Skip to content

Commit b6f1e72

Browse files
manuel-sommercneill
manuel-sommer
and
cneill
authored
🎉 Make Trivy Operator K8s vulnids consistent (#11188)
* 🎉 Uniform Trivy Operator K8s vulnids * sha sum * sha sum * bug fix * ruff * fix secretshandler * sha sum * ruff * fix * fix * fix unittests * fix * Update dojo/tools/trivy_operator/uniform_vulnid.py Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com> * Update dojo/tools/trivy_operator/compliance_handler.py Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com> * Update dojo/tools/trivy_operator/checks_handler.py Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com> * Update dojo/tools/trivy_operator/vulnerability_handler.py Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com> * update sha sum * update sha sum --------- Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
1 parent 9a29e63 commit b6f1e72

9 files changed

Lines changed: 35 additions & 15 deletions

File tree

‎dojo/settings/.settings.dist.py.sha256sum‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
58e2f6cb0ed2c041fe2741d955b72cb7540bfb0923f489d6324717fcf00039da
1+
16d7a27d3146421a9aa6a8b1283f3d71b5c41b8bdb7c88ca70b0160e251034d1

‎dojo/settings/settings.dist.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1744,6 +1744,8 @@ def saml2_attrib_map_format(dict):
17441744
"ELSA": "https://linux.oracle.com/errata/&&.html", # e.g. https://linux.oracle.com/errata/ELSA-2024-12714.html
17451745
"ELBA": "https://linux.oracle.com/errata/&&.html", # e.g. https://linux.oracle.com/errata/ELBA-2024-7457.html
17461746
"RXSA": "https://errata.rockylinux.org/", # e.g. https://errata.rockylinux.org/RXSA-2024:4928
1747+
"AVD": "https://avd.aquasec.com/misconfig/", # e.g. https://avd.aquasec.com/misconfig/avd-ksv-01010
1748+
"KHV": "https://avd.aquasec.com/misconfig/kubernetes/", # e.g. https://avd.aquasec.com/misconfig/kubernetes/khv045
17471749
"CAPEC": "https://capec.mitre.org/data/definitions/&&.html", # e.g. https://capec.mitre.org/data/definitions/157.html
17481750
"CWE": "https://cwe.mitre.org/data/definitions/&&.html", # e.g. https://cwe.mitre.org/data/definitions/79.html
17491751
"TEMP": "https://security-tracker.debian.org/tracker/", # e.g. https://security-tracker.debian.org/tracker/TEMP-0841856-B18BAF

‎dojo/templatetags/display_tags.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -780,6 +780,8 @@ def vulnerability_url(vulnerability_id):
780780

781781
for key in settings.VULNERABILITY_URLS:
782782
if vulnerability_id.upper().startswith(key):
783+
if key in ["AVD", "KHV"]:
784+
return settings.VULNERABILITY_URLS[key] + str(vulnerability_id.lower())
783785
if "&&" in settings.VULNERABILITY_URLS[key]:
784786
# Process specific keys specially if need
785787
if key in ["CAPEC", "CWE"]:

‎dojo/tools/trivy_operator/checks_handler.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
from dojo.models import Finding
2+
from dojo.tools.trivy_operator.uniform_vulnid import UniformTrivyVulnID
23

34
TRIVY_SEVERITIES = {
45
"CRITICAL": "Critical",
@@ -47,6 +48,6 @@ def handle_checks(self, labels, checks, test):
4748
tags=[resource_namespace],
4849
)
4950
if check_id:
50-
finding.unsaved_vulnerability_ids = [check_id]
51+
finding.unsaved_vulnerability_ids = [UniformTrivyVulnID().return_uniformed_vulnid(check_id)]
5152
findings.append(finding)
5253
return findings

‎dojo/tools/trivy_operator/compliance_handler.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
from dojo.models import Finding
2+
from dojo.tools.trivy_operator.uniform_vulnid import UniformTrivyVulnID
23

34
TRIVY_SEVERITIES = {
45
"CRITICAL": "Critical",
@@ -54,6 +55,6 @@ def handle_compliance(self, benchmarkreport, test):
5455
dynamic_finding=True,
5556
)
5657
if check_checkID:
57-
finding.unsaved_vulnerability_ids = [check_checkID]
58+
finding.unsaved_vulnerability_ids = [UniformTrivyVulnID().return_uniformed_vulnid(check_checkID)]
5859
findings.append(finding)
5960
return findings

‎dojo/tools/trivy_operator/secrets_handler.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ def handle_secrets(self, labels, secrets, test):
4242
secret_description += "\n**resource.kind:** " + resource_kind
4343
secret_description += "\n**resource.name:** " + resource_name
4444
secret_description += "\n**resource.namespace:** " + resource_namespace
45+
secret_description += "\n**ruleID:** " + secret_rule_id
4546
finding = Finding(
4647
test=test,
4748
title=title,
@@ -54,7 +55,5 @@ def handle_secrets(self, labels, secrets, test):
5455
service=service,
5556
tags=[resource_namespace],
5657
)
57-
if secret_rule_id:
58-
finding.unsaved_vulnerability_ids = [secret_rule_id]
5958
findings.append(finding)
6059
return findings

