Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(ubuntu): add 23.10 (mantic minotaur) #349

Merged
merged 1 commit into from
Oct 20, 2023
Merged

Conversation

MaineK00n
Copy link
Collaborator

@MaineK00n MaineK00n commented Oct 20, 2023

What did you implement:

add 23.10 (mantic minotaur)

Type of change

  • New feature (non-breaking change which adds functionality)
  • This change requires a documentation update

How Has This Been Tested?

$ goval-dictionary fetch ubuntu 23.10
INFO[10-20|15:01:37] Fetching...                              URL=https://security-metadata.canonical.com/oval/oci.com.ubuntu.mantic.cve.oval.xml.bz2
INFO[10-20|15:01:41] Fetched                                  File=oci.com.ubuntu.mantic.cve.oval.xml.bz2 Count=10430 Timestamp=2023-10-19T15:09:48
INFO[10-20|15:01:41] Refreshing...                            Family=ubuntu Version=23.10
INFO[10-20|15:01:41] Inserting new Definitions... 
10430 / 10430 [----------------------------------------------] 100.00% 40121 p/s
INFO[10-20|15:01:41] Finish                                   Updated=10430

$ goval-dictionary select --by-package ubuntu 23.10 curl
CVE-2023-28321
    {3744 9538 curl 7.88.1-10ubuntu1  false }
CVE-2023-28322
    {3745 9539 curl 7.88.1-10ubuntu1  false }
CVE-2023-38039
    {4387 9998 curl 8.2.1-1ubuntu3  false }
CVE-2023-38545
    {4464 10031 curl 8.2.1-1ubuntu3.1  false }
CVE-2023-38546
    {4465 10032 curl 8.2.1-1ubuntu3.1  false }
------------------
[]models.Definition{
  models.Definition{
    ID:           0x2542,
    RootID:       0x1,
    DefinitionID: "oval:com.ubuntu.mantic:def:2023283210000000",
    Title:        "CVE-2023-28321 on Ubuntu 23.10 (mantic) - low.",
    Description:  "An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.\n\nUpdate Instructions:\n\nRun `sudo pro fix CVE-2023-28321` to fix the vulnerability. The problem can be corrected\nby updating your system to the following package versions:\n\ncurl - 7.88.1-10ubuntu1\nlibcurl3-gnutls - 7.88.1-10ubuntu1\nlibcurl3-nss - 7.88.1-10ubuntu1\nlibcurl4 - 7.88.1-10ubuntu1\nNo subscription required",
    Advisory:     models.Advisory{
      ID:           0x2542,
      DefinitionID: 0x2542,
      Severity:     "Low",
      Cves:         []models.Cve{
        models.Cve{
          ID:         0x2542,
          AdvisoryID: 0x2542,
          CveID:      "CVE-2023-28321",
          Cvss2:      "",
          Cvss3:      "",
          Cwe:        "",
          Impact:     "",
          Href:       "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28321",
          Public:     "",
        },
      },
      Bugzillas:          []models.Bugzilla{},
      AffectedCPEList:    []models.Cpe{},
      AffectedRepository: "",
      Issued:             2023-05-17 06:00:00 UTC,
      Updated:            2023-05-17 06:00:00 UTC,
    },
    Debian:        (*models.Debian)(nil),
    AffectedPacks: []models.Package{
      models.Package{
        ID:              0xea0,
        DefinitionID:    0x2542,
        Name:            "curl",
        Version:         "7.88.1-10ubuntu1",
        Arch:            "",
        NotFixedYet:     false,
        ModularityLabel: "",
      },
    },
    References: []models.Reference{
      models.Reference{
        ID:           0x31c4,
        DefinitionID: 0x2542,
        Source:       "CVE",
        RefID:        "CVE-2023-28321",
        RefURL:       "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28321",
      },
    },
  },
...

Checklist:

You don't have to satisfy all of the following.

  • Write tests
  • Write documentation
  • Check that there aren't other open pull requests for the same issue/feature
  • Format your source code by make fmt
  • Pass the test by make test
  • Provide verification config / commands
  • Enable "Allow edits from maintainers" for this PR
  • Update the messages below

Is this ready for review?: YES

Reference

@MaineK00n MaineK00n self-assigned this Oct 20, 2023
@MaineK00n MaineK00n merged commit 086af7d into master Oct 20, 2023
@MaineK00n MaineK00n deleted the MaineK00n/ubuntu-23.10 branch October 20, 2023 06:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant