summaryrefslogtreecommitdiffstats
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* Drop buster from backports releasesEmilio Pozuelo Monfort14 days1-1/+1
| | | | buster-backports has been archived.
* Revert "bugs.py: Hint towards a typo issue on check"Salvatore Bonaccorso2023-08-021-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 63a9aa4515f4335203346034dcf842b067ab0fcc. Samuel Henrique reported on IRC to get a message "release note must follow its package note" when trying to commit diff --git c/data/CVE/list i/data/CVE/list index 5f829a4c..a3741dd6 100644 --- c/data/CVE/list +++ i/data/CVE/list @@ -92086,10 +92086,12 @@ CVE-2022-28702 (Incorrect Default Permissions vulnerability in ABB e-Design allo CVE-2022-1615 (In Samba, GnuTLS gnutls_rnd() can fail and give predictable random val ...) [experimental] - samba 2:4.17.0+dfsg-1 - samba 2:4.16.5+dfsg-2 (bug #1021024) + [buster] - sambda <not-affected> (Vulnerable code introduced later) [bullseye] - samba <postponed> (Minor issue) NOTE: https://bugzilla.samba.org/show_bug.cgi?id=15103 NOTE: https://gitlab.com/samba-team/samba/-/merge_requests/2644 - NOTE: https://gitlab.com/samba-team/samba/-/commit/9849e7440e30853c61a80ce1f11b7b244ed766fe (samba-4.17.0rc1) + NOTE: Introduced by: https://gitlab.com/samba-team/samba/-/commit/664eed2e926f8f572b81e6d7c8e09b7ccbafb908 (samba-4.12.0) + NOTE: Fixed by: https://gitlab.com/samba-team/samba/-/commit/9849e7440e30853c61a80ce1f11b7b244ed766fe (samba-4.17.0rc1) CVE-2022-1614 (The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visi ...) NOT-FOR-US: WordPress plugin CVE-2022-1613 (The Restricted Site Access WordPress plugin before 7.3.2 prioritizes g ...) In this case the error comes because of the release "[buster] - sambda ..." does not follow a package note "- sambda ...", which hints this time to a possible typo in the source package name. If the source package name would have been correct, the syntax check would have indicated the wrong order next. But this is not generally only a hint to a typo. Samewise the message would come if two source package enties are covered and a release note is put before the actual package note, e.g. - linux ... [buster] - amd64-microcode ... - amd64-microcode Revert the change as the hint is given to check if something is wrong adding the release note. It *might* be a typo in the source package note, but it might be as well a release note which is missplaced but valid. That said, this hints at that the notation of 'package note' and 'release note' is not sufficiently well explained and might need some clarification in the message from the syntax check or documentation.
* bugs.py: Hint towards a typo issue on checkSamuel Henrique2023-08-011-1/+3
|
* Filter list for "unreported" view. Fix #987283Anton Gladky2023-05-261-22/+65
|
* Add file print of the removed_packages into DBAnton Gladky2023-05-251-0/+13
|
* xpickle: re-parse the file in case of AttributeErrorEmilio Pozuelo Monfort2023-03-281-6/+1
|
* Add a readable hint on what happens on unpickling errorsDominik George2023-03-281-0/+5
|
* sectracker.parsers: make cvelist et al return a list of BugsEmilio Pozuelo Monfort2023-03-273-17/+15
|
* parsers: make classes mutableEmilio Pozuelo Monfort2023-03-272-20/+59
| | | | | | | The parser is not read-only but has write support, so it makes more sense to have mutable classes so that API users can modify them as appopriate rather than going through hoops to clone objects in order to modify something.
* sectracker.parsers: fix reporting of invalid annotationsEmilio Pozuelo Monfort2023-03-271-1/+1
|
* sectracker.parsers: fix itp bug checkEmilio Pozuelo Monfort2023-03-271-1/+1
|
* test_parsers: update duplicated urgency error messageEmilio Pozuelo Monfort2023-03-271-1/+1
|
* test_parsers: update errors for 'bug filed' annotationEmilio Pozuelo Monfort2023-03-271-2/+4
| | | | That is no longer supported, see commit 8f844bff.
