feat(alpine): support unfixed vulnerabilities #1235
Conversation
pkg/detector/ospkg/alpine/alpine.go
Outdated
|
|
||
| // This logic is for unfixed vulnerabilities, but Trivy DB doesn't have advisories for unfixed vulnerabilities | ||
| // because Alpine just provides potentially vulnerable packages. It will cause a lot of false positives. | ||
| if adv.FixedVersion == "" { |
There was a problem hiding this comment.
Current logic in Cybercenter is, we look for range.
If installedVersion >AffectedFrom && installedVersion <= AffectedTo{
vulns = append(vulns, vuln)
}
We need to add affectedFrom and affectedTo in trivy-db types.
There was a problem hiding this comment.
If we take the information from NVD, it is true. But we take it from Alpine Security Tracker which provides potentially vulnerable packages. We don't need to care about affectedFrom and affectedTo because secfixes tracker already compares versions with minimum and maximum versions.
https://gitlab.alpinelinux.org/kaniini/secfixes-tracker/-/blob/master/secfixes_tracker/models.py#L266-301
If we compare it again, it doesn't make sense. We just do the same thing twice.
There was a problem hiding this comment.
Okay. I get it. Please consider below scenario
- I have curl v1.5 package
- sec fix tracker says that 2.0 (current/latest version) is vulnerable
- Now, with this logic we will show v1.5 also as vulnerable.
there can be a chance that the installed version is not vulnerable. latest version of the package is only vulnerable.
There was a problem hiding this comment.
I see, but it is the same as fixed vulnerabilities, right? Alpine doesn't provide introduced versions, but fixed versions only. What do you think about it? Do we support the introduced versions only for unpatched vulnerabilities?
There was a problem hiding this comment.
okay, so all version below this version are vulnerable. Okay this is good
There was a problem hiding this comment.
I think it is enough to support minimum versions. I've fixed that. While building DB, you need to insert minimum versions into the AffectedVersion field.
03eece3
Overview
Trivy DB doesn't insert security advisories for unfixed vulnerabilities, so Trivy cannot detect unfixed vulnerabilities at the moment. This PR is for the future.
Related PRs