feat(vex): Add support for CSAF format #5535

juan131 · 2023-11-08T10:28:33Z

Description

This PR adds support for filtering out detected vulnerabilities using the existing --vex experimental flag and VEX data provided using CSAF format (currently only OpenVEX & CycloneDX are supported).

Given the following SBOM running the scanner will report the following vulnerabilities:

$ trivy sbom trivy.sbom.cdx
2023-11-08T11:26:24.445+0100	INFO	Vulnerability scanning is enabled
2023-11-08T11:26:24.448+0100	INFO	Detected SBOM format: cyclonedx-json
2023-11-08T11:26:24.455+0100	WARN	Ignore the OS package as no OS information is found.
2023-11-08T11:26:24.467+0100	INFO	Number of language-specific files: 1
2023-11-08T11:26:24.467+0100	INFO	Detecting gomod vulnerabilities...

go.mod (gomod)

Total: 9 (UNKNOWN: 0, LOW: 0, MEDIUM: 7, HIGH: 2, CRITICAL: 0)

┌───────────────────────────────────────┬─────────────────────┬──────────┬────────┬─────────────────────┬────────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                │    Vulnerability    │ Severity │ Status │  Installed Version  │     Fixed Version      │                            Title                             │
├───────────────────────────────────────┼─────────────────────┼──────────┼────────┼─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/cloudflare/circl           │ CVE-2023-1732       │ MEDIUM   │ fixed  │ 1.1.0               │ 1.3.3                  │ Improper random reading in CIRCL                             │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-1732                    │
├───────────────────────────────────────┼─────────────────────┤          │        ├─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/cyphar/filepath-securejoin │ GHSA-6xv5-86q9-7xr8 │          │        │ 0.2.3               │ 0.2.4                  │ SecureJoin: on windows, paths outside of the rootfs could be │
│                                       │                     │          │        │                     │                        │ inadvertently produced...                                    │
│                                       │                     │          │        │                     │                        │ https://github.com/advisories/GHSA-6xv5-86q9-7xr8            │
├───────────────────────────────────────┼─────────────────────┤          │        ├─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/docker/docker              │ GHSA-jq35-85cj-fj4p │          │        │ 23.0.5+incompatible │ 24.0.7                 │ /sys/devices/virtual/powercap accessible by default to       │
│                                       │                     │          │        │                     │                        │ containers                                                   │
│                                       │                     │          │        │                     │                        │ https://github.com/advisories/GHSA-jq35-85cj-fj4p            │
├───────────────────────────────────────┼─────────────────────┤          │        ├─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/sigstore/rekor             │ CVE-2023-33199      │          │        │ 1.1.1               │ 1.2.0                  │ malformed proposed intoto entries can cause a panic          │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-33199                   │
├───────────────────────────────────────┼─────────────────────┼──────────┤        ├─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net                      │ CVE-2023-39325      │ HIGH     │        │ 0.9.0               │ 0.17.0                 │ rapid stream resets can cause excessive work                 │
│                                       │                     │          │        │                     │                        │ (CVE-2023-44487)                                             │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
│                                       ├─────────────────────┼──────────┤        │                     ├────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                       │ CVE-2023-3978       │ MEDIUM   │        │                     │ 0.13.0                 │ Cross site scripting                                         │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-3978                    │
│                                       ├─────────────────────┤          │        │                     ├────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                       │ CVE-2023-44487      │          │        │                     │ 0.17.0                 │ Multiple HTTP/2 enabled web servers are vulnerable to a DDoS │
│                                       │                     │          │        │                     │                        │ attack (Rapid...                                             │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
├───────────────────────────────────────┼─────────────────────┼──────────┤        ├─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc                │ GHSA-m425-mq94-257g │ HIGH     │        │ 1.54.0              │ 1.56.3, 1.57.1, 1.58.3 │ gRPC-Go HTTP/2 Rapid Reset vulnerability                     │
│                                       │                     │          │        │                     │                        │ https://github.com/advisories/GHSA-m425-mq94-257g            │
│                                       ├─────────────────────┼──────────┤        │                     ├────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                       │ CVE-2023-44487      │ MEDIUM   │        │                     │ 1.58.3, 1.57.1, 1.56.3 │ Multiple HTTP/2 enabled web servers are vulnerable to a DDoS │
│                                       │                     │          │        │                     │                        │ attack (Rapid...                                             │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
└───────────────────────────────────────┴─────────────────────┴──────────┴────────┴─────────────────────┴────────────────────────┴──────────────────────────────────────────────────────────────┘

