Update IT advisories #128

justmurphy · 2024-10-22T23:14:56Z

🗣 Description

💭 Motivation and context

🧪 Testing

✅ Pre-approval checklist

This PR has an informative and human-readable title.
Changes are limited to a single goal - eschew scope creep!
All future TODOs are captured in issues, which are referenced
in code comments.
All relevant type-of-change labels have been added.
I have read the CONTRIBUTING document.
These code changes follow cisagov code standards.
All relevant repo and/or project documentation has been updated
to reflect the changes in this PR.
Tests have been added and/or modified to cover the changes in this PR.
All new and existing tests pass.

✅ Pre-merge checklist

Revert dependencies to default branches.
Finalize version.

✅ Post-merge checklist

Create a release.

mstrad

The CSAF itself looks good. However the hash file and signature file of the CSAF should be regenerated to reflect the changed CSAF.

justmurphy · 2024-10-24T21:24:30Z

csaf_files/IT/white/2024/va-24-201-01.json

@@ -94,7 +94,7 @@
            "branches": [
              {
                "category": "product_version_range",
-                "name": "all versions",
+                "name": "<=4.8.1",


https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#31231-branches-type---name-under-product-version

"all versions" is invalid. See documentation above.

I agree with the above change.

IIUC Adminer "4.8.1" happens to be a "Vers -like Specifier (vls)" so I think this change works syntactically and I understand that "all versions" is not valid.

However I'm slightly concerned with how to interpret this limit on the version range. The product is used in status and remediation elements. "<=4.8.1" might imply that there might be a more recent version, and is that more recent version fixed? We can't know the future at the time of publication, could update the CSAF if a new/fixed version is released, and the CSAF VEX profile has an explicit "Fixed" status, but at least for those familar with the CVE ecosystem, "<=4.8.1" could imply "fixed in >4.8.1, now go look to see if any such versions exist."

@amanion-cisa there is also this as an option:
Version Range Specifier (vers)
vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [VERS].
vers MUST be used in its canonical form. To convey the term "all versions" the special string vers:all/* MUST be used.

I used vers:all/* for the Adminer advisory, I think this is more correct informationally, see develop...amanion-cisa:CSAF:jmfixes#diff-b68d7bbabc197e783ddff83a11b37d5c9e309aeec18c89cf5551b478586daac1L97-R166.

justmurphy · 2024-10-24T21:24:51Z

csaf_files/IT/white/2024/va-24-201-01.json

@@ -158,7 +158,7 @@
                  "product_id": "CSAFPID-0078"
                },
                "category": "product_version_range",
-                "name": "all versions"
+                "name": "<4.8.4"


See above comment re: version:
https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#31231-branches-type---name-under-product-version

I agree with the above change.

justmurphy · 2024-10-24T21:28:22Z

csaf_files/IT/white/2024/va-24-201-01.json

-          ]
+            "Matthew Galligan"
+          ],
+          "organization": "CISA Rapid Action Force",


https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#311-acknowledgments-type

Properties for acknowledgements are names, organization, summary, and urls. Moved organization from names property to organization property.

I agree with the above change.

justmurphy · 2024-10-24T21:28:50Z

csaf_files/IT/white/2024/va-24-201-01.json

-          ]
+            "Matthew Galligan"
+          ],
+          "organization": "CISA Rapid Action Force",
        }


See above comment:
https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#311-acknowledgments-type

I agree with the above change.

justmurphy · 2024-10-24T21:29:02Z

csaf_files/IT/white/2024/va-24-201-01.json

-          ]
+            "Matthew Galligan"
+          ],
+          "organization": "CISA Rapid Action Force",
        }


See above comment:
https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#311-acknowledgments-type

I agree with the above change.

justmurphy · 2024-10-24T21:32:35Z

The CSAF itself looks good. However the hash file and signature file of the CSAF should be regenerated to reflect the changed CSAF.

@mstrad the issue I am seeing is the product tree structure: vendor -> product_family -> product_name -> product_version.

Going to revise the advisory to meet recommended structure and will ping you for another review. I believe that all the IT advisories will need to be revised for product tree structure, and then small edits to the product_version_range and acknowledgement properties.

mstrad · 2024-10-24T22:42:32Z

The CSAF itself looks good. However the hash file and signature file of the CSAF should be regenerated to reflect the changed CSAF.

@mstrad the issue I am seeing is the product tree structure: vendor -> product_family -> product_name -> product_version.

Going to revise the advisory to meet recommended structure and will ping you for another review. I believe that all the IT advisories will need to be revised for product tree structure, and then small edits to the product_version_range and acknowledgement properties.

@justmurphy I see what you're saying. Initially I was only reviewing the proposed changes in this PR itself. All of which I agree with and offer the reminder that new hashes and signature files will need to be made and pushed to the repo when a CSAF file is updated. :)

To the comment above, I agree. I took a look at the raw CSAF file and I agree that following the recommended product tree structure should be followed with the ending leaf being a product_version or product_version_range. Will this recommendation become a requirement in future CSAF versions?

amanion-cisa

FWIW I'm fine with the changes, they are fixing technically incorrect CSAF. I can make the updates including new hashes, signatures, and ROLIE files if you'd like.

amanion-cisa · 2024-11-08T21:05:58Z

csaf_files/IT/white/2024/va-24-201-01.json

@@ -94,7 +94,7 @@
            "branches": [
              {
                "category": "product_version_range",
-                "name": "all versions",
+                "name": "<=4.8.1",


IIUC Adminer "4.8.1" happens to be a "Vers -like Specifier (vls)" so I think this change works syntactically and I understand that "all versions" is not valid.

However I'm slightly concerned with how to interpret this limit on the version range. The product is used in status and remediation elements. "<=4.8.1" might imply that there might be a more recent version, and is that more recent version fixed? We can't know the future at the time of publication, could update the CSAF if a new/fixed version is released, and the CSAF VEX profile has an explicit "Fixed" status, but at least for those familar with the CVE ecosystem, "<=4.8.1" could imply "fixed in >4.8.1, now go look to see if any such versions exist."

amanion-cisa · 2024-11-14T01:27:54Z

Here are fixes for version ranges and acknowledgments (and section headings, not initially part of this PR): develop...amanion-cisa:CSAF:jmfixes

I won't send a PR until we've reviewed these changes.

update vuln acknowledgment structure

03d951a

justmurphy added blocked This issue or pull request is awaiting the outcome of another issue or pull request improvement This issue or pull request will add new or improve existing functionality labels Oct 22, 2024

justmurphy requested review from batarr22 and mstrad October 22, 2024 23:14

justmurphy self-assigned this Oct 22, 2024

justmurphy marked this pull request as draft October 22, 2024 23:15

justmurphy added 2 commits October 22, 2024 19:33

change product_version_range for Adminer

a1f9988

Change product_version_range for AdminerEvo

47fdd4f

mstrad requested changes Oct 24, 2024

View reviewed changes

justmurphy commented Oct 24, 2024

View reviewed changes

amanion-cisa approved these changes Nov 8, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update IT advisories #128

Update IT advisories #128

justmurphy commented Oct 22, 2024

mstrad left a comment

justmurphy Oct 24, 2024

mstrad Oct 24, 2024

amanion-cisa Nov 8, 2024

justmurphy Nov 13, 2024

amanion-cisa Nov 14, 2024

justmurphy Oct 24, 2024

mstrad Oct 24, 2024

justmurphy Oct 24, 2024

mstrad Oct 24, 2024

justmurphy Oct 24, 2024

mstrad Oct 24, 2024

justmurphy Oct 24, 2024

mstrad Oct 24, 2024

justmurphy commented Oct 24, 2024 •

edited

Loading

mstrad commented Oct 24, 2024

amanion-cisa left a comment

amanion-cisa Nov 8, 2024

amanion-cisa commented Nov 14, 2024

Update IT advisories #128

Are you sure you want to change the base?

Update IT advisories #128

Conversation

justmurphy commented Oct 22, 2024

🗣 Description

💭 Motivation and context

🧪 Testing

✅ Pre-approval checklist

✅ Pre-merge checklist

✅ Post-merge checklist

mstrad left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

justmurphy commented Oct 24, 2024 • edited Loading

mstrad commented Oct 24, 2024

amanion-cisa left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

amanion-cisa commented Nov 14, 2024

justmurphy commented Oct 24, 2024 •

edited

Loading