From 895194d63be1113eb8e5ee0b3252b23f5c1846e0 Mon Sep 17 00:00:00 2001 From: Lucas Manuel Rodriguez Date: Wed, 16 Apr 2025 11:50:10 -0300 Subject: [PATCH] Add scanning to released images and process to track vulnerabilities (#28087) For #25902. --------- Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com> --- ...ild-and-check-fleetctl-docker-and-deps.yml | 71 ++++++---- ...nerabilities-in-released-docker-images.yml | 122 ++++++++++++++++++ .../workflows/goreleaser-snapshot-fleet.yaml | 71 +++++++++- .github/workflows/trivy-scan.yml | 2 +- Makefile | 10 +- SECURITY.md | 3 + go.mod | 2 +- go.sum | 2 + security/README.md | 80 ++++++++++++ .trivyignore => security/code/.trivyignore | 0 security/status.md | 120 +++++++++++++++++ security/vex/fleet/CVE-2023-32698.vex.json | 26 ++++ security/vex/fleet/CVE-2024-12797.vex.json | 29 +++++ security/vex/fleet/CVE-2025-21613.vex.json | 26 ++++ security/vex/fleet/CVE-2025-21614.vex.json | 26 ++++ security/vex/fleet/CVE-2025-26519.vex.json | 26 ++++ security/vex/fleet/CVE-2025-30204.vex.json | 26 ++++ security/vex/fleetctl/CVE-2012-0881.vex.json | 26 ++++ security/vex/fleetctl/CVE-2013-4002.vex.json | 26 ++++ security/vex/fleetctl/CVE-2019-10202.vex.json | 26 ++++ security/vex/fleetctl/CVE-2023-32698.vex.json | 26 ++++ security/vex/fleetctl/CVE-2023-45853.vex.json | 26 ++++ security/vex/fleetctl/CVE-2023-6879.vex.json | 26 ++++ security/vex/fleetctl/CVE-2024-7254.vex.json | 26 ++++ security/vex/fleetctl/CVE-2025-31115.vex.json | 26 ++++ tools/github-releases/github-releases.go | 58 +++++++++ tools/vex-parser/vex-parser.go | 102 +++++++++++++++ 27 files changed, 980 insertions(+), 30 deletions(-) create mode 100644 .github/workflows/check-vulnerabilities-in-released-docker-images.yml create mode 100644 security/README.md rename .trivyignore => security/code/.trivyignore (100%) create mode 100644 security/status.md create mode 100644 security/vex/fleet/CVE-2023-32698.vex.json create mode 100644 security/vex/fleet/CVE-2024-12797.vex.json create mode 100644 security/vex/fleet/CVE-2025-21613.vex.json create mode 100644 security/vex/fleet/CVE-2025-21614.vex.json create mode 100644 security/vex/fleet/CVE-2025-26519.vex.json create mode 100644 security/vex/fleet/CVE-2025-30204.vex.json create mode 100644 security/vex/fleetctl/CVE-2012-0881.vex.json create mode 100644 security/vex/fleetctl/CVE-2013-4002.vex.json create mode 100644 security/vex/fleetctl/CVE-2019-10202.vex.json create mode 100644 security/vex/fleetctl/CVE-2023-32698.vex.json create mode 100644 security/vex/fleetctl/CVE-2023-45853.vex.json create mode 100644 security/vex/fleetctl/CVE-2023-6879.vex.json create mode 100644 security/vex/fleetctl/CVE-2024-7254.vex.json create mode 100644 security/vex/fleetctl/CVE-2025-31115.vex.json create mode 100644 tools/github-releases/github-releases.go create mode 100644 tools/vex-parser/vex-parser.go diff --git a/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml b/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml index 359b9390ce..548326a729 100644 --- a/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml +++ b/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml @@ -15,10 +15,6 @@ defaults: # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference shell: bash -env: - AWS_REGION: us-east-2 - AWS_IAM_ROLE: arn:aws:iam::160035666661:role/github-actions-role - permissions: contents: read @@ -37,17 +33,6 @@ jobs: - name: Checkout uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 - with: - role-to-assume: ${{env.AWS_IAM_ROLE}} - aws-region: ${{ env.AWS_REGION }} - - - name: Login to Docker Hub - uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }} - - name: Set up Go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: @@ -62,6 +47,32 @@ jobs: - name: Build fleetdm/fleetctl run: make fleetctl-docker + - name: List VEX files + id: generate_vex_files + run: | + echo "VEX_FILES=$(ls -1 ./security/vex/fleetctl/ | while IFS= read -r line; do echo "./security/vex/fleetctl/$line"; done | tr '\n' ',' | sed 's/.$//')" >> $GITHUB_OUTPUT + + # We use the trivy command and not the github action because it doesn't support loading VEX files yet. + - name: Run Trivy vulnerability scanner on fleetdm/fleetctl + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db + run: | + mkdir trivy-download + cd trivy-download + curl -L https://github.com/aquasecurity/trivy/releases/download/v0.61.0/trivy_0.61.0_Linux-64bit.tar.gz --output trivy_0.61.0_Linux-64bit.tar.gz + tar -xf trivy_0.61.0_Linux-64bit.tar.gz + mv trivy .. + cd .. + chmod +x ./trivy + ./trivy image \ + --exit-code=1 \ + --ignore-unfixed \ + --pkg-types=os,library \ + --severity=HIGH,CRITICAL \ + --vex="${{ steps.generate_vex_files.outputs.VEX_FILES }}" \ + fleetdm/fleetctl + - name: Run Trivy vulnerability scanner on fleetdm/wix uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 env: @@ -88,15 +99,23 @@ jobs: vuln-type: "os,library" severity: "CRITICAL" - - name: Run Trivy vulnerability scanner on fleetdm/fleetctl - uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 - env: - TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db - TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db + - name: Slack root notification + if: github.event.schedule == '0 6 * * *' && failure() + uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0 with: - image-ref: "fleetdm/fleetctl" - format: "table" - exit-code: "1" - ignore-unfixed: true - vuln-type: "os,library" - severity: "CRITICAL" + payload: | + { + "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}", + "blocks": [ + { + "type": "section", + "text": { + "type": "mrkdwn", + "text": "⚠️ Build fleetctl docker dependencies and check vulnerabilities failed.