keremet/rpm-ostree
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
bdf3cda8db
rpm-ostree/tests/vmcheck
History
Jonathan Lebon bdf3cda8db Print CVEs fixed in available updates 
One question I often have when looking at the output of `status -a`:

```
AvailableUpdate:
        Version: 29.20181202.0 (2018-12-02T08:37:50Z)
         Commit: dece5737a087d5c6038efdb86cb4512f867082ccfc6eb0fa97b2734c1f6d99c3
   GPGSignature: Valid signature by 5A03B4DD8254ECA02FDA1637A20AA56B429476B4
  SecAdvisories: FEDORA-2018-042156f164  Unknown    net-snmp-libs-1:5.8-3.fc29.x86_64
                 FEDORA-2018-87ba0312c2  Moderate   kernel-4.19.5-300.fc29.x86_64
                 FEDORA-2018-87ba0312c2  Moderate   kernel-core-4.19.5-300.fc29.x86_64
                 FEDORA-2018-87ba0312c2  Moderate   kernel-modules-4.19.5-300.fc29.x86_64
                 FEDORA-2018-87ba0312c2  Moderate   kernel-modules-extra-4.19.5-300.fc29.x86_64
                 FEDORA-2018-f467c36c2b  Moderate   git-core-2.19.2-1.fc29.x86_64
           Diff: 67 upgraded, 1 removed, 16 added
```

is "How serious and relevant are these advisories to me? How soon should
I reboot?". For the packages that I'm most familiar with, e.g. `kernel`
and `git-core`, I usually look up the advisory and check why it was
marked as a security update, mentioned CVEs, and how those affect me.

The updateinfo metadata includes a wealth of information that could be
useful here. In Fedora, CVEs treated by the security response team
result in RHBZs, which end up attached to the advisories and thus make
it into that metadata.

This patch tries to reduce friction in answering some of those questions
above by checking for those CVEs and printing a short description in the
output of `status -a`. Example:

```
AvailableUpdate:
        Version: 29.20181202.0 (2018-12-02T08:37:50Z)
         Commit: dece5737a087d5c6038efdb86cb4512f867082ccfc6eb0fa97b2734c1f6d99c3
   GPGSignature: Valid signature by 5A03B4DD8254ECA02FDA1637A20AA56B429476B4
  SecAdvisories: FEDORA-2018-042156f164  Unknown    net-snmp-libs-1:5.8-3.fc29.x86_64
                   CVE-2018-18065 CVE-2018-18066 net-snmp: various flaws [fedora-all]
                   https://bugzilla.redhat.com/show_bug.cgi?id=1637573
                 FEDORA-2018-87ba0312c2  Moderate   kernel-4.19.5-300.fc29.x86_64
                 FEDORA-2018-87ba0312c2  Moderate   kernel-core-4.19.5-300.fc29.x86_64
                 FEDORA-2018-87ba0312c2  Moderate   kernel-modules-4.19.5-300.fc29.x86_64
                 FEDORA-2018-87ba0312c2  Moderate   kernel-modules-extra-4.19.5-300.fc29.x86_64
                   CVE-2018-16862 kernel: cleancache: Infoleak of deleted files after reuse of old inodes
                   https://bugzilla.redhat.com/show_bug.cgi?id=1649017
                   CVE-2018-19407 kernel: kvm: NULL pointer dereference in vcpu_scan_ioapic in arch/x86/kvm/x86.c
                   https://bugzilla.redhat.com/show_bug.cgi?id=1652656
                 FEDORA-2018-f467c36c2b  Moderate   git-core-2.19.2-1.fc29.x86_64
                   CVE-2018-19486 git: Improper handling of PATH allows for commands to executed from current directory
                   https://bugzilla.redhat.com/show_bug.cgi?id=1653143
           Diff: 67 upgraded, 1 removed, 16 added
```

Including the CVE name and RHBZ link also makes it easier to look for
more details if desired.

