Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(detector/gost/ubuntu): detection logic when esm etc. are mixed #2090

Merged
merged 1 commit into from
Dec 17, 2024
Merged

fix(detector/gost/ubuntu): detection logic when esm etc. are mixed #2090

merged 1 commit into from
Dec 17, 2024

Conversation

MaineK00n
Copy link
Collaborator

@MaineK00n MaineK00n commented Dec 16, 2024 •
edited
Loading

What did you implement:

With this PR(vulsio/gost#185), patch information for fixes in ESM will now be returned in addition to the main release.

This can result in a situation where an issue is not fixed in the main release, but a fix is ​​released in the ESM.
For example, in the case of focal and esm-apps/focal, as shown below.
https://github.com/vulsio/vuls-data-raw-ubuntu-cve-tracker/blob/d0b60209acf5d91d3a7ca49c85550ee907bd8717/2020/CVE-2020-22039.json

Also, even if you make a fix in the ESM, it may remain needed in the main release and be judged as unfixed.

This PR fixes these bugs.

Type of change

  • Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

1. main: needed, esm-apps: fixed; installed version < esm-apps fixed version

    "family": "ubuntu",
    "release": "20.04",
    "packages": {
        "ffmpeg": {
            "name": "ffmpeg",
            "version": "7:4.2.7-0ubuntu0.1",
            "release": "",
            "newVersion": "",
            "newRelease": "",
            "arch": "",
            "repository": "",
            "modularitylabel": ""
        },
    },
    "SrcPackages": {
        "ffmpeg": {
            "name": "ffmpeg",
            "version": "7:4.2.7-0ubuntu0.1",
            "arch": "",
            "binaryNames": [
                "ffmpeg"
            ]
        },
    },

before

$ vuls report --refresh-cve
...
localhost (ubuntu20.04)
=======================
Total: 21 (Critical:0 High:0 Medium:21 Low:0 ?:0)
0/21 Fixed, 0 poc, 0 exploits, 0 kevs, uscert: 0, jpcert: 0 alerts
1 installed

+----------------+------+--------+-----+-----+-----------+---------+----------+
|     CVE-ID     | CVSS | ATTACK | POC | KEV |   ALERT   |  FIXED  | PACKAGES |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-20898 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22024 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22038 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22039 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22040 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22043 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22051 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38090 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38091 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38092 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38093 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38094 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-3109  |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-3341  |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-48434 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-49502 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-50010 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51794 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51798 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-31578 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-32230 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+

$ cat results/2024-12-16T18-39-28+0900/localhost.json | jq -r '.scannedCves."CVE-2020-22039"'
{
  "cveID": "CVE-2020-22039",
  "confidences": [
    {
      "score": 100,
      "detectionMethod": "UbuntuAPIMatch"
    }
  ],
  "affectedPackages": [
    {
      "name": "ffmpeg",
      "notFixedYet": true,
      "fixState": "open"
    }
  ],
  "cveContents": {
    "ubuntu_api": [
      {
        "type": "ubuntu_api",
        "cveID": "CVE-2020-22039",
        "title": "",
        "summary": "A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function.",
        "cvss2Score": 0,
        "cvss2Vector": "",
        "cvss2Severity": "medium",
        "cvss3Score": 0,
        "cvss3Vector": "",
        "cvss3Severity": "medium",
        "cvss40Score": 0,
        "cvss40Vector": "",
        "cvss40Severity": "",
        "sourceLink": "https://ubuntu.com/security/CVE-2020-22039",
        "references": [
          {
            "link": "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a581bb66ea5eb981e2e498ca301df7d1ef15a6a3"
          },
          {
            "link": "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a581bb66ea5eb981e2e498ca301df7d1ef15a6a3",
            "source": "UPSTREAM"
          },
          {
            "link": "https://trac.ffmpeg.org/ticket/8302"
          },
          {
            "link": "https://ubuntu.com/security/notices/USN-6430-1"
          },
          {
            "link": "https://www.cve.org/CVERecord?id=CVE-2020-22039"
          }
        ],
        "published": "2021-06-01T20:15:00Z",
        "lastModified": "0001-01-01T00:00:00Z"
      }
    ]
  },
  "alertDict": {
    "cisa": null,
    "jpcert": null,
    "uscert": null
  }
}

