Skip to content

Commit 0a5e456

Browse files
wagoodmanwagoodman
authored
add advisory date to msrc (#659)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
1 parent 283415b commit 0a5e456

4 files changed

Lines changed: 118 additions & 24 deletions

File tree

‎pkg/process/v6/transformers/msrc/test-fixtures/microsoft-msrc-0.json‎

Lines changed: 80 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,11 @@
1313
"links": [
1414
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4493470",
1515
"https://support.microsoft.com/help/4493470"
16-
]
16+
],
17+
"available": {
18+
"date": "2019-11-12",
19+
"kind": "advisory"
20+
}
1721
},
1822
{
1923
"id": "4494440",
@@ -22,7 +26,11 @@
2226
"links": [
2327
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4494440",
2428
"https://support.microsoft.com/help/4494440"
25-
]
29+
],
30+
"available": {
31+
"date": "2019-11-12",
32+
"kind": "advisory"
33+
}
2634
},
2735
{
2836
"id": "4503267",
@@ -31,7 +39,11 @@
3139
"links": [
3240
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4503267",
3341
"https://support.microsoft.com/en-us/help/4503267"
34-
]
42+
],
43+
"available": {
44+
"date": "2019-11-12",
45+
"kind": "advisory"
46+
}
3547
},
3648
{
3749
"id": "4507460",
@@ -40,7 +52,11 @@
4052
"links": [
4153
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4507460",
4254
"https://support.microsoft.com/help/4507460"
43-
]
55+
],
56+
"available": {
57+
"date": "2019-11-12",
58+
"kind": "advisory"
59+
}
4460
},
4561
{
4662
"id": "4512517",
@@ -49,7 +65,11 @@
4965
"links": [
5066
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4512517",
5167
"https://support.microsoft.com/help/4512517"
52-
]
68+
],
69+
"available": {
70+
"date": "2019-11-12",
71+
"kind": "advisory"
72+
}
5373
},
5474
{
5575
"id": "4516044",
@@ -58,7 +78,11 @@
5878
"links": [
5979
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4516044",
6080
"https://support.microsoft.com/help/4516044"
61-
]
81+
],
82+
"available": {
83+
"date": "2019-11-12",
84+
"kind": "advisory"
85+
}
6286
}
6387
],
6488
"id": "CVE-2019-0671",
@@ -90,79 +114,119 @@
90114
"is_latest": false,
91115
"links": [
92116
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4093119"
93-
]
117+
],
118+
"available": {
119+
"date": "2019-11-12",
120+
"kind": "advisory"
121+
}
94122
},
95123
{
96124
"id": "4103723",
97125
"is_first": false,
98126
"is_latest": false,
99127
"links": [
100128
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4103723"
101-
]
129+
],
130+
"available": {
131+
"date": "2019-11-12",
132+
"kind": "advisory"
133+
}
102134
},
103135
{
104136
"id": "4284880",
105137
"is_first": false,
106138
"is_latest": false,
107139
"links": [
108140
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4284880"
109-
]
141+
],
142+
"available": {
143+
"date": "2019-11-12",
144+
"kind": "advisory"
145+
}
110146
},
111147
{
112148
"id": "4338814",
113149
"is_first": false,
114150
"is_latest": false,
115151
"links": [
116152
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4338814"
117-
]
153+
],
154+
"available": {
155+
"date": "2019-11-12",
156+
"kind": "advisory"
157+
}
118158
},
119159
{
120160
"id": "4343887",
121161
"is_first": false,
122162
"is_latest": false,
123163
"links": [
124164
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4343887"
125-
]
165+
],
166+
"available": {
167+
"date": "2019-11-12",
168+
"kind": "advisory"
169+
}
126170
},
127171
{
128172
"id": "4345418",
129173
"is_first": false,
130174
"is_latest": true,
131175
"links": [
132176
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4345418"
133-
]
177+
],
178+
"available": {
179+
"date": "2019-11-12",
180+
"kind": "advisory"
181+
}
134182
},
135183
{
136184
"id": "4457131",
137185
"is_first": false,
138186
"is_latest": false,
139187
"links": [
140188
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4457131"
141-
]
189+
],
190+
"available": {
191+
"date": "2019-11-12",
192+
"kind": "advisory"
193+
}
142194
},
143195
{
144196
"id": "4462917",
145197
"is_first": false,
146198
"is_latest": false,
147199
"links": [
148200
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4462917"
149-
]
201+
],
202+
"available": {
203+
"date": "2019-11-12",
204+
"kind": "advisory"
205+
}
150206
},
151207
{
152208
"id": "4467691",
153209
"is_first": false,
154210
"is_latest": false,
155211
"links": [
156212
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4467691"
157-
]
213+
],
214+
"available": {
215+
"date": "2019-11-12",
216+
"kind": "advisory"
217+
}
158218
},
159219
{
160220
"id": "4471321",
161221
"is_first": false,
162222
"is_latest": true,
163223
"links": [
164224
"https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4471321"
165-
]
225+
],
226+
"available": {
227+
"date": "2019-11-12",
228+
"kind": "advisory"
229+
}
166230
}
167231
],
168232
"id": "CVE-2018-8116",