Closes: #1695
Approved by: rfairley
2018-12-05 18:56:49 +00:00
..
fetch-journal.sh vmcheck: prep for parallel runs 2017-03-13 00:42:13 +00:00
install.sh vmcheck: Sync over libsolv and zchunk-libs too 2018-11-20 18:06:34 +00:00
multitest.py vmcheck/multitest: Print when we're waiting 2018-11-20 18:06:34 +00:00
overlay.sh vmcheck: Drop selinux-policy hack 2018-02-27 15:44:11 +00:00
sync.sh daemon: add RPMOSTREE_DEBUG_DISABLE_DAEMON_IDLE_EXIT 2017-10-12 15:35:44 +00:00
test-autoupdate-check.sh Print CVEs fixed in available updates 2018-12-05 18:56:49 +00:00
test-autoupdate-stage.sh Stabilize stage automatic update policy 2018-08-21 01:01:45 +00:00
test-cached-rpm-diffs.sh tests: Split test-basic into misc-{1,2} 2018-04-16 17:53:20 +00:00
test-db.sh tests/vmcheck: Create correct base commits from layered 2018-09-17 20:07:45 +00:00
test-download-only.sh tests/vmcheck: Create correct base commits from layered 2018-09-17 20:07:45 +00:00
test-initramfs.sh initramfs: Return error when --arg specified without --enable 2018-09-12 20:45:19 +00:00
test-kernel-args.sh tests/kernel-args: Prep for staged 2018-07-12 17:44:15 +00:00
test-layering-basic-1.sh Use indicatif for progress 2018-11-09 13:59:43 +00:00
test-layering-basic-2.sh core: Tweak "Importing" messages 2018-11-21 13:54:35 +00:00
test-layering-gpg.sh tests/libvm: use rsync and add yumrepo mode 2017-10-06 18:20:59 +00:00
test-layering-local.sh vmcheck: Store temporary files in /var/tmp instead 2018-09-07 14:20:01 +00:00
test-layering-non-root-caps.sh tests/vmcheck: turn on strict bash mode 2017-10-02 20:36:07 +00:00
test-layering-relabel.sh core: Change relabeling to use libostree's SELinux support 2017-12-08 15:01:32 +00:00
test-layering-relayer.sh tests/vmcheck: turn on strict bash mode 2017-10-02 20:36:07 +00:00
test-layering-rpmdb.sh core: handle shared files and multilib 2018-02-08 21:58:55 +00:00
test-layering-scripts.sh Move reset out of experimental 2018-11-22 20:47:50 +00:00
test-layering-unified.sh vmcheck: Store temporary files in /var/tmp instead 2018-09-07 14:20:01 +00:00
test-livefs.sh Move reset out of experimental 2018-11-22 20:47:50 +00:00
test-misc-1.sh vmcheck/misc-1: skip the overlay check when needed 2018-09-12 14:48:02 +00:00
test-misc-2.sh daemon/transaction-types: Fix dnf cache override 2018-11-26 23:39:44 +00:00
test-override-kernel.sh app: Add support for passing URLs to RPMs 2018-08-23 11:16:15 +00:00
test-override-local-replace.sh tests/vmcheck: Create correct base commits from layered 2018-09-17 20:07:45 +00:00
test-override-remove.sh tests/vmcheck: Create correct base commits from layered 2018-09-17 20:07:45 +00:00
test-override-replace-2.sh tests/vmcheck: Create correct base commits from layered 2018-09-17 20:07:45 +00:00
test-pinned-commit.sh Handle "pinned commits" specifically 2018-06-11 20:37:58 +00:00
test-reset.sh Move reset out of experimental 2018-11-22 20:47:50 +00:00
test-rojig-client.sh tests/vmcheck: Fix rojig expected NEVRA for f28 2018-06-04 14:10:21 +00:00
test-upgrades.sh app: Add an update → upgrade alias 2018-07-09 14:21:32 +00:00
test.sh Hard require staging 2018-09-11 20:55:48 +00:00