Now, if we create a CSAF VEX assessment for CVE-2023-1732 for example, and we run the command again:

$ ./trivy sbom trivy.sbom.cdx --vex trivy.vex.csaf
2023-11-08T11:27:53.281+0100	INFO	Vulnerability scanning is enabled
2023-11-08T11:27:53.283+0100	INFO	Detected SBOM format: cyclonedx-json
2023-11-08T11:27:53.289+0100	WARN	Ignore the OS package as no OS information is found.
2023-11-08T11:27:53.300+0100	INFO	Number of language-specific files: 1
2023-11-08T11:27:53.300+0100	INFO	Detecting gomod vulnerabilities...
2023-11-08T11:27:53.313+0100	INFO	Filtered out the detected vulnerability	{"VEX format": "CSAF", "vulnerability-id": "CVE-2023-1732", "status": "not_affected"}

go.mod (gomod)

Total: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0)

┌───────────────────────────────────────┬─────────────────────┬──────────┬────────┬─────────────────────┬────────────────────────┬──────────────────────────────────────────────────────────────┐
│                Library                │    Vulnerability    │ Severity │ Status │  Installed Version  │     Fixed Version      │                            Title                             │
├───────────────────────────────────────┼─────────────────────┼──────────┼────────┼─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/cyphar/filepath-securejoin │ GHSA-6xv5-86q9-7xr8 │ MEDIUM   │ fixed  │ 0.2.3               │ 0.2.4                  │ SecureJoin: on windows, paths outside of the rootfs could be │
│                                       │                     │          │        │                     │                        │ inadvertently produced...                                    │
│                                       │                     │          │        │                     │                        │ https://github.com/advisories/GHSA-6xv5-86q9-7xr8            │
├───────────────────────────────────────┼─────────────────────┤          │        ├─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/docker/docker              │ GHSA-jq35-85cj-fj4p │          │        │ 23.0.5+incompatible │ 24.0.7                 │ /sys/devices/virtual/powercap accessible by default to       │
│                                       │                     │          │        │                     │                        │ containers                                                   │
│                                       │                     │          │        │                     │                        │ https://github.com/advisories/GHSA-jq35-85cj-fj4p            │
├───────────────────────────────────────┼─────────────────────┤          │        ├─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/sigstore/rekor             │ CVE-2023-33199      │          │        │ 1.1.1               │ 1.2.0                  │ malformed proposed intoto entries can cause a panic          │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-33199                   │
├───────────────────────────────────────┼─────────────────────┼──────────┤        ├─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net                      │ CVE-2023-39325      │ HIGH     │        │ 0.9.0               │ 0.17.0                 │ rapid stream resets can cause excessive work                 │
│                                       │                     │          │        │                     │                        │ (CVE-2023-44487)                                             │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
│                                       ├─────────────────────┼──────────┤        │                     ├────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                       │ CVE-2023-3978       │ MEDIUM   │        │                     │ 0.13.0                 │ Cross site scripting                                         │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-3978                    │
│                                       ├─────────────────────┤          │        │                     ├────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                       │ CVE-2023-44487      │          │        │                     │ 0.17.0                 │ Multiple HTTP/2 enabled web servers are vulnerable to a DDoS │
│                                       │                     │          │        │                     │                        │ attack (Rapid...                                             │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
├───────────────────────────────────────┼─────────────────────┼──────────┤        ├─────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc                │ GHSA-m425-mq94-257g │ HIGH     │        │ 1.54.0              │ 1.56.3, 1.57.1, 1.58.3 │ gRPC-Go HTTP/2 Rapid Reset vulnerability                     │
│                                       │                     │          │        │                     │                        │ https://github.com/advisories/GHSA-m425-mq94-257g            │
│                                       ├─────────────────────┼──────────┤        │                     ├────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                       │ CVE-2023-44487      │ MEDIUM   │        │                     │ 1.58.3, 1.57.1, 1.56.3 │ Multiple HTTP/2 enabled web servers are vulnerable to a DDoS │
│                                       │                     │          │        │                     │                        │ attack (Rapid...                                             │
│                                       │                     │          │        │                     │                        │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
└───────────────────────────────────────┴─────────────────────┴──────────┴────────┴─────────────────────┴────────────────────────┴──────────────────────────────────────────────────────────────┘

