Skip to content

Commit b9b383e

Browse files
DmitriyLewenDmitriyLewen
authored
feat(oracle): add flavors support (#7858)
1 parent 9988147 commit b9b383e

File tree

7 files changed

+74
-20
lines changed

7 files changed

+74
-20
lines changed

‎docs/docs/coverage/os/oracle.md

+13
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,19 @@ See [here](../../scanner/vulnerability.md#data-sources).
2828
### Fixed Version
2929
Trivy takes fixed versions from [Oracle security advisories][alerts].
3030

31+
#### Flavors
32+
Trivy detects the flavor for version of the found package and finds vulnerabilities only for that flavor.
33+
34+
| Flavor | Format | Example |
35+
|:-------:|:------------------------------------:|------------------------------------------------------|
36+
| normal | version without `fips` and `ksplice` | 3.6.16-4.el8 |
37+
| fips | `*_fips` | 10:3.6.16-4.0.1.el8_fips |
38+
| ksplice | `*.ksplice*.*` | 2:2.34-60.0.3.ksplice1.el9_2.7, 151.0.1.ksplice2.el8 |
39+
40+
41+
For example Trivy finds [CVE-2021-33560](https://linux.oracle.com/cve/CVE-2021-33560.html) only for the `normal` and `fips` flavors.
42+
For the `ksplice` flavor, [CVE-2021-33560](https://linux.oracle.com/cve/CVE-2021-33560.html) will be skipped.
43+
3144
### Severity
3245
Trivy determines vulnerability severity based on the severity metric provided in [Oracle security advisories][alerts].
3346
For example, the security patch for [CVE-2023-0464][CVE-2023-0464] is provided as [ELSA-2023-2645][ELSA-2023-2645].

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ require (
2424
github.com/aquasecurity/testdocker v0.0.0-20240730042311-4642e94c7fc8
2525
github.com/aquasecurity/tml v0.6.1
2626
github.com/aquasecurity/trivy-checks v1.3.0
27-
github.com/aquasecurity/trivy-db v0.0.0-20240910133327-7e0f4d2ed4c1
27+
github.com/aquasecurity/trivy-db v0.0.0-20241120092622-333d808d7e45
2828
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48
2929
github.com/aquasecurity/trivy-kubernetes v0.6.7-0.20241101182546-89bffc3932bc
3030
github.com/aws/aws-sdk-go-v2 v1.32.4

‎go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -355,8 +355,8 @@ github.com/aquasecurity/tml v0.6.1 h1:y2ZlGSfrhnn7t4ZJ/0rotuH+v5Jgv6BDDO5jB6A9gw
355355
github.com/aquasecurity/tml v0.6.1/go.mod h1:OnYMWY5lvI9ejU7yH9LCberWaaTBW7hBFsITiIMY2yY=
356356
github.com/aquasecurity/trivy-checks v1.3.0 h1:Z4+wxxApNSJOLcmGPWQ9cS3NGmT/yTaPCTMavIeuVEQ=
357357
github.com/aquasecurity/trivy-checks v1.3.0/go.mod h1:WDo8IKyW4FvA69uKYmamSIy3RosCOiBuA1Kfxuigiy0=
358-
github.com/aquasecurity/trivy-db v0.0.0-20240910133327-7e0f4d2ed4c1 h1:G0gnacAORRUqz2Tm5MqivSpldY2GZ74ijhJcMsae+sA=
359-
github.com/aquasecurity/trivy-db v0.0.0-20240910133327-7e0f4d2ed4c1/go.mod h1:PYkSRx4dlgFATEt+okGwibvbxVEtqsOdH+vX/saACYE=
358+
github.com/aquasecurity/trivy-db v0.0.0-20241120092622-333d808d7e45 h1:ljinbg7JTQvdnzuRsPYS6btA51SyGYWKCQInxSIwbRw=
359+
github.com/aquasecurity/trivy-db v0.0.0-20241120092622-333d808d7e45/go.mod h1:Lg2avQhFy5qeGA0eMysI/61REVvWpEltverCarGc3l0=
360360
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48 h1:JVgBIuIYbwG+ekC5lUHUpGJboPYiCcxiz06RCtz8neI=
361361
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48/go.mod h1:Ldya37FLi0e/5Cjq2T5Bty7cFkzUDwTcPeQua+2M8i8=
362362
github.com/aquasecurity/trivy-kubernetes v0.6.7-0.20241101182546-89bffc3932bc h1:/mFBYIK9RY+L8s1CIbQbJ5B3v0YmoDSu5eAzavvMa+Y=

