Skip to content

Commit acec6af

Browse files
manuel-sommermanuel-sommer
authored
✨ add epss for aqua parser #10849 (#10855)
* ✨ add epss for aqua parser #10849 * add unittest * fix unittest
1 parent 9286f21 commit acec6af

3 files changed

Lines changed: 138 additions & 1 deletion

File tree

‎dojo/tools/aqua/parser.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,10 @@ def get_item(resource, vuln, test):
136136
)
137137
if vulnerability_id != "No CVE":
138138
finding.unsaved_vulnerability_ids = [vulnerability_id]
139-
139+
if vuln.get("epss_score"):
140+
finding.epss_score = vuln.get("epss_score")
141+
if vuln.get("epss_percentile"):
142+
finding.epss_percentile = vuln.get("epss_percentile")
140143
return finding
141144

142145

‎unittests/scans/aqua/issue_10849.json‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
[
2+
{ "image_name": "test:latest",
3+
"results":
4+
{
5+
"image": "test:latest",
6+
"registry": "myregistry",
7+
"scan_started": {
8+
"seconds": 1721416289,
9+
"nanos": 744607040
10+
},
11+
"scan_duration": 53,
12+
"digest": "sha256:97a847b2a0230e01116e00d8b988a4d150b49ee2662032456ab5c46e39ccba1d",
13+
"metadata": {},
14+
"os": "debian",
15+
"version": "11.7",
16+
"resources": [
17+
{
18+
"resource": {
19+
"format": "npm",
20+
"path": "/juice-shop/node_modules/@babel/traverse",
21+
"name": "@babel/traverse",
22+
"version": "7.22.15",
23+
"cpe": "pkg:/npm:*:@babel/traverse:7.22.15",
24+
"license": "MIT",
25+
"layer": "COPY /juice-shop . # buildkit",
26+
"layer_digest": "sha256:69c661528fdd4ef0a0f4fdbd62ec988b9efb5c1a4d11651adb877a13a40da37d"
27+
},
28+
"scanned": true,
29+
"vulnerabilities": [
30+
{
31+
"name": "CVE-2023-45133",
32+
"type": "vulnerability",
33+
"description": "Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.",
34+
"nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45133",
35+
"publish_date": "2023-10-12",
36+
"modification_date": "2023-10-24",
37+
"fix_version": "7.23.2, 8.0.0-alpha.4",
38+
"solution": "Upgrade package @babel/traverse to version 8.0.0-alpha.4, 7.23.2 or above.",
39+
"nvd_score_v3": 8.8,
40+
"nvd_vectors_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
41+
"nvd_severity_v3": "high",
42+
"aqua_score": 8.8,
43+
"aqua_severity": "high",
44+
"aqua_vectors": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
45+
"aqua_scoring_system": "CVSS V3",
46+
"heuristic_ref_id": 265547,
47+
"aqua_severity_classification": "NVD CVSS V3 Score: 8.8",
48+
"aqua_score_classification": "NVD CVSS V3 Score: 8.8",
49+
"cwe_info": [
50+
{
51+
"Id": "CWE-697",
52+
"name": "Incorrect Comparison"
53+
},
54+
{
55+
"Id": "CWE-184",
56+
"name": "Incomplete List of Disallowed Inputs"
57+
}
58+
],
59+
"epss_score": 0.0006,
60+
"epss_percentile": 0.23474,
61+
"epss_date": "2024-01-22"
62+
}
63+
]
64+
}
65+
],
66+
"image_assurance_results": {
67+
"checks_performed": [
68+
{
69+
"policy_id": 6,
70+
"policy_name": "Malware-Default-Policy",
71+
"control": "malware",
72+
"malware_file_scanned": 2057
73+
}
74+
]
75+
},
76+
"vulnerability_summary": {
77+
"total": 98,
78+
"critical": 15,
79+
"high": 47,
80+
"medium": 35,
81+
"low": 1,
82+
"negligible": 38,
83+
"sensitive": 3,
84+
"score_average": 7.2989764
85+
},
86+
"scan_options": {
87+
"scan_executables": true,
88+
"scan_sensitive_data": true,
89+
"scan_malware": true,
90+
"scan_files": true,
91+
"scan_timeout": 3600000000000,
92+
"manual_pull_fallback": true,
93+
"save_adhoc_scans": true,
94+
"use_cvss3": true,
95+
"dockerless": true,
96+
"system_image_platform": "amd64:::",
97+
"enable_fast_scanning": true,
98+
"memoryThrottling": true,
99+
"suggest_os_upgrade": true,
100+
"adhoc_scan_retention": 30,
101+
"enable_diff_ids": true,
102+
"is_trivy_enabled": true,
103+
"register_image": true,
104+
"socket": "docker"
105+
},
106+
"initiating_user": "myuser",
107+
"pull_name": "test:latest",
108+
"original_registry": "myregistry",
109+
"scan_id": 1060,
110+
"required_image_platform": "amd64:::",
111+
"scanned_image_platform": ":::",
112+
"security_feeds_used": {
113+
"executables": "12345"
114+
},
115+
"image_id": 45,
116+
"internal_digest_id": {
117+
"id": 276
118+
},
119+
"local": true,
120+
"isAdhocRegister": true,
121+
"OriginFromHostImage": true,
122+
"FileHashEncoding": "zlib",
123+
"registryType": 6
124+
}
125+
}
126+
]
127+

‎unittests/tools/test_aqua_parser.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,13 @@ def test_aqua_parser_aqua_devops_issue_10611(self):
105105
self.assertEqual(101, len(findings))
106106
self.assertEqual("server.key - server.key (/juice-shop/node_modules/node-gyp/test/fixtures/server.key) ", findings[83].title)
107107

108+
def test_aqua_parser_aqua_devops_issue_10849(self):
109+
with open("unittests/scans/aqua/issue_10849.json", encoding="utf-8") as testfile:
110+
parser = AquaParser()
111+
findings = parser.get_findings(testfile, Test())
112+
self.assertEqual(0.0006, findings[0].epss_score)
113+
self.assertEqual(0.23474, findings[0].epss_percentile)
114+
108115
def test_aqua_parser_aqua_devops_empty(self):
109116
with open("unittests/scans/aqua/empty_aquadevops.json", encoding="utf-8") as testfile:
110117
parser = AquaParser()

0 commit comments

Comments
 (0)