gsadmin/renovate
1
0
Fork 0
mirror of https://github.com/renovatebot/renovate.git synced 2026-10-31 09:41:46 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
feat/setup-node-https
renovate/lib/workers/repository/init/vulnerability.spec.ts
T
Sebastian Poxhofer 05e1271376 test: use expect().resolves instead of awaiting inside expect (#45672) 
Enables the vitest/prefer-expect-resolves oxlint rule and applies its
autofix across the spec suite.
2026-09-04 10:40:46 +00:00

931 lines
39 KiB
TypeScript
Raw Permalink Blame History

import { codeBlock } from 'common-tags';
import type { RenovateConfig } from '~test/util.ts';
import { platform } from '~test/util.ts';
import { NO_VULNERABILITY_ALERTS } from '../../../constants/error-messages.ts';
import { logger } from '../../../logger/index.ts';
import {
detectVulnerabilityAlerts,
getFixedVersionByDatasource,
} from './vulnerability.ts';
describe('workers/repository/init/vulnerability', () => {
describe('getFixedVersionByDatasource()', () => {
it('returns ecosystem-specific version range', () => {
expect(getFixedVersionByDatasource('1.2.3', 'maven')).toBe('[1.2.3,)');
expect(getFixedVersionByDatasource('1.2.3', 'nuget')).toBe('[1.2.3,)');
});
it('returns default version range', () => {
expect(getFixedVersionByDatasource('1.2.3', 'npm')).toBe('>= 1.2.3');
});
});
describe('detectVulnerabilityAlerts()', () => {
let config: RenovateConfig;
beforeEach(() => {
config = {
vulnerabilityAlerts: {
enabled: true,
},
};
});
it('returns if vulnerabilityAlerts is undefined', async () => {
config = {};
await expect(detectVulnerabilityAlerts(config)).resolves.toBe(config);
});
it('returns if alerts are disabled', async () => {
config.vulnerabilityAlerts = { enabled: false };
await expect(detectVulnerabilityAlerts(config)).resolves.toEqual(config);
expect(logger.debug).toHaveBeenCalledWith(
'Vulnerability alerts are disabled',
);
});
it('returns if no alerts are detected', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([]);
await expect(detectVulnerabilityAlerts(config)).resolves.toEqual(config);
});
it('throws if no alerts and vulnerabilityAlertsOnly', async () => {
config.vulnerabilityAlertsOnly = true;
platform.getVulnerabilityAlerts.mockResolvedValue([]);
await expect(detectVulnerabilityAlerts(config)).rejects.toThrow(
NO_VULNERABILITY_ALERTS,
);
});
it('ignores alert if dismissed_reason is not nullish', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dismissed_reason: 'some reason',
dependency: {
manifest_path: 'package-lock.json',
},
security_advisory: {
ghsa_id: 'GHSA-hv9c-qwqg-qj3v',
summary: 'WebPreferences vulnerability in Electron',
description:
'GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.',
identifiers: [
{ type: 'GHSA', value: 'GHSA-hv9c-qwqg-qj3v' },
{ type: 'CVE', value: 'CVE-2018-15685' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2018-15685' },
],
severity: 'high',
},
security_vulnerability: {
package: { name: 'electron', ecosystem: 'npm' },
first_patched_version: { identifier: '1.8.8' },
vulnerable_version_range: '>= 1.8.0, < 1.8.8',
severity: 'high',
},
},
]);
const res = await detectVulnerabilityAlerts(config);
expect(res.packageRules).toBeEmpty();
});
it('ignores alert if firstPatchVersion is nullish', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dependency: {
manifest_path: 'requirements.txt',
},
security_advisory: {
ghsa_id: 'GHSA-rh6x-qvg7-rrmj',
summary: 'Ansible lxc_container symlink attack',
description:
'The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.',
identifiers: [
{ type: 'GHSA', value: 'GHSA-rh6x-qvg7-rrmj' },
{ type: 'CVE', value: 'CVE-2016-3096' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2016-3096' },
],
severity: 'high',
},
security_vulnerability: {
package: { name: 'ansible', ecosystem: 'pip' },
vulnerable_version_range: '< 1.9.6.1',
severity: 'high',
},
},
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'requirements.txt',
},
security_advisory: {
ghsa_id: 'GHSA-rh6x-qvg7-rrmj',
summary: 'Ansible lxc_container symlink attack',
description:
'The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.',
identifiers: [
{ type: 'GHSA', value: 'GHSA-rh6x-qvg7-rrmj' },
{ type: 'CVE', value: 'CVE-2016-3096' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2016-3096' },
],
severity: 'high',
},
security_vulnerability: {
package: { name: 'ansible', ecosystem: 'pip' },
vulnerable_version_range: '< 1.9.6.1',
first_patched_version: undefined,
severity: 'high',
},
},
]);
const res = await detectVulnerabilityAlerts(config);
expect(logger.debug).toHaveBeenCalledWith(
{ alert: expect.any(Object) },
'Vulnerability alert has no firstPatchedVersion - skipping',
);
expect(res.packageRules).toBeEmpty();
});
it('warns if an error occurs while parsing the alerts', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dismissed_reason: undefined,
// @ts-expect-error invalid options
dependency: {},
security_advisory: {
ghsa_id: 'abc',
summary: 'go vulnerability',
description: 'go',
identifiers: [{ type: 'GHSA', value: 'abc' }],
references: [{ url: '' }],
severity: 'medium',
},
security_vulnerability: {
// @ts-expect-error invalid options
package: null,
first_patched_version: { identifier: '1.8.3' },
vulnerable_version_range: '>= 1.8, < 1.8.3',
severity: 'medium',
},
},
]);
await detectVulnerabilityAlerts(config);
expect(logger.warn).toHaveBeenCalledWith(
{ err: expect.any(Object) },
'Error parsing vulnerability alert',
);
});
it('returns go alerts', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dependency: {
manifest_path: 'go.sum',
},
security_advisory: {
ghsa_id: 'abc',
summary: 'go vulnerability',
description: 'go',
identifiers: [{ type: 'GHSA', value: 'abc' }],
severity: 'high',
},
security_vulnerability: {
package: { name: 'foo', ecosystem: 'go' },
first_patched_version: { identifier: '1.8.3' },
vulnerable_version_range: '>= 1.8, < 1.8.3',
severity: 'high',
},
},
]);
const res = await detectVulnerabilityAlerts(config);
expect(res).toMatchObject({
packageRules: [
{
matchDatasources: ['go'],
matchPackageNames: ['foo'],
matchCurrentVersion: '< 1.8.3',
vulnerabilityFixVersion: '1.8.3',
vulnerabilitySeverity: 'HIGH',
isVulnerabilityAlert: true,
prBodyNotes: [
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### go vulnerability
abc
<details>
<summary>More information</summary>
#### Details
go
#### Severity
High
#### References
No references.
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/abc) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
],
force: {
enabled: true,
},
},
],
});
});
it('returns maven alerts', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'pom.xml',
},
security_advisory: {
ghsa_id: 'GHSA-cjjf-94ff-43w7',
summary: 'Deserialization of Untrusted Data in jackson-databind',
description:
'An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.',
identifiers: [
{ type: 'GHSA', value: 'GHSA-cjjf-94ff-43w7' },
{ type: 'CVE', value: 'CVE-2018-12022' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2018-12022' },
],
severity: 'high',
cvss_severities: {
cvss_v3: {
vector_string: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H',
score: 8.1,
},
cvss_v4: {
vector_string: null,
score: 0,
},
},
},
security_vulnerability: {
package: {
name: 'com.fasterxml.jackson.core:jackson-databind',
ecosystem: 'maven',
},
first_patched_version: { identifier: '2.7.9.4' },
vulnerable_version_range: '< 2.7.9.4',
severity: 'high',
},
},
]);
const res = await detectVulnerabilityAlerts(config);
expect(res).toMatchObject({
packageRules: [
{
matchDatasources: ['maven', 'clojure'],
matchPackageNames: ['com.fasterxml.jackson.core:jackson-databind'],
matchCurrentVersion: '(,2.7.9.4)',
vulnerabilityFixVersion: '2.7.9.4',
isVulnerabilityAlert: true,
prBodyNotes: [
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### Deserialization of Untrusted Data in jackson-databind
[CVE-2018-12022](https://nvd.nist.gov/vuln/detail/CVE-2018-12022) / [GHSA-cjjf-94ff-43w7](https://github.com/advisories/GHSA-cjjf-94ff-43w7)
<details>
<summary>More information</summary>
#### Details
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
#### Severity
- CVSS Score: 8.1 / 10 (High)
