From 49bcff2ed1b7c0f8f77401227934ca23d2a98709 Mon Sep 17 00:00:00 2001 From: Jonathan Machado Date: Wed, 29 Jul 2026 15:05:55 -0400 Subject: [PATCH] feat(ubuntu): match FIPS packages against the dedicated FIPS bucket Ubuntu ships FIPS-validated packages (e.g. openssl) fixed on its FIPS streams (fips/, fips-updates/, fips-preview/). trivy-db now stores those advisories in a dedicated "-FIPS" bucket instead of the regular release bucket, so FIPS and non-FIPS fixed versions no longer collide. Detect FIPS packages by the FIPS version marker Ubuntu adds ("+Fips"/"+fips", or ".fips.") and, for those packages, query the "-FIPS" bucket. Non-FIPS packages keep querying the regular release bucket, so FIPS-validated fixes are shown only to FIPS users and non-FIPS users are unaffected. Companion trivy-db change: DataDog/trivy-db#60 Upstream discussion: https://github.com/aquasecurity/trivy-db/pull/664 Co-authored-by: Cursor --- .../ubuntu/testdata/fixtures/data-source.yaml | 5 ++ .../ubuntu/testdata/fixtures/ubuntu.yaml | 7 +++ pkg/detector/ospkg/ubuntu/ubuntu.go | 27 ++++++++- pkg/detector/ospkg/ubuntu/ubuntu_test.go | 59 +++++++++++++++++++ 4 files changed, 96 insertions(+), 2 deletions(-) diff --git a/pkg/detector/ospkg/ubuntu/testdata/fixtures/data-source.yaml b/pkg/detector/ospkg/ubuntu/testdata/fixtures/data-source.yaml index b5c8f895fd21..2015e36603fb 100644 --- a/pkg/detector/ospkg/ubuntu/testdata/fixtures/data-source.yaml +++ b/pkg/detector/ospkg/ubuntu/testdata/fixtures/data-source.yaml @@ -6,6 +6,11 @@ Name: "Ubuntu CVE Tracker" URL: "https://git.launchpad.net/ubuntu-cve-tracker" - key: ubuntu 21.04 + value: + ID: "ubuntu" + Name: "Ubuntu CVE Tracker" + URL: "https://git.launchpad.net/ubuntu-cve-tracker" + - key: ubuntu 20.04-FIPS value: ID: "ubuntu" Name: "Ubuntu CVE Tracker" diff --git a/pkg/detector/ospkg/ubuntu/testdata/fixtures/ubuntu.yaml b/pkg/detector/ospkg/ubuntu/testdata/fixtures/ubuntu.yaml index bcb207cd8e26..a57d9ac45eeb 100644 --- a/pkg/detector/ospkg/ubuntu/testdata/fixtures/ubuntu.yaml +++ b/pkg/detector/ospkg/ubuntu/testdata/fixtures/ubuntu.yaml @@ -18,3 +18,10 @@ - key: CVE-2016-4476 value: FixedVersion: "2.4-0ubuntu10" +- bucket: ubuntu 20.04-FIPS + pairs: + - bucket: openssl + pairs: + - key: CVE-2099-FIPS + value: + FixedVersion: "3.0.2-0ubuntu1.17+Fips2" diff --git a/pkg/detector/ospkg/ubuntu/ubuntu.go b/pkg/detector/ospkg/ubuntu/ubuntu.go index 05fa7cb0d9e5..ebfaf7952328 100644 --- a/pkg/detector/ospkg/ubuntu/ubuntu.go +++ b/pkg/detector/ospkg/ubuntu/ubuntu.go @@ -103,6 +103,8 @@ func (s *Scanner) Detect(ctx context.Context, osVer string, _ *ftypes.Repository log.InfoContext(ctx, "Detecting vulnerabilities...", log.String("os_version", osVer), log.Int("pkg_num", len(pkgs))) + release := s.versionFromEolDates(ctx, osVer) + var vulns []types.DetectedVulnerability for _, pkg := range pkgs { // Skip third-party packages as they are not covered by Ubuntu security advisories @@ -110,9 +112,16 @@ func (s *Scanner) Detect(ctx context.Context, osVer string, _ *ftypes.Repository continue } - osVer = s.versionFromEolDates(ctx, osVer) + // FIPS-validated