From be7ed0db474a6654e4f0f11cec1edbab11322153 Mon Sep 17 00:00:00 2001 From: jasquat Date: Fri, 16 Aug 2024 15:36:29 -0400 Subject: [PATCH 1/3] build on pr w/ burnettk --- .github/workflows/test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index df6aff4..0a94931 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,6 +4,7 @@ on: push: branches: - main + pull_request: workflow_dispatch: jobs: From 29bf2eff62d44438e8d89fa0dd086d3e0fdad52f Mon Sep 17 00:00:00 2001 From: jasquat Date: Fri, 16 Aug 2024 15:38:23 -0400 Subject: [PATCH 2/3] remove one finding again w/ burnettk --- .../tests/ecr-scan-result-ubuntu.json | 60 ------------------- 1 file changed, 60 deletions(-) diff --git a/wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-ubuntu.json b/wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-ubuntu.json index 2ab2609..f2204c6 100644 --- a/wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-ubuntu.json +++ b/wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-ubuntu.json @@ -1,66 +1,6 @@ { "imageScanFindings": { "enhancedFindings": [ - { - "awsAccountId": "772215651096", - "description": " Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a ", - "findingArn": "arn:aws:inspector2:us-east-2:772215651096:finding/ad5766346c1bd7d00155d228605c8e98", - "firstObservedAt": "2024-08-15T11:00:34.053000-04:00", - "lastObservedAt": "2024-08-15T11:00:34.053000-04:00", - "packageVulnerabilityDetails": { - "cvss": [], - "referenceUrls": [ - "https://www.cve.org/CVERecord?id=CVE-2024-4603", - "https://www.openssl.org/news/secadv/20240516.txt", - "https://ubuntu.com/security/notices/USN-6937-1" - ], - "relatedVulnerabilities": ["USN-6937-1"], - "source": "UBUNTU_CVE", - "sourceUrl": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4603.html", - "vendorCreatedAt": "2024-05-16T12:15:00-04:00", - "vulnerabilityId": "CVE-2024-4603", - "vulnerablePackages": [ - { - "arch": "AMD64", - "epoch": 0, - "name": "libssl3t64", - "packageManager": "OS", - "release": "0ubuntu3.1", - "sourceLayerHash": "sha256:2b3981cac065674916a0b4e8d1b5d7eb49d9863a79ec47ba37336c70496ac8ab", - "version": "3.0.13" - } - ] - }, - "remediation": { - "recommendation": { - "text": "None Provided" - } - }, - "resources": [ - { - "details": { - "awsEcrContainerImage": { - "architecture": "amd64", - "imageHash": "sha256:a616befefefd567cd27092f0eacaa057e3e9592b3c1c57110800f2a43828994f", - "imageTags": ["main"], - "platform": "UBUNTU_24_04", - "pushedAt": "2024-08-15T11:00:23-04:00", - "registry": "772215651096", - "repositoryName": "infr/testcloud2202" - } - }, - "id": "arn:aws:ecr:us-east-2:772215651096:repository/infr/testcloud2202/sha256:a616befefefd567cd27092f0eacaa057e3e9592b3c1c57110800f2a43828994f", - "tags": {}, - "type": "AWS_ECR_CONTAINER_IMAGE" - } - ], - "score": 0.0, - "severity": "UNTRIAGED", - "status": "ACTIVE", - "title": "CVE-2024-4603 - libssl3t64", - "type": "PACKAGE_VULNERABILITY", - "updatedAt": "2024-08-15T11:00:34.053000-04:00" - }, { "awsAccountId": "772215651096", "description": " Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was ne", From 657414591dd207877cdda0e58e6483206d77bba7 Mon Sep 17 00:00:00 2001 From: jasquat Date: Fri, 16 Aug 2024 15:40:44 -0400 Subject: [PATCH 3/3] put back vulnerability w/ burnettk --- .../tests/ecr-scan-result-ubuntu.json | 60 +++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-ubuntu.json b/wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-ubuntu.json index f2204c6..2ab2609 100644 --- a/wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-ubuntu.json +++ b/wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-ubuntu.json @@ -1,6 +1,66 @@ { "imageScanFindings": { "enhancedFindings": [ + { + "awsAccountId": "772215651096", + "description": " Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a ", + "findingArn": "arn:aws:inspector2:us-east-2:772215651096:finding/ad5766346c1bd7d00155d228605c8e98", + "firstObservedAt": "2024-08-15T11:00:34.053000-04:00", + "lastObservedAt": "2024-08-15T11:00:34.053000-04:00", + "packageVulnerabilityDetails": { + "cvss": [], + "referenceUrls": [ + "https://www.cve.org/CVERecord?id=CVE-2024-4603", + "https://www.openssl.org/news/secadv/20240516.txt", + "https://ubuntu.com/security/notices/USN-6937-1" + ], + "relatedVulnerabilities": ["USN-6937-1"], + "source": "UBUNTU_CVE", + "sourceUrl": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4603.html", + "vendorCreatedAt": "2024-05-16T12:15:00-04:00", + "vulnerabilityId": "CVE-2024-4603", + "vulnerablePackages": [ + { + "arch": "AMD64", + "epoch": 0, + "name": "libssl3t64", + "packageManager": "OS", + "release": "0ubuntu3.1", + "sourceLayerHash": "sha256:2b3981cac065674916a0b4e8d1b5d7eb49d9863a79ec47ba37336c70496ac8ab", + "version": "3.0.13" + } + ] + }, + "remediation": { + "recommendation": { + "text": "None Provided" + } + }, + "resources": [ + { + "details": { + "awsEcrContainerImage": { + "architecture": "amd64", + "imageHash": "sha256:a616befefefd567cd27092f0eacaa057e3e9592b3c1c57110800f2a43828994f", + "imageTags": ["main"], + "platform": "UBUNTU_24_04", + "pushedAt": "2024-08-15T11:00:23-04:00", + "registry": "772215651096", + "repositoryName": "infr/testcloud2202" + } + }, + "id": "arn:aws:ecr:us-east-2:772215651096:repository/infr/testcloud2202/sha256:a616befefefd567cd27092f0eacaa057e3e9592b3c1c57110800f2a43828994f", + "tags": {}, + "type": "AWS_ECR_CONTAINER_IMAGE" + } + ], + "score": 0.0, + "severity": "UNTRIAGED", + "status": "ACTIVE", + "title": "CVE-2024-4603 - libssl3t64", + "type": "PACKAGE_VULNERABILITY", + "updatedAt": "2024-08-15T11:00:34.053000-04:00" + }, { "awsAccountId": "772215651096", "description": " Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was ne",