X-Original-To: alpine-devel@mail.alpinelinux.org Delivered-To: alpine-devel@mail.alpinelinux.org Received: from mail.alpinelinux.org (dallas-a1.alpinelinux.org [127.0.0.1]) by mail.alpinelinux.org (Postfix) with ESMTP id 90A44DCE693 for ; Fri, 25 Mar 2016 20:35:08 +0000 (UTC) Received: from mail-qk0-f170.google.com (mail-qk0-f170.google.com [209.85.220.170]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mail.alpinelinux.org (Postfix) with ESMTPS id 4E69EDC718C for ; Fri, 25 Mar 2016 20:35:07 +0000 (UTC) Received: by mail-qk0-f170.google.com with SMTP id p130so39936740qke.1 for ; Fri, 25 Mar 2016 13:35:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coreos.com; s=google; h=date:from:to:message-id:in-reply-to:references:subject:mime-version; bh=91QR06Qa3pVO3a/eODVxcKyKYrejcD2px1CatAPJuos=; b=h4jXpMOHOC1hGmUnnFTGxz+z3DoYKL5mG57JKkrJ9NU9astNlPiZE2CLen2F1S6jgY xGhNelDIP9Z3wF4ysw7c0jJ0tcIByJ8m450roSTd2WeAvw8wlmidknlhbe7h0Rqt9IKa 61GBe23EtfAqNUuzTqBnuzxg89vem/AeO8h/c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:message-id:in-reply-to:references :subject:mime-version; bh=91QR06Qa3pVO3a/eODVxcKyKYrejcD2px1CatAPJuos=; b=EtJUkqmLFWVygQVPZ86eK5vHcjCLvG/0YUffSJ/F7M6NoZp4hHLzegkF/SbAgGBlI5 S5r8Q4A6dkuJiVQ6SUQzG53N9eit27zL/1P4swmAW6+60npVe2om6bRilPqoR0KGwYu6 X14UXhBSaEMgN4qkbn0XItENS+6/QRNNm+m8TGZpSsS8zhtF9y+oO3G8FTuEk1TinS/0 AAkLdDwNecBwhzUgiVS+Xr1n8X/VU4fWYjOjcgftahpWy2o0szOWwh8bma2MJHzGNLfU 3UGgsdP9uvQfXrFSzxs9VHa1mUl0xhll2ahqgwpG3Ss7BypDvAYXRu227KrjeveJsQ+d rc0Q== X-Gm-Message-State: AD7BkJLAwxMhFgmV0E1i1RjkRD0NJ6Peb1frGoxBQQs2+R3UjEmR/omNSXdyiwkTLBDjHf1b X-Received: by 10.55.212.132 with SMTP id s4mr9715549qks.78.1458938107486; Fri, 25 Mar 2016 13:35:07 -0700 (PDT) Received: from Mentalow-2.local ([65.209.47.35]) by smtp.gmail.com with ESMTPSA id 100sm6047422qgg.44.2016.03.25.13.35.06 for (version=TLSv1/SSLv3 cipher=OTHER); Fri, 25 Mar 2016 13:35:06 -0700 (PDT) Date: Fri, 25 Mar 2016 16:35:05 -0400 From: Quentin Machu To: alpine-devel@lists.alpinelinux.org Message-ID: In-Reply-To: <20160325045905.GA6060@newbook> References: <1458852606.9023.4.camel@c89m3s1> <1458853405.9023.10.camel@c89m3s1> <20160325045905.GA6060@newbook> Subject: Re: [alpine-devel] Alpine security tracker X-Mailer: Airmail Beta (353) X-Mailinglist: alpine-devel Precedence: list List-Id: Alpine Development List-Unsubscribe: List-Post: List-Help: List-Subscribe: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="56f5a0f9_5e94fb7c_644" X-Virus-Scanned: ClamAV using ClamSMTP --56f5a0f9_5e94fb7c_644 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline =46rom:=C2=A0Isaac Dunham=C2=A0 There's also no associated package version.=C2=A0 However, it's theoretically possible to retrieve the package version in=C2= =A0 an automated manner:=C2=A0 each issue has an associated git revision, and the diff will include a=C2= =A0 change to the APKBUILD touching at least one of the two version numbers:=C2= =A0 pkgver and pkgrel.