packages are fixed on Ubuntu's FIPS streams, which + // trivy-db stores in a dedicated "-FIPS" bucket. Querying that + // bucket (instead of the regular release bucket) ensures FIPS users get + // the FIPS-validated fixed version, and non-FIPS users are unaffected. + pkgRelease := release + if isFIPSPackage(pkg) { + pkgRelease += "-FIPS" + } advisories, err := s.vs.Get(db.GetParams{ - Release: osVer, + Release: pkgRelease, PkgName: pkg.SrcName, }) if err != nil { @@ -164,6 +173,20 @@ func (s *Scanner) IsSupportedVersion(ctx context.Context, osFamily ftypes.OSType return osver.Supported(ctx, s.eolDates, osFamily, osVer) } +// isFIPSPackage reports whether a package is a FIPS-validated build, based on +// the FIPS marker Ubuntu adds to the package version (e.g. "3.0.2-0ubuntu1.17+Fips1"). +// Such packages are fixed on Ubuntu's FIPS streams and must be matched against +// the dedicated "-FIPS" bucket rather than the regular release bucket. +func isFIPSPackage(pkg ftypes.Package) bool { + for _, v := range []string{utils.FormatVersion(pkg), utils.FormatSrcVersion(pkg)} { + v = strings.ToLower(v) + if strings.Contains(v, "+fips") || strings.Contains(v, ".fips.") { + return true + } + } + return false +} + // versionFromEolDates checks if actual (not ESM) version is not outdated func (s *Scanner) versionFromEolDates(ctx context.Context, osVer string) string { if _, ok := s.eolDates[osVer]; ok { diff --git a/pkg/detector/ospkg/ubuntu/ubuntu_test.go b/pkg/detector/ospkg/ubuntu/ubuntu_test.go index 2cf331e9ab16..3b5898b60d21 100644 --- a/pkg/detector/ospkg/ubuntu/ubuntu_test.go +++ b/pkg/detector/ospkg/ubuntu/ubuntu_test.go @@ -165,6 +165,65 @@ func TestScanner_Detect(t *testing.T) { }, }, }, + { + name: "FIPS package is matched against the FIPS bucket", + fixtures: []string{ + "testdata/fixtures/ubuntu.yaml", + "testdata/fixtures/data-source.yaml", + }, + args: args{ + osVer: "20.04", + pkgs: []ftypes.Package{ + { + Name: "openssl", + Version: "3.0.2-0ubuntu1.17+Fips1", + SrcName: "openssl", + SrcVersion: "3.0.2-0ubuntu1.17+Fips1", + Layer: ftypes.Layer{ + DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02", + }, + }, + }, + }, + want: []types.DetectedVulnerability{ + { + PkgName: "openssl", + VulnerabilityID: "CVE-2099-FIPS", + InstalledVersion: "3.0.2-0ubuntu1.17+Fips1", + FixedVersion: "3.0.2-0ubuntu1.17+Fips2", + Layer: ftypes.Layer{ + DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02", + }, + DataSource: &dbTypes.DataSource{ + ID: vulnerability.Ubuntu, + Name: "Ubuntu CVE Tracker", + URL: "https://git.launchpad.net/ubuntu-cve-tracker", + }, + }, + }, + }, + { + name: "non-FIPS package does not match the FIPS bucket", + fixtures: []string{ + "testdata/fixtures/ubuntu.yaml", + "testdata/fixtures/data-source.yaml", + }, + args: args{ + osVer: "20.04", + pkgs: []ftypes.Package{ + { + Name: "openssl", + Version: "3.0.2-0ubuntu1.17", + SrcName: "openssl", + SrcVersion: "3.0.2-0ubuntu1.17", + Layer: ftypes.Layer{ + DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02", + }, + }, + }, + }, + want: nil, + }, { name: "broken bucket", fixtures: []string{