‎pkg/process/v6/transformers/msrc/transform.go‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ func getRanges(vuln unmarshal.MSRCVulnerability) []grypeDB.AffectedRange {
7373
}
7474

7575
func getFix(vuln unmarshal.MSRCVulnerability) *grypeDB.Fix {
76-
fixedInVersion := fixedInKB(vuln)
76+
fixedInVersion, fixDetail := fixedInKB(vuln)
7777

7878
fixState := grypeDB.FixedStatus
7979
if fixedInVersion == "" {
@@ -83,18 +83,28 @@ func getFix(vuln unmarshal.MSRCVulnerability) *grypeDB.Fix {
8383
return &grypeDB.Fix{
8484
Version: fixedInVersion,
8585
State: fixState,
86+
Detail: fixDetail,
8687
}
8788
}
8889

8990
// fixedInKB finds the "latest" patch (KB id) amongst the available microsoft patches and returns it
9091
// if the "latest" patch cannot be found, an empty string is returned
91-
func fixedInKB(vulnerability unmarshal.MSRCVulnerability) string {
92+
func fixedInKB(vulnerability unmarshal.MSRCVulnerability) (string, *grypeDB.FixDetail) {
9293
for _, fixedIn := range vulnerability.FixedIn {
9394
if fixedIn.IsLatest {
94-
return fixedIn.ID
95+
var detail *grypeDB.FixDetail
96+
if fixedIn.Available.Date != "" {
97+
detail = &grypeDB.FixDetail{
98+
Available: &grypeDB.FixAvailability{
99+
Date: internal.ParseTime(fixedIn.Available.Date),
100+
Kind: fixedIn.Available.Kind,
101+
},
102+
}
103+
}
104+
return fixedIn.ID, detail
95105
}
96106
}
97-
return ""
107+
return "", nil
98108
}
99109

100110
func getReferences(vuln unmarshal.MSRCVulnerability) []grypeDB.Reference {

‎pkg/process/v6/transformers/msrc/transform_test.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,12 @@ func TestParseMSRCEntry(t *testing.T) {
9696
Fix: &grypeDB.Fix{
9797
Version: "4516044",
9898
State: grypeDB.FixedStatus,
99+
Detail: &grypeDB.FixDetail{
100+
Available: &grypeDB.FixAvailability{
101+
Date: timePtr(time.Date(2019, 11, 12, 0, 0, 0, 0, time.UTC)),
102+
Kind: "advisory",
103+
},
104+
},
99105
},
100106
},
101107
},
@@ -155,6 +161,12 @@ func TestParseMSRCEntry(t *testing.T) {
155161
Fix: &grypeDB.Fix{
156162
Version: "4345418",
157163
State: grypeDB.FixedStatus,
164+
Detail: &grypeDB.FixDetail{
165+
Available: &grypeDB.FixAvailability{
166+
Date: timePtr(time.Date(2019, 11, 12, 0, 0, 0, 0, time.UTC)),
167+
Kind: "advisory",
168+
},
169+
},
158170
},
159171
},
160172
},
@@ -183,3 +195,7 @@ func TestParseMSRCEntry(t *testing.T) {
183195
}
184196
}
185197
}
198+
199+
func timePtr(t time.Time) *time.Time {
200+
return &t
201+
}

‎pkg/provider/unmarshal/msrc_vulnerability.go‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,14 @@ type MSRCVulnerability struct {
1212
Vector string `json:"vector"`
1313
} `json:"cvss"`
1414
FixedIn []struct {
15-
ID string `json:"id"`
16-
IsFirst bool `json:"is_first"`
17-
IsLatest bool `json:"is_latest"`
18-
Links []string `json:"links"`
15+
ID string `json:"id"`
16+
IsFirst bool `json:"is_first"`
17+
IsLatest bool `json:"is_latest"`
18+
Links []string `json:"links"`
19+
Available struct {
20+
Date string `json:"date,omitempty"`
21+
Kind string `json:"kind,omitempty"`
22+
} `json:"available,omitempty"`
1923
} `json:"fixed_in"`
2024
ID string `json:"id"`
2125
Link string `json:"link"`

0 commit comments

Comments
 (0)