1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
package app
import (
"fmt"
"os"
"sort"
"strings"
)
// BrewVulnsReport is the JSON structure emitted on stdout.
type BrewVulnsReport struct {
Exploited []string `json:"exploited"`
NotExploited []string `json:"not_exploited"`
NonCVE []string `json:"non_cve"`
VulnerablePackages []string `json:"vulnerable_packages"`
}
// BuildBrewVulnsReport checks each brew-reported CVE against fprox and
// classifies it as exploited or not, alongside the vulnerable packages.
func BuildBrewVulnsReport() (BrewVulnsReport, error) {
r, err := runBrewVulns()
if err != nil {
return BrewVulnsReport{}, err
}
// Maintain a CVE -> homebrew package mapping while accumulating the
// vulnerable packages and non-CVE identifiers so the report references all.
cvePkg := make(map[string]string)
pkgSeen := make(map[string]struct{})
nonCveSeen := make(map[string]struct{})
for _, finding := range r.Findings {
for _, v := range finding.Vulnerabilities {
if v.ID == "" {
continue
}
if strings.HasPrefix(v.ID, "CVE-") {
if _, ok := cvePkg[v.ID]; !ok {
cvePkg[v.ID] = finding.Formula
}
pkgSeen[finding.Formula] = struct{}{}
} else {
nonCveSeen[v.ID] = struct{}{}
}
}
}
var exploited, notExploited []string
for cve := range cvePkg {
has, err := CveHasExploits(cve)
if err != nil {
// Skip CVEs we could not resolve so they are never mislabeled.
fmt.Fprintf(os.Stderr, "warning: skipping %s: %v\n", cve, err)
continue
}
if has {
exploited = append(exploited, cve)
} else {
notExploited = append(notExploited, cve)
}
}
sort.Strings(exploited)
sort.Strings(notExploited)
pkgs := make([]string, 0, len(pkgSeen))
for pkg := range pkgSeen {
pkgs = append(pkgs, pkg)
}
sort.Strings(pkgs)
nonCves := make([]string, 0, len(nonCveSeen))
for id := range nonCveSeen {
nonCves = append(nonCves, id)
}
sort.Strings(nonCves)
return BrewVulnsReport{
Exploited: exploited,
NotExploited: notExploited,
NonCVE: nonCves,
VulnerablePackages: pkgs,
}, nil
}
|