- Vector String: \`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\`
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2018-12022](https://nvd.nist.gov/vuln/detail/CVE-2018-12022)
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/GHSA-cjjf-94ff-43w7) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
],
force: {
enabled: true,
},
},
],
});
});
it('returns nuget alerts', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'test.csproj',
},
security_advisory: {
ghsa_id: 'GHSA-7mfr-774f-w5r9',
summary: '.NET CORE Denial Of Service Vulnerability',
description:
'.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service Vulnerability".',
identifiers: [
{ type: 'GHSA', value: 'GHSA-7mfr-774f-w5r9' },
{ type: 'CVE', value: 'CVE-2017-11770' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2017-11770' },
],
severity: 'high',
cvss_severities: {
cvss_v3: {
vector_string: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H',
score: 7.5,
},
cvss_v4: {
vector_string:
'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N',
score: 8.7,
},
},
},
security_vulnerability: {
package: {
name: 'Microsoft.NETCore.App',
ecosystem: 'nuget',
},
first_patched_version: { identifier: '2.0.3' },
vulnerable_version_range: '>= 1.0.0, < 2.0.3',
severity: 'high',
},
},
]);
const res = await detectVulnerabilityAlerts(config);
expect(res).toMatchObject({
packageRules: [
{
matchDatasources: ['nuget'],
matchPackageNames: ['Microsoft.NETCore.App'],
matchCurrentVersion: '(,2.0.3)',
vulnerabilityFixVersion: '2.0.3',
isVulnerabilityAlert: true,
prBodyNotes: [
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### .NET CORE Denial Of Service Vulnerability
[CVE-2017-11770](https://nvd.nist.gov/vuln/detail/CVE-2017-11770) / [GHSA-7mfr-774f-w5r9](https://github.com/advisories/GHSA-7mfr-774f-w5r9)
<details>
<summary>More information</summary>
#### Details
.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service Vulnerability".
#### Severity
- CVSS Score: 8.7 / 10 (High)
- Vector String: \`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\`
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2017-11770](https://nvd.nist.gov/vuln/detail/CVE-2017-11770)
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/GHSA-7mfr-774f-w5r9) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
],
force: {
enabled: true,
},
},
],
});
});
it('returns pip alerts', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'requirements.txt',
},
security_advisory: {
ghsa_id: 'GHSA-w578-j992-554x',
summary: 'Ansible fails to mark lookup-plugin results as unsafe',
description:
"Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.",
identifiers: [
{ type: 'GHSA', value: 'GHSA-w578-j992-554x' },
{ type: 'CVE', value: 'CVE-2017-7481' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2017-7481' },
],
severity: 'critical',
},
security_vulnerability: {
package: { name: 'ansible', ecosystem: 'pip' },
first_patched_version: { identifier: 'abc-2.3.1.0' },
vulnerable_version_range: '< 2.3.1.0',
severity: 'critical',
},
},
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'requirements.txt',
},
security_advisory: {
ghsa_id: 'GHSA-w64c-pxjj-h866',
summary:
'Ansible does not verify server hostname in SSL certificates',
description:
"Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.",
identifiers: [
{ type: 'GHSA', value: 'GHSA-w64c-pxjj-h866' },
{ type: 'CVE', value: 'CVE-2015-3908' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2015-3908' },
],
severity: 'medium',
},
security_vulnerability: {
package: { name: 'ansible', ecosystem: 'pip' },
first_patched_version: { identifier: '1.9.2' },
vulnerable_version_range: '< 1.9.2',
severity: 'medium',
},
},
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'requirements.txt',
},
security_advisory: {
ghsa_id: 'GHSA-x4cm-m36h-c6qj',
summary: 'Ansible mysql_user module fails to change password',
description:
"An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.",
identifiers: [
{ type: 'GHSA', value: 'GHSA-x4cm-m36h-c6qj' },
{ type: 'CVE', value: 'CVE-2016-8647' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2016-8647' },