* test_parsers: fix PackageAnnotationsEmilio Pozuelo Monfort2023-03-271-15/+15
| | | | This was changed in 727ff2f44 but the test was not updated.
* sectracker.analyzers: check the right struct fieldsEmilio Pozuelo Monfort2023-03-271-2/+2
|
* lib/debian-releases.mk: Add support for fetching from different archive areasSalvatore Bonaccorso2023-02-041-0/+7
| | | | | | | | | For suites older than bookworm, fix section to main, contrib and non-free. Starting in bookworm an additonal archive section non-free-firmware will be present. Link: https://bugs.debian.org/1030321 Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
* lib: add support for data/<extended>/list in the parsersSylvain Beucler2021-10-221-0/+16
|
* security_db: fix releasepart_to_number on non-mainEmilio Pozuelo Monfort2021-06-161-0/+3
| | | | | | | For releases with a component (e.g. buster/non-free), releasepart_to_number was not spliting the component. This was causing bad sorting on CVE pages for packages in contrib or non-free.
* security_db: Create next_point_table as well on fresh DB initializationSalvatore Bonaccorso2021-05-221-0/+2
| | | | | | | | | | | | | | 8846bec76339 ("Fix CVE10k problem for CVE with more than 4 numbers") introduced the initialization of schema 22 and introducing the machinery to allow the tracker.d.o support reading next point release information. On updates from already initialized databases with previous schemas this worked fine, but as Neil Williams reported, this fails when starting with a new instance. Link: https://lists.debian.org/debian-security-tracker/2021/05/msg00024.html Fixes: 8846bec76339 ("Fix CVE10k problem for CVE with more than 4 numbers") Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
* web_support: call parse_qs from urllibEmilio Pozuelo Monfort2021-04-301-1/+6
| | | | The one from cgi has been removed in Python 3.8.
* security_db: replace base64.encodestring with encodebytesEmilio Pozuelo Monfort2021-04-301-3/+3
| | | | | | | It was an alias for the latter, and has finally been removed in Python 3.9. Likewise for decodestring.
* Sort CVEs as versionsSylvain Beucler2021-04-301-10/+3
|
* Merge branch 'beuc/security-tracker-natsort'Salvatore Bonaccorso2021-02-271-1/+8
|\ | | | | | | | | | | tracker_service: display CVE entries using natural sort order See merge request security-tracker-team/security-tracker!76
| * tracker_service: display CVE entries using natural sort order [#76]Sylvain Beucler2021-02-121-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to avoid annoying confusions with the default incorrect sort due to e.g. CVE-2021-3392 considered higher than CVE-2021-20203 Approach: - use 'COLLATE natorder' [1]; however, we'd have to leave the bug unfixed for a few years, until this feature is merged and packaged in stable sqlite3 [1] https://sqlite.org/forum/forumpost/e4dc6f3331 - sort at the Python level; AFAICS this breaks the current code global logic that delegates the sort to the database, so we'd need to revamp the Python code or introduce ad-hoc logic - use a size-bounded sort at the SQL level (current patch) using a reasonable max size (10 digits / 32-bits), until 1) is available. (variable-length is feasible but impacts readability and performance)
* | Fix CVE10k problem for CVE with more than 4 numbersCarles Pina i Estany2021-02-152-1/+78
|/ | | | | | | It had no consequences in security-tracker: the next-oldstable-point-update.txt file is empty and the next-point-update.txt CVEs are not used yet for what I can see via this code path.
* sectracker.parsers: rename version to kind in package_pseudoEmilio Pozuelo Monfort2020-12-041-6/+6
| | | | | | The version is tracked in package_version, here we have a <tag> assigned to the kind variable of the PackageAnnotation, so let's call it kind to make it less confusing.
