aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLudovic Courtès <ludo@gnu.org>2021-04-21 23:49:59 +0200
committerLudovic Courtès <ludo@gnu.org>2021-04-21 23:53:49 +0200
commit7dbc2fcb45fac4a0b64fef8efa8c858a047d0498 (patch)
tree3d22f8ef534f28dfae2d6f51d87966de333aacb8
parent50616a7dfbbda1d7f8d5cffceaa165b829d2c8ae (diff)
downloadguix-7dbc2fcb45fac4a0b64fef8efa8c858a047d0498.tar
guix-7dbc2fcb45fac4a0b64fef8efa8c858a047d0498.tar.gz
cve: Gracefully handle bogus CVE entries.
Fixes <https://bugs.gnu.org/47941>. Reported by Jack Hill <jackhill@jackhill.us>. * guix/cve.scm (reference-data->cve-references): Gracefully handle lack of "reference_data". (cpe-match->cve-configuration): Gracefully handle lack of "cpe23Uri".
-rw-r--r--guix/cve.scm31
1 files changed, 18 insertions, 13 deletions
diff --git a/guix/cve.scm b/guix/cve.scm
index b3a8b13a06..9e1cf5b587 100644
--- a/guix/cve.scm
+++ b/guix/cve.scm
@@ -1,5 +1,5 @@
;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021 Ludovic Courtès <ludo@gnu.org>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -99,7 +99,9 @@
(define (reference-data->cve-references alist)
(map json->cve-reference
- (vector->list (assoc-ref alist "reference_data"))))
+ ;; Normally "reference_data" is always present but rejected CVEs such
+ ;; as CVE-2020-10020 can lack it.
+ (vector->list (or (assoc-ref alist "reference_data") '#()))))
(define %cpe-package-rx
;; For applications: "cpe:2.3:a:VENDOR:PACKAGE:VERSION", or sometimes
@@ -137,17 +139,20 @@ package."
(starte (assoc-ref alist "versionStartExcluding"))
(endi (assoc-ref alist "versionEndIncluding"))
(ende (assoc-ref alist "versionEndExcluding")))
- (let-values (((package version) (cpe->package-name cpe)))
- (and package
- `(,package
- ,(cond ((and (or starti starte) (or endi ende))
- `(and ,(if starti `(>= ,starti) `(> ,starte))
- ,(if endi `(<= ,endi) `(< ,ende))))
- (starti `(>= ,starti))
- (starte `(> ,starte))
- (endi `(<= ,endi))
- (ende `(< ,ende))
- (else version)))))))
+ ;; Normally "cpe23Uri" is here in each "cpe_match" item, but CVE-2020-0534
+ ;; has a configuration that lacks it.
+ (and cpe
+ (let-values (((package version) (cpe->package-name cpe)))
+ (and package
+ `(,package
+ ,(cond ((and (or starti starte) (or endi ende))
+ `(and ,(if starti `(>= ,starti) `(> ,starte))
+ ,(if endi `(<= ,endi) `(< ,ende))))
+ (starti `(>= ,starti))
+ (starte `(> ,starte))
+ (endi `(<= ,endi))
+ (ende `(< ,ende))
+ (else version))))))))
(define (configuration-data->cve-configurations alist)
"Given ALIST, a JSON dictionary for the baroque \"configurations\"