],
severity: 'medium',
},
security_vulnerability: {
package: { name: 'ansible', ecosystem: 'pip' },
first_patched_version: { identifier: '2.2.1.0' },
vulnerable_version_range: '< 2.2.1.0',
severity: 'medium',
},
},
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'requirements.txt',
},
security_advisory: {
ghsa_id: 'GHSA-cmwx-9m2h-x7v4',
summary: 'Ansible apt_key module does not verify key fingerprints',
description:
'A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.',
identifiers: [
{ type: 'GHSA', value: 'GHSA-cmwx-9m2h-x7v4' },
{ type: 'CVE', value: 'CVE-2016-8614' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2016-8614' },
],
severity: 'high',
},
security_vulnerability: {
package: { name: 'ansible', ecosystem: 'pip' },
first_patched_version: { identifier: '2.2.0' },
vulnerable_version_range: '< 2.2.0',
severity: 'high',
},
},
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'requirements.txt',
},
security_advisory: {
ghsa_id: 'GHSA-jg4f-jqm5-4mgq',
summary: 'Ansible fails to sanitize fact variables',
description:
'Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.',
identifiers: [
{ type: 'GHSA', value: 'GHSA-jg4f-jqm5-4mgq' },
{ type: 'CVE', value: 'CVE-2016-8628' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2016-8628' },
],
severity: 'critical',
},
security_vulnerability: {
package: { name: 'ansible', ecosystem: 'pip' },
first_patched_version: { identifier: '2.2.0' },
vulnerable_version_range: '< 2.2.0',
severity: 'critical',
},
},
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'requirements.txt',
},
security_advisory: {
ghsa_id: 'GHSA-m956-frf4-m2wr',
summary: 'Ansible improper input validation',
description:
"Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.",
identifiers: [
{ type: 'GHSA', value: 'GHSA-m956-frf4-m2wr' },
{ type: 'CVE', value: 'CVE-2016-9587' },
],
references: [
{ url: 'https://nvd.nist.gov/vuln/detail/CVE-2016-9587' },
],
severity: 'critical',
},
security_vulnerability: {
package: { name: 'ansible', ecosystem: 'pip' },
first_patched_version: { identifier: '2.1.4' },
vulnerable_version_range: '< 2.1.4',
severity: 'critical',
},
},
]);
const res = await detectVulnerabilityAlerts(config);
expect(logger.debug).toHaveBeenCalledWith(
'Invalid firstPatchedVersion: abc-2.3.1.0',
);
expect(res).toMatchObject({
packageRules: [
{
matchDatasources: ['pypi'],
matchPackageNames: ['ansible'],
matchCurrentVersion: '< 2.2.1.0',
vulnerabilityFixVersion: '2.2.1.0',
isVulnerabilityAlert: true,
prBodyNotes: [
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### Ansible fails to mark lookup-plugin results as unsafe
[CVE-2017-7481](https://nvd.nist.gov/vuln/detail/CVE-2017-7481) / [GHSA-w578-j992-554x](https://github.com/advisories/GHSA-w578-j992-554x)
<details>
<summary>More information</summary>
#### Details
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
#### Severity
Critical
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2017-7481](https://nvd.nist.gov/vuln/detail/CVE-2017-7481)
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/GHSA-w578-j992-554x) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### Ansible does not verify server hostname in SSL certificates
[CVE-2015-3908](https://nvd.nist.gov/vuln/detail/CVE-2015-3908) / [GHSA-w64c-pxjj-h866](https://github.com/advisories/GHSA-w64c-pxjj-h866)
<details>
<summary>More information</summary>
#### Details
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
#### Severity
Medium
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2015-3908](https://nvd.nist.gov/vuln/detail/CVE-2015-3908)
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/GHSA-w64c-pxjj-h866) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### Ansible mysql_user module fails to change password
[CVE-2016-8647](https://nvd.nist.gov/vuln/detail/CVE-2016-8647) / [GHSA-x4cm-m36h-c6qj](https://github.com/advisories/GHSA-x4cm-m36h-c6qj)
<details>
<summary>More information</summary>
#### Details
An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.
