Update OpenSSL advisories #1765
Conversation
Signed-off-by: kunalsz <[email protected]>
Signed-off-by: kunalsz <[email protected]>
|
@TG1999 I have added tests for the pipelines,you can now review it |
|
@kunalsz please resolve conflicts |
|
|
||
|
|
||
| # fetch the content from the html data | ||
| def fetch_advisory_data(url): |
There was a problem hiding this comment.
Add docstrings and doctests in all your functions please. Thanks!
Signed-off-by: kunalsz <[email protected]>
Signed-off-by: kunalsz <[email protected]>
| """Collect Advisories from Openssl""" | ||
|
|
||
| pipeline_id = "openssl_importer" | ||
| spdx_license_expression = "OpenSSL-standalone" |
There was a problem hiding this comment.
Can you paste the link from where you concluded that openssl advisory is under OpenSSL-standalone license?
There was a problem hiding this comment.
Looks like I used the wrong license, the correct one should be Apache License v2 , I'll update it
| versions = re.findall(r"(?<=from\s)([^\s]+)|(?<=before\s)([^\s]+)", affected) | ||
| versions = [v for group in versions for v in group if v] # ['1.0.1', '1.0.1j'] | ||
| affected_version_range = OpensslVersionRange.from_versions(versions) | ||
| affected_packages.append( | ||
| AffectedPackage( | ||
| package=PackageURL(type="openssl", name="openssl"), | ||
| affected_version_range=affected_version_range, | ||
| ) | ||
| ) |
There was a problem hiding this comment.
This is not correct. For OpenSSL from 1.0.1 to 1.0.1j this will produce vers:openssl/1.0.1 which is incorrect affected range.
There was a problem hiding this comment.
I'll make the necessary changes.
There was a problem hiding this comment.
@keshav-space The versions are getting extracted correctly.
In CVE-2024-13176 one of the affected version string is from 1.1.1 before 1.1.1zb and it gets processed correctly to 'affected_version_range': 'vers:openssl/1.1.1|1.1.1zb'
As far as OpenSSL from 1.0.1 to 1.0.1j is concerned, all the affected ranges on the advisory page are in the format of from VERSION before VERSION , so the regex works correctly
Signed-off-by: kunalsz <[email protected]>
Signed-off-by: kunalsz <[email protected]>
kunalsz
force-pushed
the
openssl-advisories
branch
from
e2f03f5 to
3c0854d
Compare
This reverts commit b38dbfd.
Signed-off-by: kunalsz <[email protected]>
|
@keshav-space I have made the necessary changes, please review the PR |
Updated the
importers/openssl.pyfile to scrape data from the new updated data sourcehttps://openssl-library.org/news/vulnerabilities/index.html.Fixes #1747