.1-9.amzn2.0.1?arch=x86_64\u0026distro=amazon-2+%28Karoo%29"
},
"InstalledVersion": "7.61.1-9.amzn2.0.1",
"FixedVersion": "7.61.1-11.amzn2.0.2",
"Status": "fixed",
Expand Down
3 changes: 3 additions & 0 deletions integration/testdata/amazonlinux2-gp2-x86-vm.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,9 @@
"VulnerabilityID": "CVE-2022-38177",
"PkgID": "bind-export-libs@9.11.4-26.P2.amzn2.5.2.x86_64",
"PkgName": "bind-export-libs",
"PkgIdentifier": {
"PURL": "pkg:rpm/amazon/bind-export-libs@9.11.4-26.P2.amzn2.5.2?arch=x86_64\u0026distro=amazon-2+%28Karoo%29\u0026epoch=32"
},
"InstalledVersion": "32:9.11.4-26.P2.amzn2.5.2",
"FixedVersion": "99:9.11.4-26.P2.amzn2.13",
"Status": "fixed",
Expand Down
6 changes: 6 additions & 0 deletions integration/testdata/busybox-with-lockfile.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,9 @@
"VulnerabilityID": "CVE-2019-15542",
"PkgID": "ammonia@1.9.0",
"PkgName": "ammonia",
"PkgIdentifier": {
"PURL": "pkg:cargo/ammonia@1.9.0"
},
"InstalledVersion": "1.9.0",
"FixedVersion": "\u003e= 2.1.0",
"Status": "fixed",
Expand Down Expand Up @@ -99,6 +102,9 @@
"VulnerabilityID": "CVE-2021-38193",
"PkgID": "ammonia@1.9.0",
"PkgName": "ammonia",
"PkgIdentifier": {
"PURL": "pkg:cargo/ammonia@1.9.0"
},
"InstalledVersion": "1.9.0",
"FixedVersion": "\u003e= 3.1.0, \u003e= 2.1.3, \u003c 3.0.0",
"Status": "fixed",
Expand Down
6 changes: 6 additions & 0 deletions integration/testdata/centos-6.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,9 @@
"VulnerabilityID": "CVE-2020-29573",
"PkgID": "glibc@2.12-1.212.el6.x86_64",
"PkgName": "glibc",
"PkgIdentifier": {
"PURL": "pkg:rpm/centos/glibc@2.12-1.212.el6?arch=x86_64\u0026distro=centos-6.10"
},
"InstalledVersion": "2.12-1.212.el6",
"Status": "end_of_life",
"Layer": {
Expand Down Expand Up @@ -132,6 +135,9 @@
],
"PkgID": "openssl@1.0.1e-57.el6.x86_64",
"PkgName": "openssl",
"PkgIdentifier": {
"PURL": "pkg:rpm/centos/openssl@1.0.1e-57.el6?arch=x86_64\u0026distro=centos-6.10"
},
"InstalledVersion": "1.0.1e-57.el6",
"FixedVersion": "1.0.1e-58.el6_10",
"Status": "fixed",
Expand Down
6 changes: 6 additions & 0 deletions integration/testdata/centos-7-ignore-unfixed.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,9 @@
],
"PkgID": "openssl-libs@1.0.2k-16.el7.x86_64",
"PkgName": "openssl-libs",
"PkgIdentifier": {
"PURL": "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64\u0026distro=centos-7.6.1810\u0026epoch=1"
},
"InstalledVersion": "1:1.0.2k-16.el7",
"FixedVersion": "1:1.0.2k-19.el7",
"Status": "fixed",
Expand Down Expand Up @@ -162,6 +165,9 @@
],
"PkgID": "openssl-libs@1.0.2k-16.el7.x86_64",
"PkgName": "openssl-libs",
"PkgIdentifier": {
"PURL": "pkg:rpm/centos/openssl-libs@1.0.2k-16.el7?arch=x86_64\u0026distro=centos-7.6.1810\u0026epoch=1"
},
"InstalledVersion": "1:1.0.2k-16.el7",
"FixedVersion": "1:1.0.2k-19.el7",
"Status": "fixed",
Expand Down
Loading

0 comments on commit 1f0d629

Please sign in to comment.