‎dojo/tools/trivy_operator/uniform_vulnid.py‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import re
2+
3+
4+
class UniformTrivyVulnID:
5+
def return_uniformed_vulnid(self, vulnid):
6+
if vulnid is None:
7+
return vulnid
8+
if "cve" in vulnid.lower():
9+
return vulnid
10+
if "khv" in vulnid.lower():
11+
temp = re.compile("([a-zA-Z-_]+)([0-9]+)")
12+
number = str(temp.match(vulnid).groups()[1]).zfill(3)
13+
avd_category = str(temp.match(vulnid.lower()).groups()[0])
14+
return avd_category.upper() + number
15+
if "ksv" in vulnid.lower() or "kcv" in vulnid.lower():
16+
temp = re.compile("([a-zA-Z-_]+)([0-9]+)")
17+
number = str(temp.match(vulnid).groups()[1]).zfill(4)
18+
avd_category = str(temp.match(vulnid.lower().replace("_", "").replace("-", "")).groups()[0].replace("avd", ""))
19+
return "AVD-" + avd_category.upper() + "-" + number
20+
return vulnid

‎dojo/tools/trivy_operator/vulnerability_handler.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
from dojo.models import Finding
2+
from dojo.tools.trivy_operator.uniform_vulnid import UniformTrivyVulnID
23

34
DESCRIPTION_TEMPLATE = """{title}
45
**Fixed version:** {fixed_version}
@@ -85,6 +86,6 @@ def handle_vulns(self, labels, vulnerabilities, test):
8586
tags=finding_tags,
8687
)
8788
if vuln_id:
88-
finding.unsaved_vulnerability_ids = [vuln_id]
89+
finding.unsaved_vulnerability_ids = [UniformTrivyVulnID().return_uniformed_vulnid(vuln_id)]
8990
findings.append(finding)
9091
return findings

‎unittests/tools/test_trivy_operator_parser.py‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ def test_configauditreport_single_vulns(self):
2525
finding = findings[0]
2626
self.assertEqual("Low", finding.severity)
2727
self.assertEqual(1, len(finding.unsaved_vulnerability_ids))
28-
self.assertEqual("KSV014", finding.unsaved_vulnerability_ids[0])
28+
self.assertEqual("AVD-KSV-0014", finding.unsaved_vulnerability_ids[0])
2929
self.assertEqual("KSV014 - Root file system is not read-only", finding.title)
3030

3131
def test_configauditreport_many_vulns(self):
@@ -36,12 +36,12 @@ def test_configauditreport_many_vulns(self):
3636
finding = findings[0]
3737
self.assertEqual("Low", finding.severity)
3838
self.assertEqual(1, len(finding.unsaved_vulnerability_ids))
39-
self.assertEqual("KSV014", finding.unsaved_vulnerability_ids[0])
39+
self.assertEqual("AVD-KSV-0014", finding.unsaved_vulnerability_ids[0])
4040
self.assertEqual("KSV014 - Root file system is not read-only", finding.title)
4141
finding = findings[1]
4242
self.assertEqual("Low", finding.severity)
4343
self.assertEqual(1, len(finding.unsaved_vulnerability_ids))
44-
self.assertEqual("KSV016", finding.unsaved_vulnerability_ids[0])
44+
self.assertEqual("AVD-KSV-0016", finding.unsaved_vulnerability_ids[0])
4545
self.assertEqual("KSV016 - Memory requests not specified", finding.title)
4646

4747
def test_vulnerabilityreport_no_vuln(self):
@@ -96,8 +96,6 @@ def test_exposedsecretreport_single_vulns(self):
9696
self.assertEqual(len(findings), 1)
9797
finding = findings[0]
9898
self.assertEqual("Critical", finding.severity)
99-
self.assertEqual(1, len(finding.unsaved_vulnerability_ids))
100-
self.assertEqual("aws-secret-access-key", finding.unsaved_vulnerability_ids[0])
10199
self.assertEqual("aws-secret-access-key", finding.references)
102100
self.assertEqual("root/aws_secret.txt", finding.file_path)
103101
self.assertEqual("Secret detected in root/aws_secret.txt - AWS Secret Access Key", finding.title)
@@ -109,15 +107,11 @@ def test_exposedsecretreport_many(self):
109107
self.assertEqual(len(findings), 2)
110108
finding = findings[0]
111109
self.assertEqual("Critical", finding.severity)
112-
self.assertEqual(1, len(finding.unsaved_vulnerability_ids))
113-
self.assertEqual("aws-secret-access-key", finding.unsaved_vulnerability_ids[0])
114110
self.assertEqual("aws-secret-access-key", finding.references)
115111
self.assertEqual("root/aws_secret.txt", finding.file_path)
116112
self.assertEqual("Secret detected in root/aws_secret.txt - AWS Secret Access Key", finding.title)
117113
finding = findings[1]
118114
self.assertEqual("Critical", finding.severity)
119-
self.assertEqual(1, len(finding.unsaved_vulnerability_ids))
120-
self.assertEqual("github-pat", finding.unsaved_vulnerability_ids[0])
121115
self.assertEqual("github-pat", finding.references)
122116
self.assertEqual("root/github_secret.txt", finding.file_path)
123117
self.assertEqual("Secret detected in root/github_secret.txt - GitHub Personal Access Token", finding.title)

0 commit comments

Comments
 (0)