[Git][security-tracker-team/security-tracker][30-improve-gen-dsa-by-checking-cve-s-are-related-to-package] Print a warning if the package cannot be found for a given CVE

[Ola Lundqvist (@opal)]

Ola Lundqvist pushed to branch 30-improve-gen-dsa-by-checking-cve-s-are-related-to-package at Debian Security Tracker / security-tracker


Commits:
39492470 by Ola Lundqvist at 2024-08-30T23:08:55+02:00
Print a warning if the package cannot be found for a given CVE

  Introduced a new bin/check-package-cves script that check whether
  a CVE is related to a package. If not a warning is emitted and
  exit with error code 1.

  bin/gen-DSA is also updated to call this new script and if an exit
  code != 0 is returned check if it should proceed.

  For more information see:
    https://salsa.debian.org/lts-team/lts-extra-tasks/-/issues/61

- - - - -


2 changed files:

- + bin/check-package-cves
- bin/gen-DSA


Changes:

=====================================
bin/check-package-cves
=====================================
@@ -0,0 +1,49 @@
+#!/usr/bin/python3
+#
+# Check if a package is affected by  no-dsa tags from data/CVE/list
+#
+# Copyright © 2021 Emilio Pozuelo Monfort <pochu at debian.org>
+# Copyright © 2024 Ola Lundqvist <opal at debian.org>
+# This script is written by Ola, but based on remove-cve-tags written by
+# Emilio.
+
+import os.path
+import sys
+
+import setup_paths  # noqa
+import config
+from sectracker.parsers import cvelist, PackageAnnotation
+
+if len(sys.argv) <= 3:
+    # assume there are no CVEs, so nothing to do
+    sys.exit(0)
+
+releases = sys.argv[1].split(",")
+package = sys.argv[2]
+cves = sys.argv[3:]
+
+main_list = os.path.dirname(__file__) + '/../data/CVE/list'
+# check if another file was specified in config, e.g. a ExtendedFile
+
+for release in releases:
+    distconfig = config.get_config()[release]
+    if 'maincvefile' in distconfig:
+        main_list = os.path.dirname(__file__) + '/../' + distconfig['maincvefile']
+
+data = cvelist(main_list)
+cvematch = []
+
+for cve in data:
+    if cve.header.name in cves:
+        for annotation in cve.annotations:
+            if isinstance(annotation, PackageAnnotation):
+                if annotation.package == package:
+                    cvematch.append(cve.header.name)
+
+error = 0
+for cve in cves:
+    if not cve in cvematch:
+        error = 1
+        print(f"Warning: Cannot find that {cve} is related to {package}. Check package name or CVE.")
+
+exit (error)


=====================================
bin/gen-DSA
=====================================
@@ -358,6 +358,7 @@ for dist in $RELEASES; do
 done
 
 DISTS=
+DISTSX=
 
 for dist in $CODENAMES; do
     version="$(eval 'printf "%s" "$'"$dist"_VERSION'"')"
@@ -370,10 +371,17 @@ for dist in $CODENAMES; do
     fi
     [ -z "$version" ] || setvar "${dist}_VERSION" "$version"
     [ -z "$version" ] || DISTS="${DISTS},${dist}"
+    DISTSX="${DISTSX},${dist}"
 done
 
 DISTS="${DISTS#,}"
+DISTSX="${DISTSX#,}"
 
+bin/check-package-cves "${DISTSX}" "${PACKAGE}" ${CVE}
+if [ $? -ne 0 ] ; then
+    echo Are you sure you want to continue. If to press enter.
+    read
+fi
 if [ -n "${DISTS}" ]; then
     bin/remove-cve-dist-tags "${DISTS}" "${PACKAGE}" ${CVE}
 fi



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/39492470a26b870a18451bb123d6a9becdde18a1

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/39492470a26b870a18451bb123d6a9becdde18a1
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240830/557d449d/attachment-0001.htm>