\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}" + } + } + ] + } + env: + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }} + SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK diff --git a/.github/workflows/check-vulnerabilities-in-released-docker-images.yml b/.github/workflows/check-vulnerabilities-in-released-docker-images.yml new file mode 100644 index 0000000000..ec5f620455 --- /dev/null +++ b/.github/workflows/check-vulnerabilities-in-released-docker-images.yml @@ -0,0 +1,122 @@ +name: Check critical vulnerabilities in released docker images + +on: + workflow_dispatch: + pull_request: + schedule: + - cron: "0 6 * * *" + +# This allows a subsequently queued workflow run to interrupt previous runs +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}} + cancel-in-progress: true + +defaults: + run: + # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference + shell: bash + +permissions: + contents: read + +jobs: + build-and-check: + runs-on: ubuntu-22.04 + environment: Docker Hub + steps: + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + + - name: Checkout + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + + - name: Set up Go + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 + with: + go-version-file: "go.mod" + + - name: Get last 5 minor releases + id: get_latest_releases + run: | + echo "FLEET_LATEST_RELEASES=$(go run ./tools/github-releases --last-minor-releases 5)" >> $GITHUB_OUTPUT + + - name: Pull docker images + run: | + RELEASES="${{ steps.get_latest_releases.outputs.FLEET_LATEST_RELEASES }}" + for version in $RELEASES; do + docker pull fleetdm/fleet:$version + done + + - name: List fleet VEX files + id: generate_fleet_vex_files + run: | + VEX_FILES=$(ls -1 ./security/vex/fleet/ | while IFS= read -r line; do echo "./security/vex/fleet/$line"; done | tr '\n' ',' | sed 's/.$//') + echo $VEX_FILES + echo "FLEET_VEX_FILES=$VEX_FILES" >> $GITHUB_OUTPUT + + # We use the trivy command and not the github action because it doesn't support loading + # VEX files yet and looks like we can't run the action on multiple images. + - name: Run trivy vulnerability scanner on fleetdm/fleet images + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db + run: | + mkdir trivy-download + cd trivy-download + curl -L https://github.com/aquasecurity/trivy/releases/download/v0.61.0/trivy_0.61.0_Linux-64bit.tar.gz --output trivy_0.61.0_Linux-64bit.tar.gz + tar -xf trivy_0.61.0_Linux-64bit.tar.gz + mv trivy .. + cd .. + chmod +x ./trivy + RELEASES="${{ steps.get_latest_releases.outputs.FLEET_LATEST_RELEASES }}" + for version in $RELEASES; do + ./trivy image \ + --exit-code=1 \ + --pkg-types=os,library \ + --severity=CRITICAL \ + --vex="${{ steps.generate_fleet_vex_files.outputs.FLEET_VEX_FILES }}" \ + fleetdm/fleet:$version + done + + - name: List fleetctl VEX files + id: generate_fleetctl_vex_files + run: | + VEX_FILES=$(ls -1 ./security/vex/fleetctl/ | while IFS= read -r line; do echo "./security/vex/fleetctl/$line"; done | tr '\n' ',' | sed 's/.$//') + echo $VEX_FILES + echo "FLEETCTL_VEX_FILES=$VEX_FILES" >> $GITHUB_OUTPUT + + # We use the trivy command and not the github action because it doesn't support loading VEX files yet. + - name: Run trivy vulnerability scanner on latest released fleetdm/fleetctl image + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db + run: | + ./trivy image \ + --exit-code=1 \ + --pkg-types=os,library \ + --severity=CRITICAL \ + --vex="${{ steps.generate_fleetctl_vex_files.outputs.FLEETCTL_VEX_FILES }}" \ + fleetdm/fleetctl:latest + + - name: Slack notification + if: github.event.schedule == '0 6 * * *' && failure() + uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0 + with: + payload: | + { + "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}", + "blocks": [ + { + "type": "section", + "text": { + "type": "mrkdwn", + "text": "⚠️ Check vulnerabilities in released docker images failed.