after

$ vuls report --refresh-cve
...
localhost (ubuntu20.04)
=======================
Total: 21 (Critical:0 High:0 Medium:21 Low:0 ?:0)
21/21 Fixed, 0 poc, 0 exploits, 0 kevs, uscert: 0, jpcert: 0 alerts
1 installed

+----------------+------+--------+-----+-----+-----------+---------+----------+
|     CVE-ID     | CVSS | ATTACK | POC | KEV |   ALERT   |  FIXED  | PACKAGES |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-20898 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22024 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22038 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22039 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22040 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22043 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22051 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38090 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38091 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38092 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38093 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38094 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-3109  |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-3341  |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-48434 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-49502 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-50010 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51794 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51798 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-31578 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-32230 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+

$ cat results/2024-12-16T18-39-28+0900/localhost.json | jq -r '.scannedCves."CVE-2020-22039"'
{
  "cveID": "CVE-2020-22039",
  "confidences": [
    {
      "score": 100,
      "detectionMethod": "UbuntuAPIMatch"
    }
  ],
  "affectedPackages": [
    {
      "name": "ffmpeg",
      "fixedIn": "7:4.2.7-0ubuntu0.1+esm2"
    }
  ],
  "cveContents": {
    "ubuntu_api": [
      {
        "type": "ubuntu_api",
        "cveID": "CVE-2020-22039",
        "title": "",
        "summary": "A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function.",
        "cvss2Score": 0,
        "cvss2Vector": "",
        "cvss2Severity": "medium",
        "cvss3Score": 0,
        "cvss3Vector": "",
        "cvss3Severity": "medium",
        "cvss40Score": 0,
        "cvss40Vector": "",
        "cvss40Severity": "",
        "sourceLink": "https://ubuntu.com/security/CVE-2020-22039",
        "references": [
          {
            "link": "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a581bb66ea5eb981e2e498ca301df7d1ef15a6a3"
          },
          {
            "link": "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a581bb66ea5eb981e2e498ca301df7d1ef15a6a3",
            "source": "UPSTREAM"
          },
          {
            "link": "https://trac.ffmpeg.org/ticket/8302"
          },
          {
            "link": "https://ubuntu.com/security/notices/USN-6430-1"
          },
          {
            "link": "https://www.cve.org/CVERecord?id=CVE-2020-22039"
          }
        ],
        "published": "2021-06-01T20:15:00Z",
        "lastModified": "0001-01-01T00:00:00Z"
      }
    ]
  },
  "alertDict": {
    "cisa": null,
    "jpcert": null,
    "uscert": null
  }
}

2. main: needed, esm-apps: fixed; installed version(esm) > esm-apps fixed version

    "family": "ubuntu",
    "release": "20.04",
    "packages": {
        "ffmpeg": {
            "name": "ffmpeg",
            "version": "7:4.2.7-0ubuntu0.1+esm3",
            "release": "",
            "newVersion": "",
            "newRelease": "",
            "arch": "",
            "repository": "",
            "modularitylabel": ""
        },
    },
    "SrcPackages": {
        "ffmpeg": {
            "name": "ffmpeg",
            "version": "7:4.2.7-0ubuntu0.1+esm3",
            "arch": "",
            "binaryNames": [
                "ffmpeg"
            ]
        },
    },

before

$ vuls report --refresh-cve
...
localhost (ubuntu20.04)
=======================
Total: 21 (Critical:0 High:0 Medium:21 Low:0 ?:0)
0/21 Fixed, 0 poc, 0 exploits, 0 kevs, uscert: 0, jpcert: 0 alerts
1 installed

+----------------+------+--------+-----+-----+-----------+---------+----------+
|     CVE-ID     | CVSS | ATTACK | POC | KEV |   ALERT   |  FIXED  | PACKAGES |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-20898 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22024 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22038 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22039 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22040 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22043 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22051 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38090 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38091 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38092 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38093 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38094 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-3109  |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-3341  |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-48434 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-49502 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-50010 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51794 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51798 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-31578 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-32230 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+

$ cat results/2024-12-16T18-39-28+0900/localhost.json | jq -r '.scannedCves."CVE-2020-22039"'
{
  "cveID": "CVE-2020-22039",
  "confidences": [
    {
      "score": 100,
      "detectionMethod": "UbuntuAPIMatch"
    }
  ],
  "affectedPackages": [
    {
      "name": "ffmpeg",
      "notFixedYet": true,
      "fixState": "open"
    }
  ],
  "cveContents": {
    "ubuntu_api": [
      {
        "type": "ubuntu_api",
        "cveID": "CVE-2020-22039",
        "title": "",
        "summary": "A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function.",
        "cvss2Score": 0,
        "cvss2Vector": "",
        "cvss2Severity": "medium",
        "cvss3Score": 0,
        "cvss3Vector": "",
        "cvss3Severity": "medium",
        "cvss40Score": 0,
        "cvss40Vector": "",
        "cvss40Severity": "",
        "sourceLink": "https://ubuntu.com/security/CVE-2020-22039",
        "references": [
          {
            "link": "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a581bb66ea5eb981e2e498ca301df7d1ef15a6a3"
          },
          {
            "link": "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a581bb66ea5eb981e2e498ca301df7d1ef15a6a3",
            "source": "UPSTREAM"
          },
          {
            "link": "https://trac.ffmpeg.org/ticket/8302"
          },
          {
            "link": "https://ubuntu.com/security/notices/USN-6430-1"
          },
          {
            "link": "https://www.cve.org/CVERecord?id=CVE-2020-22039"
          }
        ],
        "published": "2021-06-01T20:15:00Z",
        "lastModified": "0001-01-01T00:00:00Z"
      }
    ]
  },
  "alertDict": {
    "cisa": null,
    "jpcert": null,
    "uscert": null
  }
}

after

$ vuls report --refresh-cve
...
localhost (ubuntu20.04)
=======================
Total: 6 (Critical:0 High:0 Medium:6 Low:0 ?:0)
6/6 Fixed, 0 poc, 0 exploits, 0 kevs, uscert: 0, jpcert: 0 alerts
1 installed

+----------------+------+--------+-----+-----+-----------+---------+----------+
|     CVE-ID     | CVSS | ATTACK | POC | KEV |   ALERT   |  FIXED  | PACKAGES |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-49502 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-50010 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51794 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51798 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-31578 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-32230 |  6.9 |        |     |     |           |   fixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+

$ cat results/2024-12-16T18-39-28+0900/localhost.json | jq -r '.scannedCves."CVE-2020-22039"'
(empty)

3. main: needed, esm-apps: fixed; installed version(non esm) > esm-apps fixed version

    "family": "ubuntu",
    "release": "20.04",
    "packages": {
        "ffmpeg": {
            "name": "ffmpeg",
            "version": "7:4.2.7-0ubuntu0.2",
            "release": "",
            "newVersion": "",
            "newRelease": "",
            "arch": "",
            "repository": "",
            "modularitylabel": ""
        },
    },
    "SrcPackages": {
        "ffmpeg": {
            "name": "ffmpeg",
            "version": "7:4.2.7-0ubuntu0.2",
            "arch": "",
            "binaryNames": [
                "ffmpeg"
            ]
        },
    },

before

$ vuls report --refresh-cve
...
localhost (ubuntu20.04)
=======================
Total: 21 (Critical:0 High:0 Medium:21 Low:0 ?:0)
0/21 Fixed, 0 poc, 0 exploits, 0 kevs, uscert: 0, jpcert: 0 alerts
1 installed

+----------------+------+--------+-----+-----+-----------+---------+----------+
|     CVE-ID     | CVSS | ATTACK | POC | KEV |   ALERT   |  FIXED  | PACKAGES |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-20898 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22024 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22038 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22039 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22040 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22043 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2020-22051 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38090 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38091 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38092 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38093 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2021-38094 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-3109  |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-3341  |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2022-48434 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-49502 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-50010 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51794 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2023-51798 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-31578 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+
| CVE-2024-32230 |  6.9 |        |     |     |           | unfixed | ffmpeg   |
+----------------+------+--------+-----+-----+-----------+---------+----------+

$ cat results/2024-12-16T18-39-28+0900/localhost.json | jq -r '.scannedCves."CVE-2020-22039"'
{
  "cveID": "CVE-2020-22039",
  "confidences": [
    {
      "score": 100,
      "detectionMethod": "UbuntuAPIMatch"
    }
  ],
  "affectedPackages": [
    {
      "name": "ffmpeg",
      "notFixedYet": true,
      "fixState": "open"
    }
  ],
  "cveContents": {
    "ubuntu_api": [
      {
        "type": "ubuntu_api",
        "cveID": "CVE-2020-22039",
        "title": "",
        "summary": "A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function.",
        "cvss2Score": 0,
        "cvss2Vector": "",
        "cvss2Severity": "medium",
        "cvss3Score": 0,
        "cvss3Vector": "",
        "cvss3Severity": "medium",
        "cvss40Score": 0,
        "cvss40Vector": "",
        "cvss40Severity": "",
        "sourceLink": "https://ubuntu.com/security/CVE-2020-22039",
        "references": [
          {
            "link": "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a581bb66ea5eb981e2e498ca301df7d1ef15a6a3"
          },
          {
            "link": "https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a581bb66ea5eb981e2e498ca301df7d1ef15a6a3",
            "source": "UPSTREAM"
          },
          {
            "link": "https://trac.ffmpeg.org/ticket/8302"
          },
          {
            "link": "https://ubuntu.com/security/notices/USN-6430-1"
          },
          {
            "link": "https://www.cve.org/CVERecord?id=CVE-2020-22039"
          }
        ],
        "published": "2021-06-01T20:15:00Z",
        "lastModified": "0001-01-01T00:00:00Z"
      }
    ]
  },
  "alertDict": {
    "cisa": null,
    "jpcert": null,
    "uscert": null
  }
}

after

$ vuls report --refresh-cve
...
localhost (ubuntu20.04)
=======================
Total: 0 (Critical:0 High:0 Medium:0 Low:0 ?:0)
0/0 Fixed, 0 poc, 0 exploits, 0 kevs, uscert: 0, jpcert: 0 alerts
1 installed

No CVE-IDs are found in updatable packages.
1 installed

$ cat results/2024-12-16T18-39-28+0900/localhost.json | jq -r '.scannedCves."CVE-2020-22039"'
(empty)

Checklist:

You don't have to satisfy all of the following.

  • Write tests
  • Write documentation
  • Check that there aren't other open pull requests for the same issue/feature
  • Format your source code by make fmt
  • Pass the test by make test
  • Provide verification config / commands
  • Enable "Allow edits from maintainers" for this PR
  • Update the messages below

Is this ready for review?: YES

Reference

@MaineK00n MaineK00n self-assigned this Dec 16, 2024
@MaineK00n MaineK00n requested a review from shino December 16, 2024 20:25
shino
shino approved these changes Dec 17, 2024
View reviewed changes
Copy link
Collaborator

@shino shino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎉

@MaineK00n MaineK00n merged commit 635109f into master Dec 17, 2024
7 checks passed
@MaineK00n MaineK00n deleted the MaineK00n/patch-2 branch December 17, 2024 08:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@shino shino shino approved these changes

Assignees

@MaineK00n MaineK00n

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@MaineK00n @shino