#### Severity
Medium
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2016-8647](https://nvd.nist.gov/vuln/detail/CVE-2016-8647)
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/GHSA-x4cm-m36h-c6qj) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### Ansible apt_key module does not verify key fingerprints
[CVE-2016-8614](https://nvd.nist.gov/vuln/detail/CVE-2016-8614) / [GHSA-cmwx-9m2h-x7v4](https://github.com/advisories/GHSA-cmwx-9m2h-x7v4)
<details>
<summary>More information</summary>
#### Details
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
#### Severity
High
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2016-8614](https://nvd.nist.gov/vuln/detail/CVE-2016-8614)
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/GHSA-cmwx-9m2h-x7v4) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### Ansible fails to sanitize fact variables
[CVE-2016-8628](https://nvd.nist.gov/vuln/detail/CVE-2016-8628) / [GHSA-jg4f-jqm5-4mgq](https://github.com/advisories/GHSA-jg4f-jqm5-4mgq)
<details>
<summary>More information</summary>
#### Details
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
#### Severity
Critical
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2016-8628](https://nvd.nist.gov/vuln/detail/CVE-2016-8628)
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/GHSA-jg4f-jqm5-4mgq) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### Ansible improper input validation
[CVE-2016-9587](https://nvd.nist.gov/vuln/detail/CVE-2016-9587) / [GHSA-m956-frf4-m2wr](https://github.com/advisories/GHSA-m956-frf4-m2wr)
<details>
<summary>More information</summary>
#### Details
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
#### Severity
Critical
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2016-9587](https://nvd.nist.gov/vuln/detail/CVE-2016-9587)
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/GHSA-m956-frf4-m2wr) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
],
force: {
enabled: true,
},
},
],
});
});
it('returns GitHub Actions alerts', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dependency: {
manifest_path: '.github/workflows/j178.yml',
},
security_advisory: {
ghsa_id: 'GHSA-pwf7-47c3-mfhx',
summary: 'Arbitrary code injection in prek-action',
description:
'### Summary\\nThere are three potential attacks of arbitrary code injection vulnerability in the composite action at _action.yml_.\\n\\n### Details\\nThe GitHub Action variables `inputs.prek-version`, `inputs.extra_args`, and `inputs.extra-args` can be used to execute arbitrary code in the context of the action.',
identifiers: [{ type: 'GHSA', value: 'GHSA-pwf7-47c3-mfhx' }],
references: [
{
url: 'https://github.com/j178/prek-action/security/advisories/GHSA-pwf7-47c3-mfhx',
},
{
url: 'https://github.com/j178/prek-action/commit/6b7c6ef5c3875c766893b881b40773cd5605bde3',
},
{ url: 'https://github.com/advisories/GHSA-pwf7-47c3-mfhx' },
],
severity: 'high',
},
security_vulnerability: {
package: {
ecosystem: 'actions',
name: 'j178/prek-action',
},
vulnerable_version_range: '<= 1.0.5',
first_patched_version: { identifier: '1.0.6' },
severity: 'high',
},
},
]);
const res = await detectVulnerabilityAlerts(config);
expect(res).toMatchObject({
packageRules: [
{
matchDatasources: ['github-tags'],
matchPackageNames: ['j178/prek-action'],
matchCurrentVersion: '!/^\\x31\\.0\\.6$/',
vulnerabilityFixVersion: '1.0.6',
isVulnerabilityAlert: true,
prBodyNotes: [
// oxlint-disable-next-line prefer-template
'\n\n' +
codeBlock`
---
### Arbitrary code injection in prek-action
[GHSA-pwf7-47c3-mfhx](https://github.com/advisories/GHSA-pwf7-47c3-mfhx)
<details>
<summary>More information</summary>
#### Details
##### Summary\\nThere are three potential attacks of arbitrary code injection vulnerability in the composite action at _action.yml_.\\n\\n### Details\\nThe GitHub Action variables \`inputs.prek-version\`, \`inputs.extra_args\`, and \`inputs.extra-args\` can be used to execute arbitrary code in the context of the action.