Related issues

Close Enhancement request to support the Common Security Advisory Framework (CSAF) format. #1475

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've included a "before" and "after" example to the description (if the PR is a user interface change).

Signed-off-by: juan131 <[email protected]>

knqyf263

Thanks for your contribution!

go.mod

Signed-off-by: juan131 <[email protected]>

…istribution library Signed-off-by: juan131 <[email protected]>

Signed-off-by: juan131 <[email protected]>

knqyf263 · 2023-12-06T07:42:53Z

I have been on paid leave irregularly for various reasons most recently, but would like to review it this week. Thanks!

juan131 · 2023-12-12T10:48:16Z

Friendly reminder @knqyf263

juan131 · 2023-12-19T07:59:45Z

@DmitriyLewen @knqyf263 I'd appreciate your review

DmitriyLewen

Hello @juan131
Thank you for your work and sorry for the wait.
LGTM.
Left 1 comment.

Can you also add information about CSAF in docs?
Pay attention to 1 point:
For default scanning (I mean non-sbom mode), vuln.PkgRef is usually empty.
We need to write that CSAF only works for sbom mode.
After merge #5439 we will update docs.

DmitriyLewen · 2023-12-26T05:05:42Z

pkg/vex/csaf.go

+package vex
+
+import (
+	csaf "github.com/csaf-poc/csaf_distribution/v3/csaf"


What if use https://github.com/openvex/go-vex/blob/main/pkg/csaf/csaf.go

I'd rather use the one maintained by OASIS CSAF TC, see https://oasis-open.github.io/csaf-documentation/tools.html

Signed-off-by: juan131 <[email protected]>

juan131 · 2024-01-02T09:31:40Z

Can you also add information about CSAF in docs?

Done at b7f1e77

Signed-off-by: juan131 <[email protected]>

Signed-off-by: knqyf263 <[email protected]>

knqyf263

Thanks for your patience! LGTM!

juan131 · 2024-01-08T07:36:38Z

Awesome, thanks @knqyf263 !! Do you plan to include this enhancement in the next minor version 0.49.0?

knqyf263 · 2024-01-08T08:16:18Z

Yes. Also, I started implementing PURL matching to improve CSAF support.

mpermar · 2024-01-08T11:25:58Z

This is awesome!! 🎉🚀 @tschmidtb51 FYI!!

