Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vexlog4j better csaf #666

Open
wants to merge 11 commits into
base: develop
Choose a base branch
from
Open

Vexlog4j better csaf #666

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
f2f502c
first try at vex
sparrell Dec 15, 2021
2ba82e6
fix vex bugs
sparrell Dec 15, 2021
3ad50ff
fixes to vex
sparrell Dec 15, 2021
45f120b
add cve link
sparrell Dec 15, 2021
594ebbc
add self url
sparrell Dec 15, 2021
0c27ed4
inc version
sparrell Dec 15, 2021
c50ecd1
fix vex bugs
sparrell Dec 15, 2021
b5d9e95
vex updates
sparrell Dec 16, 2021
69024f9
secvisogram convert json to html
sparrell Dec 16, 2021
56255db
Merge branch 'vexlog4j' of https://github.com/sparrell/quizquadaminos…
sparrell Dec 16, 2021
ce731c1
Merge branch 'develop' into vexlog4j
sparrell Dec 16, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 15 additions & 17 deletions assets/static/.well-known/sbom/quadblockquiz_vex_20211214_no_log4j.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,17 +20,16 @@ <h1>quadblockquiz_vex_20211214_no_log4j: QuadBlockQuiz Not Affected by Log4j exp
<td>Engine: Secvisogram 1.9.0</td>
</tr>
<tr>
<td>Current release date: 2021-12-14T17:00:00.000Z</td>
<td>Current release date: 2021-12-15T23:00:00.000Z</td>
<td>Build Date: 2021-12-14T13:59:32.299Z</td>
</tr>
<tr>
<td>Current version: 1.0.0</td>
<td>Status: final</td>
<td>Current version: 1.0.1</td>
<td>Status: final</td>
</tr>
<tr>
<td>CVSSv3.1 Base Score: 0</td>
<td>Severity:

Critical
</td>
</tr>
Expand All @@ -40,7 +39,7 @@ <h1>quadblockquiz_vex_20211214_no_log4j: QuadBlockQuiz Not Affected by Log4j exp
</tr>
<tr>
<td colspan="2">Also referred to: </td>
</tr>
</tr>
</table>


Expand All @@ -55,27 +54,21 @@ <h3> (CVE-2021-44228)</h3>
<td>CWE-502:Deserialization of Untrusted Data</td>
</tr>
</table>

<h4>Product status</h4>

<h4>Product status</h4>


<h5>Known not affected</h5>
<ul>
<li>QuadBlockQuiz v12.0.1</li>
<li>QuadBlockQuiz v12.0.2</li>
</ul>








<h4>References</h4>
<ul>

<li>Log42j vulnerability. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. (external): <a href=https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2021-44228>https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2021-44228</a></li>

<li>CVE-2021-44228 Mitre 4.0 json (external): <a href=https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;CVEProject&#x2F;cvelist&#x2F;master&#x2F;2021&#x2F;45xxx&#x2F;CVE-2021-44228.json>https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;CVEProject&#x2F;cvelist&#x2F;master&#x2F;2021&#x2F;45xxx&#x2F;CVE-2021-44228.json</a></li>
</ul>

<h4>Threats</h4>
Expand All @@ -92,8 +85,8 @@ <h2>sFractal PSIRT</h2>

<h2>References</h2>
<ul>

<li>The canonical URL. (self): <a href=http:&#x2F;&#x2F;quizquadblocks.sfractal.com:4000&#x2F;.well-known&#x2F;sbom&#x2F;QuadBlockQuiz_20211214_No_Log4j.html>http:&#x2F;&#x2F;quizquadblocks.sfractal.com:4000&#x2F;.well-known&#x2F;sbom&#x2F;QuadBlockQuiz_20211214_No_Log4j.html</a></li>
<li>QuadBlockQuiz qbq-12-0-1-001 - CSAF Version (self): <a href=http:&#x2F;&#x2F;quizquadblocks.sfractal.com:4000&#x2F;.well-known&#x2F;sbom&#x2F;quadblockquiz_vex_20211214_no_log4j.json>http:&#x2F;&#x2F;quizquadblocks.sfractal.com:4000&#x2F;.well-known&#x2F;sbom&#x2F;quadblockquiz_vex_20211214_no_log4j.json</a></li>
<li>QuadBlockQuiz qbq-12-0-1-001 - HTML Version (self): <a href=http:&#x2F;&#x2F;quizquadblocks.sfractal.com:4000&#x2F;.well-known&#x2F;sbom&#x2F;quadblockquiz_vex_20211214_no_log4j.html>http:&#x2F;&#x2F;quizquadblocks.sfractal.com:4000&#x2F;.well-known&#x2F;sbom&#x2F;quadblockquiz_vex_20211214_no_log4j.html</a></li>
</ul>

<h2>Revision history</h2>
Expand All @@ -111,6 +104,11 @@ <h2>Revision history</h2>
<td>2021-12-14T17:00:00.000Z</td>
<td>Initial version</td>
</tr>
<tr>
<td>1.0.1</td>
<td>2021-12-15T23:00:00.000Z</td>
<td>better use of CSAF, info content same</td>
</tr>
</tbody>
</table>

Expand Down
27 changes: 21 additions & 6 deletions assets/static/.well-known/sbom/quadblockquiz_vex_20211214_no_log4j.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,18 +9,23 @@
},
"title": "QuadBlockQuiz Not Affected by Log4j exploits",
"tracking": {
"current_release_date": "2021-12-14T17:00:00.000Z",
"current_release_date": "2021-12-15T23:00:00.000Z",
"id": "quadblockquiz_vex_20211214_no_log4j",
"initial_release_date": "2021-12-14T17:00:00.000Z",
"revision_history": [
{
"date": "2021-12-14T17:00:00.000Z",
"number": "1.0.0",
"summary": "Initial version"
},
{
"date": "2021-12-15T23:00:00.000Z",
"number": "1.0.1",
"summary": "better use of CSAF, info content same"
}
],
"status": "final",
"version": "1.0.0",
"version": "1.0.1",
"generator": {
"date": "2021-12-14T13:59:32.299Z",
"engine": {
Expand All @@ -41,8 +46,13 @@
"references": [
{
"category": "self",
"url": "http://quizquadblocks.sfractal.com:4000/.well-known/sbom/QuadBlockQuiz_20211214_No_Log4j.html",
"summary": "The canonical URL."
"url": "http://quizquadblocks.sfractal.com:4000/.well-known/sbom/quadblockquiz_vex_20211214_no_log4j.json",
"summary": "QuadBlockQuiz qbq-12-0-1-001 - CSAF Version"
},
{
"category": "self",
"url": "http://quizquadblocks.sfractal.com:4000/.well-known/sbom/quadblockquiz_vex_20211214_no_log4j.html",
"summary": "QuadBlockQuiz qbq-12-0-1-001 - HTML Version"
}
]
},
Expand All @@ -62,10 +72,10 @@
"branches": [
{
"category": "product_version",
"name": "12.0.1",
"name": "12.0.2",
"product": {
"product_id": "qbq-12-0-1-001",
"name": "QuadBlockQuiz v12.0.1"
"name": "QuadBlockQuiz v12.0.2"
}
}
]
Expand Down Expand Up @@ -102,6 +112,11 @@
"category": "external",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
"summary": "Log42j vulnerability. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled."
},
{
"category": "external",
"url": "https://raw.githubusercontent.com/CVEProject/cvelist/master/2021/45xxx/CVE-2021-44228.json",
"summary": "CVE-2021-44228 Mitre 4.0 json"
}
]
}
Expand Down