\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}" + } + } + ] + } + env: + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }} + SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK \ No newline at end of file diff --git a/.github/workflows/goreleaser-snapshot-fleet.yaml b/.github/workflows/goreleaser-snapshot-fleet.yaml index 84d6299f00..d988f5d4fc 100644 --- a/.github/workflows/goreleaser-snapshot-fleet.yaml +++ b/.github/workflows/goreleaser-snapshot-fleet.yaml @@ -16,6 +16,8 @@ on: - "website/**" - "mdm-profiles/**" workflow_dispatch: # Manual + schedule: + - cron: '0 4 * * *' # Every day at 4 AM # This allows a subsequently queued workflow run to interrupt previous runs concurrency: @@ -80,11 +82,57 @@ jobs: - name: Tag image with branch name run: docker tag fleetdm/fleet:$(git rev-parse --short HEAD) fleetdm/fleet:$(git rev-parse --abbrev-ref HEAD) + - name: Generate tag + id: generate_tag + run: | + echo "FLEET_IMAGE_TAG=$(git rev-parse --abbrev-ref HEAD)" >> $GITHUB_OUTPUT + + - name: List VEX files + id: generate_vex_files + run: | + echo "VEX_FILES=$(ls -1 ./security/vex/fleet/ | while IFS= read -r line; do echo "./security/vex/fleet/$line"; done | tr '\n' ',' | sed 's/.$//')" >> $GITHUB_OUTPUT + + # We use the trivy command and not the github action because it doesn't support loading VEX files yet. + - name: Check high/critical vulnerabilities before publishing (trivy) + # Only run this on the schedule run or when tagging RCs. + if: startsWith(github.ref, 'rc-minor-') || startsWith(github.ref, 'rc-patch-') || github.event.schedule == '0 4 * * *' + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db + run: | + mkdir trivy-download + cd trivy-download + curl -L https://github.com/aquasecurity/trivy/releases/download/v0.61.0/trivy_0.61.0_Linux-64bit.tar.gz --output trivy_0.61.0_Linux-64bit.tar.gz + tar -xf trivy_0.61.0_Linux-64bit.tar.gz + mv trivy .. + cd .. + chmod +x ./trivy + ./trivy image \ + --ignore-unfixed \ + --exit-code=1 \ + --pkg-types=os,library \ + --severity=HIGH,CRITICAL \ + --vex="${{ steps.generate_vex_files.outputs.VEX_FILES }}" \ + fleetdm/fleet:${{ steps.generate_tag.outputs.FLEET_IMAGE_TAG }} + + - name: Check high/critical vulnerabilities before publishing (docker scout) + # Only run this on the schedule run or when tagging RCs. + if: startsWith(github.ref, 'rc-minor-') || startsWith(github.ref, 'rc-patch-') || github.event.schedule == '0 4 * * *' + uses: docker/scout-action@v1 + with: + command: cves + image: fleetdm/fleet:${{ steps.generate_tag.outputs.FLEET_IMAGE_TAG }} + only-severities: critical,high + only-fixed: true + only-vex-affected: true + write-comment: false + vex-location: ./security/vex/fleet + # Explicitly push the docker images as GoReleaser will not do so in snapshot mode - name: Publish Docker images run: docker push fleetdm/fleet --all-tags - - name: Get tag + - name: Get tags run: | echo "TAG=$(git rev-parse --abbrev-ref HEAD) $(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT id: docker @@ -106,3 +154,24 @@ jobs: docker tag fleetdm/fleet:${TAG} quay.io/fleetdm/fleet:${TAG} docker push quay.io/fleetdm/fleet:${TAG} done + + - name: Slack notification + if: github.event.schedule == '0 4 * * *' && failure() + uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0 + with: + payload: | + { + "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}", + "blocks": [ + { + "type": "section", + "text": { + "type": "mrkdwn", + "text": "⚠️ Docker publish failed.\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}" + } + } + ] + } + env: + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }} + SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK \ No newline at end of file diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index b6be91c735..7825c55d76 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -63,7 +63,7 @@ jobs: format: "sarif" output: "trivy-results.sarif" severity: "CRITICAL,HIGH,MEDIUM,LOW" - trivyignores: ".trivyignore" + trivyignores: "./security/code/.trivyignore" - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 diff --git a/Makefile b/Makefile index bdf1e3e35b..b0de9d84d5 100644 --- a/Makefile +++ b/Makefile @@ -409,7 +409,8 @@ generate-mock: mock doc: .prefix go generate github.com/fleetdm/fleet/v4/server/fleet go generate github.com/fleetdm/fleet/v4/server/service/osquery_utils -generate-doc: doc + +generate-doc: doc vex-report .help-short--deps: @echo "Install dependent programs and libraries" @@ -827,4 +828,11 @@ db-replica-reset: fleet db-replica-run: fleet FLEET_MYSQL_ADDRESS=127.0.0.1:3308 FLEET_MYSQL_READ_REPLICA_ADDRESS=127.0.0.1:3309 FLEET_MYSQL_READ_REPLICA_USERNAME=fleet FLEET_MYSQL_READ_REPLICA_DATABASE=fleet FLEET_MYSQL_READ_REPLICA_PASSWORD=insecure ./build/fleet serve --dev --dev_license +vex-report: + sh -c 'echo "\n# Vulnerability Report\n\nFollowing is the vulnerability report of Fleet components.\n" > security/status.md' + sh -c 'echo "## \`fleetdm/fleet\` docker image\n" >> security/status.md' + sh -c 'go run ./tools/vex-parser ./security/vex/fleet >> security/status.md' + sh -c 'echo "## \`fleetdm/fleetctl\` docker image\n" >> security/status.md' + sh -c 'go run ./tools/vex-parser ./security/vex/fleetctl >> security/status.md' + include ./tools/makefile-support/helpsystem-targets diff --git a/SECURITY.md b/SECURITY.md index ede5520e1a..b4186a6683 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -13,4 +13,7 @@ To encrypt vulnerability reports before sending them, please use this [PGP key]( The fingerprint of the key is `23A1 9D1F 16D7 1846 57D1  6D67 320D B57D E4F0 EE8F`. ### Vulnerability tracking + GitHub issues concerning vulnerabilities will be tagged with the **security** label to differentiate them from other issues and maintain SOC2 compliance. + +See [security/README.md](./security/README.md) for more information on our process to keep Fleet products secure. \ No newline at end of file diff --git a/go.mod b/go.mod index 0b5eb2b39b..645f3a67e9 100644 --- a/go.mod +++ b/go.mod @@ -134,7 +134,7 @@ require ( golang.org/x/image v0.18.0 golang.org/x/mod v0.19.0 golang.org/x/net v0.36.0 - golang.org/x/oauth2 v0.22.0 + golang.org/x/oauth2 v0.27.0 golang.org/x/sync v0.11.0 golang.org/x/sys v0.30.0 golang.org/x/term v0.29.0 diff --git a/go.sum b/go.sum index 0973ea907f..a8ee6d6541 100644 --- a/go.sum +++ b/go.sum @@ -1044,6 +1044,8 @@ golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4Iltr golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA= golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= +golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M= +golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= diff --git a/security/README.md b/security/README.md new file mode 100644 index 0000000000..9de60517d5 --- /dev/null +++ b/security/README.md @@ -0,0 +1,80 @@ +# Security + +## Directory contents + +- [status.md](status.md): Current status of vulnerabilities reported on Fleet software components by security scanners (trivy). This document is currently auto-generated from files in the `vex/` directory. +- `code/`: Files used for vulnerability scanning on Fleet's source code. +- `vex/`: OpenVEX files to report status of vulnerabilities detected by Trivy on Fleet docker images. + +## Vulnerability scanning + +The following Github CI actions perform daily vulnerability scanning on Fleet software components. + +- [trivy-scan.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/trivy-scan.yml): Scan source code for vulnerabilities. +- [build-and-check-fleetctl-docker-and-deps.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml): Scans for `HIGH` and `CRITICAL` vulnerabilities in `fleetctl` docker image dependencies (`fleetdm/fleetctl`, `fleetdm/wix`, and `fleetdm/bomutils`). +- [goreleaser-snapshot-fleet.yaml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/goreleaser-snapshot-fleet.yaml): Scans for HIGH and CRITICAL vulnerabilities in `fleetdm/fleet` docker image before pushing to the Docker registry (runs daily and is triggered for every change in Fleet's source code). +- [check-vulnerabilities-in-released-docker-images.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/check-vulnerabilities-in-released-docker-images.yml): Scans for `CRITICAL` vulnerabilities in the last 5 minor released versions of the `fleetdm/fleet` and on the latest release of `fleetdm/fleetctl`. + +## Process to run when a CVE is reported + +### 1. Update report (status.md) + +If trivy reports a HIGH or CRITICAL CVE on one of Fleet's docker images (reported by the previously mentioned Github Actions), then we need to assess the report and track it with a status of "not affected", "affected", "fixed", or "under investigation". + +We use the OpenVEX format to track the status of reported vulnerabilities (`vex/` folder). + +Once the status is determined, we use the [vexctl](https://github.com/openvex/vexctl) tool to create a VEX file. +```sh +brew install vexctl +``` + +Example for `CVE-2023-32698` on package `github.com/goreleaser/nfpm/v2` which we know doesn't affect `fleetdm/fleetctl`: +```sh +vexctl create --product="fleetctl,pkg:golang/github.com/goreleaser/nfpm/v2" \ + --vuln="CVE-2023-32698" \ + --status="not_affected" \ + --author="@getvictor" \ + --justification="vulnerable_code_cannot_be_controlled_by_adversary" \ + --status-note="When packaging linux files, fleetctl does not use global permissions. It was verified that packed fleetd package files do not have group/global write permissions." > security/vex/fleetctl/CVE-2023-32698.vex.json +``` + +Similarly, for `CVE-2024-8260` on package `github.com/open-policy-agent/opa` which we know doesn't affect `fleetdm/fleet`: +```sh +vexctl create --product="fleet,pkg:golang/github.com/open-policy-agent/opa" \ + --vuln="CVE-2024-8260" \ + --status="not_affected" \ + --author="@luacsmrod" \ + --justification="vulnerable_code_cannot_be_controlled_by_adversary" \ + --status-note="Fleet doesn't run on Windows, so it's not affected by this vulnerability." > security/vex/fleetctl/CVE-2024-8260.vex.json +``` + +Examples of `--product` flag values (which accept "PURLs"): +- `liblzma5` debian package: `pkg:deb/debian/liblzma5`. +- `github.com/goreleaser/nfpm/v2` golang package: `pkg:golang/github.com/goreleaser/nfpm/v2`. +- `xerces/xercesImpl` java package: `pkg:maven/xerces/xercesImpl`. + +When new VEX files are generated or updated we can update the `security/status.md` file by running: +```sh +make vex-report +``` + +### 2. Update software + +If the detected vulnerability can be fixed by updating the base docker image or removing/changing components in the docker image then we do so and the update will be present on the next release. (It is good practice to keep software up-to-date.) + +### 3. Process for "affected" CRITICAL vulnerabilities + +#### fleetdm/fleet + +Following is the process to run when a `CRITICAL` CVE affects any of the five last releases of `fleetdm/fleet` docker image (reported by [check-vulnerabilities-in-released-docker-images.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/check-vulnerabilities-in-released-docker-images.yml)). + +1. We will use the information reported by the scanner and update our `status.md` to keep users/customers informed. +2. If the `CRITICAL` vulnerability (that has a fix) is on the `latest` release, we'll file a critical/P0 bug and release a patch ASAP (within 1 business day). The previous four versions scanned won't be retroactively patched, only `latest` will be patched. + +#### fleetdm/fleetctl + +Following is the process to run when a `CRITICAL` CVE affects the released `fleetdm/fleetctl:latest` docker image: + +1. After `security/status.md` is updated, notify users/customers about the CVE in the `fleetdm/fleetctl` image and possible remediations. +2. Create a Github issue with a `P0`/`security` label to track the fix. +3. The fix will be released on the next release of the `fleetdm/fleetctl` docker image. \ No newline at end of file diff --git a/.trivyignore b/security/code/.trivyignore similarity index 100% rename from .trivyignore rename to security/code/.trivyignore diff --git a/security/status.md b/security/status.md new file mode 100644 index 0000000000..9289451769 --- /dev/null +++ b/security/status.md @@ -0,0 +1,120 @@ + +# Vulnerability Report + +Following is the vulnerability report of Fleet components. + +## `fleetdm/fleet` docker image + +### CVE-2023-32698 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** The fleetctl executable is unused in the fleetdm/fleet docker image. The executable was removed in v4.64.0. +- **Products:** + - `fleet` + - `pkg:golang/github.com/goreleaser/nfpm/v2` +- **Justification:** `vulnerable_code_not_in_execute_path` +- **Timestamp:** 2025-04-10T15:28:30.406734-03:00 + +### CVE-2024-12797 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleet uses Go TLS implementation +- **Products:** + - `fleet` + - `pkg:apk/alpine/libcrypto3` + - `pkg:apk/alpine/libssl3` +- **Justification:** `vulnerable_code_not_in_execute_path` +- **Timestamp:** 2025-04-10T15:15:53.847365-03:00 + +### CVE-2025-21613 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** The fleetctl executable is unused in the fleetdm/fleet docker image. The executable was removed in v4.64.0. +- **Products:** + - `fleet` + - `pkg:golang/github.com/go-git/go-git/v5` +- **Justification:** `vulnerable_code_not_in_execute_path` +- **Timestamp:** 2025-04-10T15:42:55.967763-03:00 + +### CVE-2025-21614 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** The fleetctl executable is unused in the fleetdm/fleet docker image. The executable was removed in v4.64.0. +- **Products:** + - `fleet` + - `pkg:golang/github.com/go-git/go-git/v5` +- **Justification:** `vulnerable_code_not_in_execute_path` +- **Timestamp:** 2025-04-10T15:43:15.232143-03:00 + +### CVE-2025-26519 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleet does not perform any EUC-KR to UTF-8 translation by libc +- **Products:** + - `fleet` + - `pkg:apk/alpine/musl@1.2.5-r8?os_name=alpine&os_version=3.21` +- **Justification:** `vulnerable_code_not_in_execute_path` +- **Timestamp:** 2025-04-14T16:30:01.904498-03:00 + +### CVE-2025-30204 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** The token format being validated before the call to ParseUnverified +- **Products:** + - `fleet` + - `pkg:golang/github.com/golang-jwt/jwt/v4` +- **Justification:** `inline_mitigations_already_exist` +- **Timestamp:** 2025-04-10T15:23:54.60648-03:00 + +## `fleetdm/fleetctl` docker image + +### CVE-2012-0881 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleetctl does not use Java +- **Products:** + - `fleetctl` + - `pkg:maven/xerces/xercesImpl` +- **Justification:** `vulnerable_code_not_in_execute_path` +- **Timestamp:** 2025-04-10T14:46:52.709835-03:00 + +### CVE-2013-4002 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleetctl does not use Java +- **Products:** + - `fleetctl` + - `pkg:maven/xerces/xercesImpl` +- **Justification:** `vulnerable_code_not_in_execute_path` +- **Timestamp:** 2025-04-10T07:36:31.1157-03:00 + +### CVE-2023-32698 +- **Author:** @getvictor +- **Status:** `not_affected` +- **Status notes:** When packaging linux files, fleetctl does not use global permissions. It was verified that packed fleetd package files do not have group/global write permissions. +- **Products:** + - `fleetctl` + - `pkg:golang/github.com/goreleaser/nfpm/v2` +- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary` +- **Timestamp:** 2025-04-09T10:26:02.350338-03:00 + +### CVE-2024-7254 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleetctl does not use Java +- **Products:** + - `fleetctl` + - `pkg:maven/com.google.protobuf/protobuf-java` +- **Justification:** `vulnerable_code_not_in_execute_path` +- **Timestamp:** 2025-04-10T07:34:26.535559-03:00 + +### CVE-2025-31115 +- **Author:** @lucasmrod +- **Status:** `not_affected` +- **Status notes:** fleetctl does not use liblzma5 +- **Products:** + - `fleetctl` + - `pkg:deb/debian/liblzma5` +- **Justification:** `vulnerable_code_not_in_execute_path` +- **Timestamp:** 2025-04-09T13:24:20.950928-03:00 + diff --git a/security/vex/fleet/CVE-2023-32698.vex.json b/security/vex/fleet/CVE-2023-32698.vex.json new file mode 100644 index 0000000000..fb639aff2c --- /dev/null +++ b/security/vex/fleet/CVE-2023-32698.