=C2=A0 This is obviously going to be rather cumbersome to retrieve from a CVE=C2= =A0 checker;=C2=A0 is there a way to hook into Redmine so it automatically parses this to ad= d=C2=A0 pkgver/pkgrel fields=3F =46rom what I saw, the descriptions usually mention the packages and thei= r fixed versions (if any) =5B1=5D=5B2=5D. Could we simply create fields t= o store them instead of writing them in the description=3F So we could ea= sily parse them using any of the Redmine's export format (XML, =E2=80=A6)= =3F Sometimes, I am confused though because multiple different fixed versions= are listed, for the same Alpine Linux release =5B3=5D=5B4=5D. =5B1=5D:=C2=A0https://bugs.alpinelinux.org/issues/5288 =5B2=5D:=C2=A0https://bugs.alpinelinux.org/issues/5238 =5B3=5D:=C2=A0https://bugs.alpinelinux.org/issues/5209 =5B4=5D:=C2=A0https://bugs.alpinelinux.org/issues/5244 Sometimes (usually=3F always=3F), if there are multiple releases affected= ,=C2=A0 there are separate issues for each release, with the affected release=C2=A0= tagged.=C2=A0 =46or example:=C2=A0 5288,Alpine Linux,Bug,Closed,Normal,=5B3.0=5D openssh: missing sanitisati= on of input for X11 forwarding (CVE-2016-3115),Natanael Copa,03/23/2016 1= 0:48 AM=C2=A0 5287,Alpine Linux,Bug,Closed,Normal,=5B3.1=5D openssh: missing sanitisati= on of input for X11 forwarding (CVE-2016-3115),Natanael Copa,03/23/2016 1= 0:48 AM=C2=A0 5286,Alpine Linux,Bug,Closed,Normal,=5B3.2=5D openssh: missing sanitisati= on of input for X11 forwarding (CVE-2016-3115),Natanael Copa,03/23/2016 1= 0:48 AM=C2=A0 If a bug is filed against the current release only, it will not be tagged= .=C2=A0 This is pretty great, with that information and the package names/version= s as discussed above, we basically have the hard part figured out. The re= st is rest vulnerability name, severity, description as mentioned in my p= revious e-mail. Except for the severity, the CVE names and descriptions a= re also present either in the title and/or in the description. It probabl= y just needs a more stable format to be parsable, I am not sure how it co= uld be achieved with Redmine though. You might have different versions at the same time, yes.=C2=A0 BTW: rather than testing/stable/oldstable, we have 'edge' and multiple=C2= =A0 numbered releases.=C2=A0 Sure, that makes a lot of sense. That=E2=80=99s how Clair do it with othe= r distributions, it uses numbered versions and then =E2=80=9Cunstable=E2=80= =9D (or =E2=80=9Cedge=E2=80=9D in Alpine's case). I just wanted to simpli= fy. To summarize a bit, Clair (or any automated system with similar purposes)= has to be able to parse something like that at the end of the day: Alpine-release: 3.2 Name: CVE-2015-XXXX Severity: High Description: =5B=E2=80=A6=5D Link:=C2=A0https://bugs.alpinelinux.org/issues/X Affecting: =C2=A0 - bind9 (fixed by 9.10) =C2=A0 - dnsmasq (unfixed) =C2=A0=C2=A0 Alpine-release: 3.3 Name: CVE-2015-XXXX Severity: Medium Description: =5B=E2=80=A6=5D Link:=C2=A0https://bugs.alpinelinux.org/issues/Y Affecting: =C2=A0 - bind9 (fixed by 9.15) =C2=A0 - dnsmasq (fixed by 9.40) =C2=A0 - skydns (unfixed) Best Regards, Quentin Machu --56f5a0f9_5e94fb7c_644 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline