Grafana package used for upgrade_package_nonvulnerable_to_vulnerable case is vulnerable

[Rebits]

Description

In the Release 4.9.0 - RC 2 - Vulnerability Detection E2E tests, it was identified that the Grafana package used in the upgrade_package_nonvulnerable_to_vulnerable test case is vulnerable to CVE-2022-23498. To address this, the package should be replaced with one that is not affected by any known vulnerabilities.

Tasks

• Replace the upgrade_package_nonvulnerable_to_vulnerable test case package with another one with no vulnerabilities for Linux based agents
• Upload new packages to internal bucket

Validation

• E2E Vulnerability detection does not failed in the upgrade_package_nonvulnerable_to_vulnerable test case

[Rebits]

I suggest using grafana-9.3.16 as non-vulnerable and grafana-9.4.1 as vulnerable, although it should be review if these packages are adequate.

[rafabailon]

Update

I have added the Grafana packages and modified the Test to use them. I need to add the URL to the packages so they can be used.

I am moving the issue to On Hold until the packages are uploaded to the bucket.

[Rebits]

Packages correctly uploaded in the following URLs:

Ubuntu

• https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/end_to_end/vulnerability_detector/ubuntu_vuln_packages/grafana_9.3.16_amd64.deb
• https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/end_to_end/vulnerability_detector/ubuntu_vuln_packages/grafana_9.3.16_arm64.deb
• https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/end_to_end/vulnerability_detector/ubuntu_vuln_packages/grafana_9.4.1_amd64.deb
• https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/end_to_end/vulnerability_detector/ubuntu_vuln_packages/grafana_9.4.1_arm64.deb

centOS

• https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/end_to_end/vulnerability_detector/centos_vuln_packages/grafana-9.3.16-1.x86_64.rpm
• https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/end_to_end/vulnerability_detector/centos_vuln_packages/grafana-9.3.16-1.aarch64.rpm
• https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/end_to_end/vulnerability_detector/centos_vuln_packages/grafana-9.4.1-1.x86_64.rpm
• https://s3.amazonaws.com/ci.wazuh.com/qa/testing_files/end_to_end/vulnerability_detector/centos_vuln_packages/grafana-9.4.1-1.aarch64.rpm