Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 17:08:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 83

macOS VirtualBox false negative (#21646)

Browse source
This commit is contained in:
Tim Lee 2024-09-04 14:22:36 -06:00 committed by GitHub
parent a4fb3f45a1
commit 8542a823a7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changes/20846-vuln-virtual-box Normal file
View file

@ -0,0 +1 @@
- resolved an issue where virtual box for macOS wasn't matching against the vm_virtualbox NVD product name

8
server/vulnerabilities/nvd/cve.go
View file

@ -588,6 +588,14 @@ func expandCPEAliases(cpeItem *wfn.Attributes) []*wfn.Attributes {
}
}
for _, cpeItem := range cpeItems {
if cpeItem.Vendor == "oracle" && cpeItem.Product == "virtualbox" {
cpeItem2 := *cpeItem
cpeItem2.Product = "vm_virtualbox"
cpeItems = append(cpeItems, &cpeItem2)
}
}
return cpeItems
}

8
server/vulnerabilities/nvd/cve_test.go
View file

@ -347,6 +347,14 @@ func TestTranslateCPEToCVE(t *testing.T) {
},
continuesToUpdate: true,
},
// Tests the expandCPEAliases rule for virtualbox on macOS
"cpe:2.3:a:oracle:virtualbox:7.0.6:*:*:*:*:macos:*:*": {
includedCVEs: []cve{
{ID: "CVE-2023-21989", resolvedInVersion: "7.0.8"},
{ID: "CVE-2024-21141", resolvedInVersion: "7.0.20"},
},
continuesToUpdate: true,
},
}
cveOSTests := []struct {