* sectracker.parsers: fix innerdispatch callbackEmilio Pozuelo Monfort2020-12-041-1/+1
| | | | The signature no longer includes a bugs list.
* sectracker.parsers: there's no 'bug filed' urgencyEmilio Pozuelo Monfort2020-12-041-2/+1
| | | | That may have been used once upon a time, but it's not used anymore.
* sectracker.parsers: use _sortedtupleEmilio Pozuelo Monfort2020-12-041-3/+1
|
* sectracker.parsers: unconditionally import internEmilio Pozuelo Monfort2020-12-041-5/+1
| | | | We no longer support Python 2.
* sectracker.parsers: add function to write the file backEmilio Pozuelo Monfort2020-12-021-0/+60
| | | | | This change and the previous ones based on work by Brian with additional fixes and adaptations by me.
* sectracker.parsers: be explicit when building PackageAnnotationsEmilio Pozuelo Monfort2020-12-021-6/+27
| | | | | In some cases we are intentionally passing versions as kinds or kinds as versions, and making it explicit makes it less confusing.
* sectracker.parsers: include TEMP issues in the CVE regexEmilio Pozuelo Monfort2020-12-021-1/+1
| | | | In order to support extended CVE files.
* sectracker.parsers: do not uniquify CVE namesEmilio Pozuelo Monfort2020-12-021-14/+1
| | | | | | | | | We need the original name (basically the year) in order to write it back later. Besides the function was taking the line number rather than a hash of the description, so it was buggy anyway. If something needs the unique name at some point, we can add it in an additional field.
* sectracker.parsers: don't sort the xrefsEmilio Pozuelo Monfort2020-12-021-1/+1
| | | | | Take them as they come, as our sorting is different than the one in the file.
* sectracker.parsers: don't wrap and deref the argumentsEmilio Pozuelo Monfort2020-12-021-4/+4
| | | | We are no longer concatenating tuples.
* sectracker.parsers: better parse annotationsEmilio Pozuelo Monfort2020-12-021-35/+27
|
* sectracker.parsers: keep the parenthesis in the descriptionEmilio Pozuelo Monfort2020-12-021-4/+0
| | | | We need them in order to write the file back.
* Remove checks for apt_pkg.version_compareEmilio Pozuelo Monfort2020-11-102-17/+7
| | | | | The rename happened too long ago, and VersionCompare is long gone. We assume it exists in security_db anyway.
* sectracker: remove future importsEmilio Pozuelo Monfort2020-11-105-8/+0
|
* sectracker/repo.py: compare data to a bytes objectEmilio Pozuelo Monfort2020-11-101-1/+1
| | | | Otherwise we'll run into an endless loop under Python 3.
* sectracker/repo.py: fix calls to urllib under python3Emilio Pozuelo Monfort2020-11-101-3/+3
|
* sectracker/repo.py: don't look for sha1 fieldsEmilio Pozuelo Monfort2020-11-101-1/+0
| | | | Release files no longer contain them.
* sectracker_test/run.py: run tests under python3Emilio Pozuelo Monfort2020-11-101-1/+1
|
* test_xpickle.py: encode data before writingEmilio Pozuelo Monfort2020-11-101-2/+2
| | | | The tempfile is opened in binary mode.
* test_regexpcase.py: use assertEqual, assertEquals is deprecatedEmilio Pozuelo Monfort2020-11-101-1/+1
|
* bugs.py: add some checks for package notesEmilio Pozuelo Monfort2020-11-051-10/+48
|
* config.py: raise an error on invalid distributionsEmilio Pozuelo Monfort2020-10-061-1/+1
|
* Reenable the backport releasesEmilio Pozuelo Monfort2020-09-301-4/+1
|
* debian_support: updateFile: support .xz filesEmilio Pozuelo Monfort2020-09-301-21/+31
| | | | https://bugs.debian.org/931533

© 2014-2024 Faster IT GmbH | imprint | privacy policy