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-5ee3fede62f0769d4669c8760aa6ea30f61f85c87dc49d9518062cad868ee559", + "author": "@lucasmrod", + "timestamp": "2025-04-10T15:28:30.406729-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2023-32698" + }, + "timestamp": "2025-04-10T15:28:30.406734-03:00", + "products": [ + { + "@id": "fleet" + }, + { + "@id": "pkg:golang/github.com/goreleaser/nfpm/v2" + } + ], + "status": "not_affected", + "status_notes": "The fleetctl executable is unused in the fleetdm/fleet docker image. The executable was removed in v4.64.0.", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleet/CVE-2024-12797.vex.json b/security/vex/fleet/CVE-2024-12797.vex.json new file mode 100644 index 0000000000..5cf91999c4 --- /dev/null +++ b/security/vex/fleet/CVE-2024-12797.vex.json @@ -0,0 +1,29 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-fdaba329936f0fd22015a46e3ec50795935a124977a1b1f1b5f16b76793bcdad", + "author": "@lucasmrod", + "timestamp": "2025-04-10T15:15:53.847361-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2024-12797" + }, + "timestamp": "2025-04-10T15:15:53.847365-03:00", + "products": [ + { + "@id": "fleet" + }, + { + "@id": "pkg:apk/alpine/libcrypto3" + }, + { + "@id": "pkg:apk/alpine/libssl3" + } + ], + "status": "not_affected", + "status_notes": "fleet uses Go TLS implementation", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleet/CVE-2025-21613.vex.json b/security/vex/fleet/CVE-2025-21613.vex.json new file mode 100644 index 0000000000..1d5946f024 --- /dev/null +++ b/security/vex/fleet/CVE-2025-21613.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-42f66c75dd4500dd15cabd90d6ecf60539c98b2965f974af9f6ab4d06ee5d244", + "author": "@lucasmrod", + "timestamp": "2025-04-10T15:42:55.96775-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-21613" + }, + "timestamp": "2025-04-10T15:42:55.967763-03:00", + "products": [ + { + "@id": "fleet" + }, + { + "@id": "pkg:golang/github.com/go-git/go-git/v5" + } + ], + "status": "not_affected", + "status_notes": "The fleetctl executable is unused in the fleetdm/fleet docker image. The executable was removed in v4.64.0.", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleet/CVE-2025-21614.vex.json b/security/vex/fleet/CVE-2025-21614.vex.json new file mode 100644 index 0000000000..bf50b1676d --- /dev/null +++ b/security/vex/fleet/CVE-2025-21614.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-5b022ff6db71befabda751db57d8a680dcee0c653e2cba9fc7562275ca9bd283", + "author": "@lucasmrod", + "timestamp": "2025-04-10T15:43:15.232137-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-21614" + }, + "timestamp": "2025-04-10T15:43:15.232143-03:00", + "products": [ + { + "@id": "fleet" + }, + { + "@id": "pkg:golang/github.com/go-git/go-git/v5" + } + ], + "status": "not_affected", + "status_notes": "The fleetctl executable is unused in the fleetdm/fleet docker image. The executable was removed in v4.64.0.", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleet/CVE-2025-26519.vex.json b/security/vex/fleet/CVE-2025-26519.vex.json new file mode 100644 index 0000000000..5d992f6129 --- /dev/null +++ b/security/vex/fleet/CVE-2025-26519.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-cef4f9875ecaa9e8f27f8ba99337c635c31b801f0d071eaf60de2cc5e05ef780", + "author": "@lucasmrod", + "timestamp": "2025-04-14T16:30:01.904493-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-26519" + }, + "timestamp": "2025-04-14T16:30:01.904498-03:00", + "products": [ + { + "@id": "fleet" + }, + { + "@id": "pkg:apk/alpine/musl@1.2.5-r8?os_name=alpine&os_version=3.21" + } + ], + "status": "not_affected", + "status_notes": "fleet does not perform any EUC-KR to UTF-8 translation by libc", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleet/CVE-2025-30204.vex.json b/security/vex/fleet/CVE-2025-30204.vex.json new file mode 100644 index 0000000000..b7c3cb917e --- /dev/null +++ b/security/vex/fleet/CVE-2025-30204.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-a183e8cd49f44ec1818dcbaadcea8a43d42f8e3b6c599a613b107752e8bf35f5", + "author": "@lucasmrod", + "timestamp": "2025-04-10T15:23:54.606468-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-30204" + }, + "timestamp": "2025-04-10T15:23:54.60648-03:00", + "products": [ + { + "@id": "fleet" + }, + { + "@id": "pkg:golang/github.com/golang-jwt/jwt/v4" + } + ], + "status": "not_affected", + "status_notes": "The token format being validated before the call to ParseUnverified", + "justification": "inline_mitigations_already_exist" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2012-0881.vex.json b/security/vex/fleetctl/CVE-2012-0881.vex.json new file mode 100644 index 0000000000..2100944987 --- /dev/null +++ b/security/vex/fleetctl/CVE-2012-0881.