#### Severity
High
#### References
- [https://github.com/j178/prek-action/security/advisories/GHSA-pwf7-47c3-mfhx](https://github.com/j178/prek-action/security/advisories/GHSA-pwf7-47c3-mfhx)
- [https://github.com/j178/prek-action/commit/6b7c6ef5c3875c766893b881b40773cd5605bde3](https://github.com/j178/prek-action/commit/6b7c6ef5c3875c766893b881b40773cd5605bde3)
- [https://github.com/advisories/GHSA-pwf7-47c3-mfhx](https://github.com/advisories/GHSA-pwf7-47c3-mfhx)
This data is provided by the [GitHub Advisory Database](https://github.com/advisories/GHSA-pwf7-47c3-mfhx) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
`,
],
force: {
enabled: true,
},
},
],
});
});
it('skips package rule if no valid firstPatchedVersion found across multiple alerts', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'package.json',
},
security_advisory: {
ghsa_id: 'GHSA-xxxx-xxxx-xxx1',
summary: 'First vulnerability',
description: 'First vulnerability',
identifiers: [{ type: 'GHSA', value: 'GHSA-xxxx-xxxx-xxx1' }],
references: [{ url: 'https://example.com/vuln1' }],
severity: 'medium',
},
security_vulnerability: {
package: { name: 'vulnerable-pkg', ecosystem: 'npm' },
first_patched_version: { identifier: 'invalid-version-1' },
vulnerable_version_range: '< 1.0.0',
severity: 'medium',
},
},
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'package.json',
},
security_advisory: {
ghsa_id: 'GHSA-xxxx-xxxx-xxx2',
summary: 'Second vulnerability',
description: 'Second vulnerability',
identifiers: [{ type: 'GHSA', value: 'GHSA-xxxx-xxxx-xxx2' }],
references: [{ url: 'https://example.com/vuln2' }],
severity: 'high',
},
security_vulnerability: {
package: { name: 'vulnerable-pkg', ecosystem: 'npm' },
first_patched_version: { identifier: 'also-invalid' },
vulnerable_version_range: '< 1.0.0',
severity: 'high',
},
},
]);
const res = await detectVulnerabilityAlerts(config);
expect(logger.debug).toHaveBeenCalledWith(
'Invalid firstPatchedVersion: invalid-version-1',
);
expect(logger.debug).toHaveBeenCalledWith(
'Invalid firstPatchedVersion: also-invalid',
);
expect(res.packageRules).toBeEmpty();
});
it('computes highest severity across multiple alerts for the same dependency', async () => {
platform.getVulnerabilityAlerts.mockResolvedValue([
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'package.json',
},
security_advisory: {
ghsa_id: 'GHSA-0001-0001-0001',
summary: 'Low severity issue',
description: 'Low severity issue',
identifiers: [{ type: 'CVE', value: 'CVE-2024-0001' }],
references: [{ url: 'https://example.com/vuln1' }],
severity: 'low',
},
security_vulnerability: {
package: { name: 'some-pkg', ecosystem: 'npm' },
first_patched_version: { identifier: '1.0.1' },
vulnerable_version_range: '< 1.0.1',
severity: 'low',
},
},
{
dismissed_reason: undefined,
dependency: {
manifest_path: 'package.json',
},
security_advisory: {
ghsa_id: 'GHSA-0002-0002-0002',
summary: 'Critical severity issue',
description: 'Critical severity issue',
identifiers: [{ type: 'CVE', value: 'CVE-2024-0002' }],
references: [{ url: 'https://example.com/vuln2' }],
severity: 'critical',
},
security_vulnerability: {
package: { name: 'some-pkg', ecosystem: 'npm' },
first_patched_version: { identifier: '1.0.2' },
vulnerable_version_range: '< 1.0.2',
severity: 'critical',
},
},
]);
const res = await detectVulnerabilityAlerts(config);
expect(res).toMatchObject({
packageRules: [
{
matchPackageNames: ['some-pkg'],
vulnerabilityFixVersion: '1.0.2',
vulnerabilitySeverity: 'CRITICAL',
isVulnerabilityAlert: true,
},
],
});
});
});
});
Reference in New Issue View Git Blame Copy Permalink