‎integration/testdata/fixtures/db/oracle.yaml

+6-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,11 @@
44
pairs:
55
- key: CVE-2019-3823
66
value:
7-
FixedVersion: 7.61.1-11.el8
7+
FixedVersion: "7.61.1-11.el8"
8+
Entries:
9+
- FixedVersion: "7.61.1-11.el8"
810
- key: CVE-2019-5436
911
value:
10-
FixedVersion: 7.61.1-12.el8
12+
FixedVersion: "7.61.1-12.el8"
13+
Entries:
14+
- FixedVersion: "7.61.1-12.el8"

‎pkg/detector/ospkg/oracle/oracle.go

+3-15
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package oracle
22

33
import (
44
"context"
5-
"strings"
65
"time"
76

87
version "github.com/knqyf263/go-rpm-version"
@@ -43,16 +42,6 @@ func NewScanner() *Scanner {
4342
}
4443
}
4544

46-
func extractKsplice(v string) string {
47-
subs := strings.Split(strings.ToLower(v), ".")
48-
for _, s := range subs {
49-
if strings.HasPrefix(s, "ksplice") {
50-
return s
51-
}
52-
}
53-
return ""
54-
}
55-
5645
// Detect scans and return vulnerability in Oracle scanner
5746
func (s *Scanner) Detect(ctx context.Context, osVer string, _ *ftypes.Repository, pkgs []ftypes.Package) ([]types.DetectedVulnerability, error) {
5847
osVer = osver.Major(osVer)
@@ -69,10 +58,9 @@ func (s *Scanner) Detect(ctx context.Context, osVer string, _ *ftypes.Repository
6958
installed := utils.FormatVersion(pkg)
7059
installedVersion := version.NewVersion(installed)
7160
for _, adv := range advisories {
72-
// when one of them doesn't have ksplice, we'll also skip it
73-
// extract kspliceX and compare it with kspliceY in advisories
74-
// if kspliceX and kspliceY are different, we will skip the advisory
75-
if extractKsplice(adv.FixedVersion) != extractKsplice(pkg.Release) {
61+
// We need to use only advisories from the same flavor as the package flavors.
62+
// See more in https://github.com/aquasecurity/trivy/issues/1967
63+
if oracleoval.PackageFlavor(adv.FixedVersion) != oracleoval.PackageFlavor(pkg.Release) {
7664
continue
7765
}
7866

‎pkg/detector/ospkg/oracle/oracle_test.go

+36
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,42 @@ func TestScanner_Detect(t *testing.T) {
221221
},
222222
},
223223
},
224+
{
225+
name: "with fips",
226+
fixtures: []string{
227+
"testdata/fixtures/oracle7.yaml",
228+
"testdata/fixtures/data-source.yaml",
229+
},
230+
args: args{
231+
osVer: "7",
232+
pkgs: []ftypes.Package{
233+
{
234+
Name: "gnutls",
235+
Epoch: 10,
236+
Version: "3.6.15",
237+
Release: "4.0.1.el8_fips",
238+
Arch: "x86_64",
239+
SrcEpoch: 2,
240+
SrcName: "gnutls",
241+
SrcVersion: "3.6.15",
242+
SrcRelease: "4.0.1.el8_fips",
243+
},
244+
},
245+
},
246+
want: []types.DetectedVulnerability{
247+
{
248+
VulnerabilityID: "CVE-2021-20232",
249+
PkgName: "gnutls",
250+
InstalledVersion: "10:3.6.15-4.0.1.el8_fips",
251+
FixedVersion: "10:3.6.16-4.0.1.el8_fips",
252+
DataSource: &dbTypes.DataSource{
253+
ID: vulnerability.OracleOVAL,
254+
Name: "Oracle Linux OVAL definitions",
255+
URL: "https://linux.oracle.com/security/oval/",
256+
},
257+
},
258+
},
259+
},
224260
{
225261
name: "malformed",
226262
fixtures: []string{

‎pkg/detector/ospkg/oracle/testdata/fixtures/oracle7.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,21 @@
55
- key: CVE-2020-8177
66
value:
77
FixedVersion: "7.29.0-59.0.1.el7_9.1"
8+
Entries:
9+
- FixedVersion: "7.29.0-59.0.1.el7_9.1"
810
- bucket: glibc
911
pairs:
1012
- key: CVE-2017-1000364
1113
value:
1214
FixedVersion: "2:2.17-157.ksplice1.el7_3.4"
15+
Entries:
16+
- FixedVersion: "2:2.17-157.ksplice1.el7_3.4"
17+
- bucket: gnutls
18+
pairs:
19+
- key: CVE-2021-20232
20+
value:
21+
FixedVersion: "3.6.16-4.el8"
22+
Entries:
23+
- FixedVersion: "10:3.6.16-4.0.1.el8_fips"
24+
- FixedVersion: "3.6.16-4.el8"
25+

0 commit comments

Comments
 (0)