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-45767dc61272aac34a6e7995372d80b8e9cdfb956d3e2d92c068e94f56d4c741", + "author": "@lucasmrod", + "timestamp": "2025-04-10T14:46:52.70983-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2012-0881" + }, + "timestamp": "2025-04-10T14:46:52.709835-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:maven/xerces/xercesImpl" + } + ], + "status": "not_affected", + "status_notes": "fleetctl does not use Java", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2013-4002.vex.json b/security/vex/fleetctl/CVE-2013-4002.vex.json new file mode 100644 index 0000000000..ce184147ba --- /dev/null +++ b/security/vex/fleetctl/CVE-2013-4002.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-eac272349912fc8e15ba454df1f7ad8fe080b1326e1fab24b1b2a0ff1a7f8a33", + "author": "@lucasmrod", + "timestamp": "2025-04-10T07:36:31.115694-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2013-4002" + }, + "timestamp": "2025-04-10T07:36:31.1157-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:maven/xerces/xercesImpl" + } + ], + "status": "not_affected", + "status_notes": "fleetctl does not use Java", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2019-10202.vex.json b/security/vex/fleetctl/CVE-2019-10202.vex.json new file mode 100644 index 0000000000..60690a5a4d --- /dev/null +++ b/security/vex/fleetctl/CVE-2019-10202.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-469d711e005a8d3393e8a278cd6989fdf46a6b883f5e9387bebe5d7e5d277d61", + "author": "@lucasmrod", + "timestamp": "2025-04-15T10:31:31.924948-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2019-10202" + }, + "timestamp": "2025-04-15T10:31:31.924953-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:maven/org.codehaus.jackson/jackson-mapper-asl" + } + ], + "status": "not_affected", + "status_notes": "fleetctl does not use Java", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2023-32698.vex.json b/security/vex/fleetctl/CVE-2023-32698.vex.json new file mode 100644 index 0000000000..0a91a9a9b3 --- /dev/null +++ b/security/vex/fleetctl/CVE-2023-32698.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-4ae6be0524ed5bb8eb3a53965dfe5622e11934c5fd45fbc45d4d647fdefed395", + "author": "@getvictor", + "timestamp": "2025-04-09T10:26:02.350331-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2023-32698" + }, + "timestamp": "2025-04-09T10:26:02.350338-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:golang/github.com/goreleaser/nfpm/v2" + } + ], + "status": "not_affected", + "status_notes": "When packaging linux files, fleetctl does not use global permissions. It was verified that packed fleetd package files do not have group/global write permissions.", + "justification": "vulnerable_code_cannot_be_controlled_by_adversary" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2023-45853.vex.json b/security/vex/fleetctl/CVE-2023-45853.vex.json new file mode 100644 index 0000000000..436c27459a --- /dev/null +++ b/security/vex/fleetctl/CVE-2023-45853.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-5b2b06d8e0527002fb6c8d507d7f34bf29922b47e546a1b6050faeba7e9d7630", + "author": "@lucasmrod", + "timestamp": "2025-04-15T10:17:19.625095-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2023-45853" + }, + "timestamp": "2025-04-15T10:17:19.625099-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:deb/debian/zlib1g" + } + ], + "status": "not_affected", + "status_notes": "fleetctl does not use zlib C library", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2023-6879.vex.json b/security/vex/fleetctl/CVE-2023-6879.vex.json new file mode 100644 index 0000000000..2ccb170716 --- /dev/null +++ b/security/vex/fleetctl/CVE-2023-6879.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-cd47567372016fff85e01a8b70ef5f3c31c8df9c1634c4143633137c44809d1f", + "author": "@lucasmrod", + "timestamp": "2025-04-15T10:28:21.796432-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2023-6879" + }, + "timestamp": "2025-04-15T10:28:21.796437-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:deb/debian/libaom3" + } + ], + "status": "not_affected", + "status_notes": "fleetctl does not use libaom3", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2024-7254.vex.json b/security/vex/fleetctl/CVE-2024-7254.vex.json new file mode 100644 index 0000000000..8402d434cb --- /dev/null +++ b/security/vex/fleetctl/CVE-2024-7254.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-4cff85f80b944b78a8b5100dd0320e0cd86452461a330bfeb6cc1708cba5aadb", + "author": "@lucasmrod", + "timestamp": "2025-04-10T07:34:26.535554-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2024-7254" + }, + "timestamp": "2025-04-10T07:34:26.535559-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:maven/com.google.protobuf/protobuf-java" + } + ], + "status": "not_affected", + "status_notes": "fleetctl does not use Java", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/security/vex/fleetctl/CVE-2025-31115.vex.json b/security/vex/fleetctl/CVE-2025-31115.vex.json new file mode 100644 index 0000000000..3c2cf8e5f9 --- /dev/null +++ b/security/vex/fleetctl/CVE-2025-31115.vex.json @@ -0,0 +1,26 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-b00fa9494ed92db550cc2d471d8a6323c77edea4ca5e6ecdfc9222fc4a92c30a", + "author": "@lucasmrod", + "timestamp": "2025-04-09T13:24:20.950924-03:00", + "version": 1, + "statements": [ + { + "vulnerability": { + "name": "CVE-2025-31115" + }, + "timestamp": "2025-04-09T13:24:20.950928-03:00", + "products": [ + { + "@id": "fleetctl" + }, + { + "@id": "pkg:deb/debian/liblzma5" + } + ], + "status": "not_affected", + "status_notes": "fleetctl does not use liblzma5", + "justification": "vulnerable_code_not_in_execute_path" + } + ] +} diff --git a/tools/github-releases/github-releases.go b/tools/github-releases/github-releases.go new file mode 100644 index 0000000000..457c490523 --- /dev/null +++ b/tools/github-releases/github-releases.go @@ -0,0 +1,58 @@ +package main + +import ( + "context" + "flag" + "fmt" + "log" + "sort" + "strings" + + "github.com/fleetdm/fleet/v4/pkg/fleethttp" + "github.com/google/go-github/v37/github" +) + +func main() { + n := flag.Int("last-minor-releases", 0, "Output number of Fleet minor releases (with highest patch number)") + flag.Parse() + + if *n <= 0 { + log.Fatal("Set a valid --last-minor-releases value") + } + + c := github.NewClient(fleethttp.NewGithubClient()).Repositories + githubReleases, _, err := c.ListReleases(context.Background(), "fleetdm", "fleet", &github.ListOptions{}) + if err != nil { + log.Fatal(err) + } + + var releaseVersions []string + for _, gr := range githubReleases { + releaseVersions = append(releaseVersions, strings.TrimPrefix(*gr.Name, "fleet-")) + } + + sort.Slice(releaseVersions, func(i, j int) bool { + return releaseVersions[i] > releaseVersions[j] + }) + + lastMinor := releaseVersions[0] + outputReleases := []string{lastMinor} + for _, version := range releaseVersions { + if len(outputReleases) >= *n { + break + } + lastMinorPart := strings.Split(lastMinor, ".")[1] + minor := strings.Split(version, ".")[1] + if minor < lastMinorPart { + outputReleases = append(outputReleases, version) + lastMinor = version + } + } + + for i, version := range outputReleases { + if i != 0 { + fmt.Printf(" ") + } + fmt.Printf("%s", version) + } +} diff --git a/tools/vex-parser/vex-parser.go b/tools/vex-parser/vex-parser.go new file mode 100644 index 0000000000..527c794770 --- /dev/null +++ b/tools/vex-parser/vex-parser.go @@ -0,0 +1,102 @@ +package main + +import ( + "encoding/json" + "fmt" + "os" + "path/filepath" + "strings" +) + +type OpenVEXDocument struct { + Context string `json:"context"` + Statements []Statement `json:"statements"` + Author string `json:"author"` +} + +type Statement struct { + Vulnerability Vulnerability `json:"vulnerability"` + Status string `json:"status"` + StatusNotes string `json:"status_notes"` + Products []Product `json:"products"` + Justification string `json:"justification,omitempty"` + Timestamp string `json:"timestamp,omitempty"` +} + +type Vulnerability struct { + Name string `json:"name"` +} + +type Product struct { + ID string `json:"@id"` +} + +func parseOpenVEX(filePath string) (*OpenVEXDocument, error) { + data, err := os.ReadFile(filePath) + if err != nil { + return nil, err + } + var vex OpenVEXDocument + err = json.Unmarshal(data, &vex) + if err != nil { + return nil, err + } + return &vex, nil +} + +func generateMarkdown(vex *OpenVEXDocument) string { + var sb strings.Builder + for _, stmt := range vex.Statements { + sb.WriteString(fmt.Sprintf("### %s\n", stmt.Vulnerability.Name)) + sb.WriteString(fmt.Sprintf("- **Author:** %s\n", vex.Author)) + sb.WriteString(fmt.Sprintf("- **Status:** `%s`\n", stmt.Status)) + sb.WriteString(fmt.Sprintf("- **Status notes:** %s\n", stmt.StatusNotes)) + if len(stmt.Products) > 0 { + sb.WriteString("- **Products:**\n") + for _, product := range stmt.Products { + sb.WriteString(fmt.Sprintf(" - `%s`\n", product.ID)) + } + } + if stmt.Justification != "" { + sb.WriteString(fmt.Sprintf("- **Justification:** `%s`\n", stmt.Justification)) + } + if stmt.Timestamp != "" { + sb.WriteString(fmt.Sprintf("- **Timestamp:** %s\n", stmt.Timestamp)) + } + sb.WriteString("\n") + } + + return sb.String() +} + +func outputMarkdown(vexPath string) { + vex, err := parseOpenVEX(vexPath) + if err != nil { + fmt.Printf("Error parsing OpenVEX file %q: %s\n", vexPath, err) + return + } + + md := generateMarkdown(vex) + fmt.Print(md) +} + +func main() { + if len(os.Args) < 2 { + fmt.Println("Usage: go run main.go /path/to/directory/with/vex.json/files/") + return + } + + vexPath := os.Args[1] + vexPaths, err := filepath.Glob(filepath.Join(vexPath, "*.vex.json")) + if err != nil { + fmt.Printf("Error processing directory %q: %v\n", vexPath, err) + } + if len(vexPaths) == 0 { + fmt.Printf("No vulnerabilities tracked at the moment.\n\n") + return + } + + for _, vexPath := range vexPaths { + outputMarkdown(vexPath) + } +}