[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
branch master updated: cve: Gracefully handle bogus CVE entries.
From: |
guix-commits |
Subject: |
branch master updated: cve: Gracefully handle bogus CVE entries. |
Date: |
Wed, 21 Apr 2021 18:01:19 -0400 |
This is an automated email from the git hooks/post-receive script.
civodul pushed a commit to branch master
in repository guix.
The following commit(s) were added to refs/heads/master by this push:
new 7dbc2fc cve: Gracefully handle bogus CVE entries.
7dbc2fc is described below
commit 7dbc2fcb45fac4a0b64fef8efa8c858a047d0498
Author: Ludovic Courtès <ludo@gnu.org>
AuthorDate: Wed Apr 21 23:49:59 2021 +0200
cve: Gracefully handle bogus CVE entries.
Fixes <https://bugs.gnu.org/47941>.
Reported by Jack Hill <jackhill@jackhill.us>.
* guix/cve.scm (reference-data->cve-references): Gracefully handle lack
of "reference_data".
(cpe-match->cve-configuration): Gracefully handle lack of "cpe23Uri".
---
guix/cve.scm | 31 ++++++++++++++++++-------------
1 file changed, 18 insertions(+), 13 deletions(-)
diff --git a/guix/cve.scm b/guix/cve.scm
index b3a8b13..9e1cf5b 100644
--- a/guix/cve.scm
+++ b/guix/cve.scm
@@ -1,5 +1,5 @@
;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès
<ludo@gnu.org>
+;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021 Ludovic Courtès
<ludo@gnu.org>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -99,7 +99,9 @@
(define (reference-data->cve-references alist)
(map json->cve-reference
- (vector->list (assoc-ref alist "reference_data"))))
+ ;; Normally "reference_data" is always present but rejected CVEs such
+ ;; as CVE-2020-10020 can lack it.
+ (vector->list (or (assoc-ref alist "reference_data") '#()))))
(define %cpe-package-rx
;; For applications: "cpe:2.3:a:VENDOR:PACKAGE:VERSION", or sometimes
@@ -137,17 +139,20 @@ package."
(starte (assoc-ref alist "versionStartExcluding"))
(endi (assoc-ref alist "versionEndIncluding"))
(ende (assoc-ref alist "versionEndExcluding")))
- (let-values (((package version) (cpe->package-name cpe)))
- (and package
- `(,package
- ,(cond ((and (or starti starte) (or endi ende))
- `(and ,(if starti `(>= ,starti) `(> ,starte))
- ,(if endi `(<= ,endi) `(< ,ende))))
- (starti `(>= ,starti))
- (starte `(> ,starte))
- (endi `(<= ,endi))
- (ende `(< ,ende))
- (else version)))))))
+ ;; Normally "cpe23Uri" is here in each "cpe_match" item, but CVE-2020-0534
+ ;; has a configuration that lacks it.
+ (and cpe
+ (let-values (((package version) (cpe->package-name cpe)))
+ (and package
+ `(,package
+ ,(cond ((and (or starti starte) (or endi ende))
+ `(and ,(if starti `(>= ,starti) `(> ,starte))
+ ,(if endi `(<= ,endi) `(< ,ende))))
+ (starti `(>= ,starti))
+ (starte `(> ,starte))
+ (endi `(<= ,endi))
+ (ende `(< ,ende))
+ (else version))))))))
(define (configuration-data->cve-configurations alist)
"Given ALIST, a JSON dictionary for the baroque \"configurations\"
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- branch master updated: cve: Gracefully handle bogus CVE entries.,
guix-commits <=