Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Alpine: possibly wrong information is indexed #915

Open
armijnhemel opened this issue Sep 12, 2022 · 7 comments
Open

Alpine: possibly wrong information is indexed #915

armijnhemel opened this issue Sep 12, 2022 · 7 comments

Comments

@armijnhemel
Copy link
Contributor

As I mentioned in #801 there is an issue with the way Alpine packages are indexed.

The following example illustrates this:

https://git.alpinelinux.org/aports/tree/main/py3-jinja2/APKBUILD?id=8531e658bb1a196c87ac3e8abf0bb18022266aa5

This APKBUILD file says the version of the package is 2.11.3-r0. But at line 18 there is a different version number:

# secfixes:
#   1.11.3-r0:
#     - CVE-2020-28493

It looks like someone made a typo in the version number and it is this number that VulnerableCode seems to be using (as demonstrated in #801 ).

The solution is to do a little clean up and cross correlate this information with the Alpine package information.

@armijnhemel armijnhemel changed the title Alpine: wrong information is indexed Alpine: possibly wrong information is indexed Sep 12, 2022
@pombredanne
Copy link
Member

@armijnhemel Thank you ++
That's a beautiful finding!
We are getting the data from the Alpine secdb https://secdb.alpinelinux.org/ and this is likely wrong there too. So we can fix this indeed with some correlation and cross-checking (and then contribute it back upstream to Alpine)

@armijnhemel
Copy link
Contributor Author

armijnhemel commented Sep 12, 2022

@armijnhemel Thank you ++ That's a beautiful finding! We are getting the data from the Alpine secdb https://secdb.alpinelinux.org/ and this is likely wrong there too. So we can fix this indeed with some correlation and cross-checking (and then contribute it back upstream to Alpine)

Just verified, it is wrong in their secdb

@TG1999
Copy link
Contributor

TG1999 commented Sep 12, 2022

@pombredanne @armijnhemel if we check this reference https://cve.report/qid/501765 they also have stated Affected Package versions prior to 1.11.3-r0

@armijnhemel
Copy link
Contributor Author

@pombredanne @armijnhemel if we check this reference https://cve.report/qid/501765 they also have stated Affected Package versions prior to 1.11.3-r0

But it is the wrong version. This version of Ninja2 never existed. The Alpine maintainer made a typo in the package version, as can be clearly seen in the packaging information. Why not fix it?

@TG1999
Copy link
Contributor

TG1999 commented Sep 12, 2022

@armijnhemel makes sense!

@armijnhemel
Copy link
Contributor Author

armijnhemel commented Sep 13, 2022

@armijnhemel Thank you ++ That's a beautiful finding! We are getting the data from the Alpine secdb https://secdb.alpinelinux.org/ and this is likely wrong there too. So we can fix this indeed with some correlation and cross-checking (and then contribute it back upstream to Alpine)

I am wondering how many other errors there are in the Alpine security database. What I could imagine is that you would check the Alpine recipes to see if a certain version exists or ever existed. I could even imagine also checking the upstream sources to see if a package version actually has ever existed.

@armijnhemel
Copy link
Contributor Author

#917 is a generalization of this bug

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

4 participants