feat(vex): Add support for CSAF format

5c10f1f

Signed-off-by: juan131 <[email protected]>

juan131 requested a review from knqyf263 as a code owner November 8, 2023 10:28

Merge branch 'main' into feat/csaf-vex

69a633c

knqyf263 reviewed Nov 13, 2023

View reviewed changes

go.mod Outdated Show resolved Hide resolved

juan131 requested a review from knqyf263 November 14, 2023 15:42

mpermar mentioned this pull request Nov 15, 2023

Consuming CSAF model from go v1.20 projects gocsaf/csaf#508

Closed

knqyf263 mentioned this pull request Nov 27, 2023

chore: bump Go to 1.21 #5662

Merged

6 tasks

juan131 added 2 commits November 28, 2023 16:40

Merge branch 'main' into feat/csaf-vex

d6f2305

fix: use new csaf-distribution based on go 1.20

20a7bec

Signed-off-by: juan131 <[email protected]>

juan131 requested a review from tschmidtb51 November 28, 2023 15:49

juan131 added 6 commits November 28, 2023 16:51

fix: run go mod tidy

55c01c1

Signed-off-by: juan131 <[email protected]>

fix: address linter warning

fbbe5bd

Signed-off-by: juan131 <[email protected]>

fix: amend csaf_utils

d51e223

Signed-off-by: juan131 <[email protected]>

Merge branch 'main' into feat/csaf-vex

140436f

fix: use new CollectProductIdentificationHelpers function from csaf-d…

29c781a

…istribution library Signed-off-by: juan131 <[email protected]>

fix: avoid nil pointer exceptions

0ce4fe3

Signed-off-by: juan131 <[email protected]>

Merge branch 'main' into feat/csaf-vex

757565d

Merge branch 'main' into feat/csaf-vex

9d2910b

Merge branch 'main' into feat/csaf-vex

28621e4

DmitriyLewen reviewed Dec 26, 2023

View reviewed changes

juan131 added 2 commits January 2, 2024 09:56

Merge branch 'main' into feat/csaf-vex

7921249

docs: document VEX filtering with CSAF

b7f1e77

Signed-off-by: juan131 <[email protected]>

juan131 requested a review from DmitriyLewen January 3, 2024 07:23

juan131 and others added 3 commits January 3, 2024 08:36

fix: update golden images

f347f3f

Signed-off-by: juan131 <[email protected]>

Merge branch 'main' into feat/csaf-vex

bb3e297

fix: handle unknown VEX formats

cdace0b

Signed-off-by: knqyf263 <[email protected]>

knqyf263 added 3 commits January 6, 2024 14:07

refactor

4f6627a

Signed-off-by: knqyf263 <[email protected]>

chore(deps): bump csaf to v3.0.0

fba8991

Signed-off-by: knqyf263 <[email protected]>

Merge branch 'main' into feat/csaf-vex

7c316be

Signed-off-by: knqyf263 <[email protected]>

knqyf263 approved these changes Jan 6, 2024

View reviewed changes

knqyf263 added this pull request to the merge queue Jan 6, 2024

Merged via the queue into aquasecurity:main with commit c47ed0d Jan 6, 2024
17 checks passed

juan131 deleted the feat/csaf-vex branch January 8, 2024 07:26

knqyf263 mentioned this pull request Jan 8, 2024

feat(vex): add PURL matching for CSAF VEX #5890

Merged

6 tasks

juan131 mentioned this pull request Jan 11, 2024

fix(vex): CSAF filtering should consider relationships #5923

Merged

6 tasks

juan131 mentioned this pull request May 7, 2024

Add support for CSAF_* material types chainloop-dev/chainloop#635

Closed

aqua-bot mentioned this pull request May 29, 2024

release: v0.52.0 [main] #6809

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(vex): Add support for CSAF format #5535

feat(vex): Add support for CSAF format #5535

juan131 commented Nov 8, 2023

knqyf263 left a comment

knqyf263 commented Dec 6, 2023

juan131 commented Dec 12, 2023

juan131 commented Dec 19, 2023

DmitriyLewen left a comment

DmitriyLewen Dec 26, 2023

juan131 Jan 2, 2024

juan131 commented Jan 2, 2024

knqyf263 left a comment •

edited

Loading

juan131 commented Jan 8, 2024

knqyf263 commented Jan 8, 2024

mpermar commented Jan 8, 2024

feat(vex): Add support for CSAF format #5535

feat(vex): Add support for CSAF format #5535

Conversation

juan131 commented Nov 8, 2023

Description

Related issues

Checklist

knqyf263 left a comment

Choose a reason for hiding this comment

knqyf263 commented Dec 6, 2023

juan131 commented Dec 12, 2023

juan131 commented Dec 19, 2023

DmitriyLewen left a comment

Choose a reason for hiding this comment

DmitriyLewen Dec 26, 2023

Choose a reason for hiding this comment

juan131 Jan 2, 2024

Choose a reason for hiding this comment

juan131 commented Jan 2, 2024

knqyf263 left a comment • edited Loading

Choose a reason for hiding this comment

juan131 commented Jan 8, 2024

knqyf263 commented Jan 8, 2024

mpermar commented Jan 8, 2024

knqyf263 left a comment •

edited

Loading