Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 01:18:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 59

18913 ignore rejected NVD vulnerabilities (#20193)

Browse source 
#18913 Recreating PR (ref: https://github.com/fleetdm/fleet/pull/19972)
This commit is contained in:
Tim Lee 2024-07-24 10:53:33 -06:00 committed by GitHub
parent fb6b263fb0
commit 362a0e545e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changes/18913-ignore-rejected-cves Normal file
View file

@ -0,0 +1 @@
CVEs identified as 'Rejected' in NVD will no longer match against software

4
server/vulnerabilities/nvd/cve_test.go
View file

@ -318,7 +318,9 @@ func TestTranslateCPEToCVE(t *testing.T) {
{ID: "CVE-2023-42950", resolvedInVersion: "17.2"}, {ID: "CVE-2023-42950", resolvedInVersion: "17.2"},
{ID: "CVE-2024-23273", resolvedInVersion: "17.4"}, {ID: "CVE-2024-23273", resolvedInVersion: "17.4"},
}, },
excludedCVEs: []string{"CVE-2023-28205"}, excludedCVEs: []string{
"CVE-2023-28205", // This vulnerability is for Safari 16.4.0
},
continuesToUpdate: true, continuesToUpdate: true,
}, },
"cpe:2.3:a:apple:safari:16.4.0:*:*:*:*:macos:*:*": { "cpe:2.3:a:apple:safari:16.4.0:*:*:*:*:macos:*:*": {

6
server/vulnerabilities/nvd/sync/cve_syncer.go
View file

@ -199,6 +199,9 @@ func (s *CVE) updateYearFile(year int, cves []nvdapi.CVEItem) error {
// Convert new API 2.0 format to legacy feed format and create map of new CVE information. // Convert new API 2.0 format to legacy feed format and create map of new CVE information.
newLegacyCVEs := make(map[string]*schema.NVDCVEFeedJSON10DefCVEItem) newLegacyCVEs := make(map[string]*schema.NVDCVEFeedJSON10DefCVEItem)
for _, cve := range cves { for _, cve := range cves {
if cve.CVE.VulnStatus != nil && *cve.CVE.VulnStatus == "Rejected" {
continue
}
legacyCVE := convertAPI20CVEToLegacy(cve.CVE, s.logger) legacyCVE := convertAPI20CVEToLegacy(cve.CVE, s.logger)
newLegacyCVEs[legacyCVE.CVE.CVEDataMeta.ID] = legacyCVE newLegacyCVEs[legacyCVE.CVE.CVEDataMeta.ID] = legacyCVE
} }
@ -249,6 +252,9 @@ func (s *CVE) updateVulnCheckYearFile(year int, cves []VulnCheckCVE, modCount, a
// Convert new API 2.0 format to legacy feed format and create map of new CVE information. // Convert new API 2.0 format to legacy feed format and create map of new CVE information.
newLegacyCVEs := make(map[string]*schema.NVDCVEFeedJSON10DefCVEItem) newLegacyCVEs := make(map[string]*schema.NVDCVEFeedJSON10DefCVEItem)
for _, cve := range cves { for _, cve := range cves {
if cve.CVE.VulnStatus != nil && *cve.CVE.VulnStatus == "Rejected" {
continue
}
legacyCVE := convertAPI20CVEToLegacy(cve.CVE, s.logger) legacyCVE := convertAPI20CVEToLegacy(cve.CVE, s.logger)
updateWithVulnCheckConfigurations(legacyCVE, cve.VcConfigurations) updateWithVulnCheckConfigurations(legacyCVE, cve.VcConfigurations)
newLegacyCVEs[legacyCVE.CVE.CVEDataMeta.ID] = legacyCVE newLegacyCVEs[legacyCVE.CVE.CVEDataMeta.ID] = legacyCVE