attempt to upload potentially bad sarif file w/ burnettk
This commit is contained in:
jasquat
parent
e56ffec56a
commit
0d78e3968f
|
|
@ -39,21 +39,22 @@ jobs:
|
|||
# python wait-for-ecr-scan-and-get-sarif/pylib/aws_scan_findings_to_sarif.py \
|
||||
# --input_file wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-ubuntu.json \
|
||||
# --output_file report.sarif
|
||||
- name: Run the Python script to convert ECR scan to SARIF
|
||||
shell: bash
|
||||
run: |
|
||||
python wait-for-ecr-scan-and-get-sarif/pylib/aws_scan_findings_to_sarif.py \
|
||||
--input_file wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-no-findings.json \
|
||||
--output_file report.sarif
|
||||
|
||||
- name: Upload SARIF report as artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: sarif-report
|
||||
path: report.sarif
|
||||
# - name: Run the Python script to convert ECR scan to SARIF
|
||||
# shell: bash
|
||||
# run: |
|
||||
# python wait-for-ecr-scan-and-get-sarif/pylib/aws_scan_findings_to_sarif.py \
|
||||
# --input_file wait-for-ecr-scan-and-get-sarif/tests/ecr-scan-result-no-findings.json \
|
||||
# --output_file report.sarif
|
||||
#
|
||||
# - name: Upload SARIF report as artifact
|
||||
# uses: actions/upload-artifact@v4
|
||||
# with:
|
||||
# name: sarif-report
|
||||
# path: report.sarif
|
||||
|
||||
- name: Upload SARIF file
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
with:
|
||||
sarif_file: report.sarif
|
||||
# sarif_file: report.sarif
|
||||
sarif_file: "wait-for-ecr-scan-and-get-sarif/tests/bad-ecr-repot.sarif"
|
||||
category: security
|
||||
|
|
|
|||
|
|
@ -0,0 +1,208 @@
|
|||
{
|
||||
"version": "2.1.0",
|
||||
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
|
||||
"runs": [
|
||||
{
|
||||
"tool": {
|
||||
"driver": {
|
||||
"name": "Amazon ECR Image Scanning",
|
||||
"informationUri": "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html",
|
||||
"rules": [
|
||||
{
|
||||
"id": "CVE-2024-4603",
|
||||
"name": "PACKAGE_VULNERABILITY",
|
||||
"shortDescription": {
|
||||
"text": "CVE-2024-4603 - libssl3t64"
|
||||
},
|
||||
"fullDescription": {
|
||||
"text": " Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a "
|
||||
},
|
||||
"defaultConfiguration": {
|
||||
"level": "none"
|
||||
},
|
||||
"helpUri": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4603.html",
|
||||
"help": {
|
||||
"text": "Vulnerability CVE-2024-4603\nSeverity: UNTRIAGED\nPackage: libssl3t64\nFixed Version: \nLink: [CVE-2024-4603](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4603.html)",
|
||||
"markdown": "**Vulnerability CVE-2024-4603**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|UNTRIAGED|libssl3t64||[CVE-2024-4603](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4603.html)\n\n Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a "
|
||||
},
|
||||
"properties": {
|
||||
"tags": [
|
||||
"vulnerability",
|
||||
"security",
|
||||
"UNTRIAGED"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "CVE-2024-5535",
|
||||
"name": "PACKAGE_VULNERABILITY",
|
||||
"shortDescription": {
|
||||
"text": "CVE-2024-5535 - libssl3t64"
|
||||
},
|
||||
"fullDescription": {
|
||||
"text": " Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was ne"
|
||||
},
|
||||
"defaultConfiguration": {
|
||||
"level": "none"
|
||||
},
|
||||
"helpUri": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-5535.html",
|
||||
"help": {
|
||||
"text": "Vulnerability CVE-2024-5535\nSeverity: UNTRIAGED\nPackage: libssl3t64\nFixed Version: \nLink: [CVE-2024-5535](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-5535.html)",
|
||||
"markdown": "**Vulnerability CVE-2024-5535**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|UNTRIAGED|libssl3t64||[CVE-2024-5535](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-5535.html)\n\n Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was ne"
|
||||
},
|
||||
"properties": {
|
||||
"tags": [
|
||||
"vulnerability",
|
||||
"security",
|
||||
"UNTRIAGED"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "CVE-2024-2511",
|
||||
"name": "PACKAGE_VULNERABILITY",
|
||||
"shortDescription": {
|
||||
"text": "CVE-2024-2511 - libssl3t64"
|
||||
},
|
||||
"fullDescription": {
|
||||
"text": " Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this iss"
|
||||
},
|
||||
"defaultConfiguration": {
|
||||
"level": "none"
|
||||
},
|
||||
"helpUri": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-2511.html",
|
||||
"help": {
|
||||
"text": "Vulnerability CVE-2024-2511\nSeverity: UNTRIAGED\nPackage: libssl3t64\nFixed Version: \nLink: [CVE-2024-2511](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-2511.html)",
|
||||
"markdown": "**Vulnerability CVE-2024-2511**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|UNTRIAGED|libssl3t64||[CVE-2024-2511](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-2511.html)\n\n Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this iss"
|
||||
},
|
||||
"properties": {
|
||||
"tags": [
|
||||
"vulnerability",
|
||||
"security",
|
||||
"UNTRIAGED"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "CVE-2024-4741",
|
||||
"name": "PACKAGE_VULNERABILITY",
|
||||
"shortDescription": {
|
||||
"text": "CVE-2024-4741 - libssl3t64"
|
||||
},
|
||||
"fullDescription": {
|
||||
"text": " Use After Free with SSL_free_buffers"
|
||||
},
|
||||
"defaultConfiguration": {
|
||||
"level": "none"
|
||||
},
|
||||
"helpUri": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4741.html",
|
||||
"help": {
|
||||
"text": "Vulnerability CVE-2024-4741\nSeverity: UNTRIAGED\nPackage: libssl3t64\nFixed Version: \nLink: [CVE-2024-4741](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4741.html)",
|
||||
"markdown": "**Vulnerability CVE-2024-4741**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|UNTRIAGED|libssl3t64||[CVE-2024-4741](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4741.html)\n\n Use After Free with SSL_free_buffers"
|
||||
},
|
||||
"properties": {
|
||||
"tags": [
|
||||
"vulnerability",
|
||||
"security",
|
||||
"UNTRIAGED"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"results": [
|
||||
{
|
||||
"ruleId": "CVE-2024-4603",
|
||||
"ruleIndex": 0,
|
||||
"level": "none",
|
||||
"message": {
|
||||
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-4603\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-4603](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4603.html)"
|
||||
},
|
||||
"locations": [
|
||||
{
|
||||
"physicalLocation": {
|
||||
"artifactLocation": {
|
||||
"uri": "infr/testcloud2202"
|
||||
}
|
||||
},
|
||||
"message": {
|
||||
"text": "infr/testcloud2202: libssl3t64@3.0.13"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "CVE-2024-5535",
|
||||
"ruleIndex": 1,
|
||||
"level": "none",
|
||||
"message": {
|
||||
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-5535\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-5535](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-5535.html)"
|
||||
},
|
||||
"locations": [
|
||||
{
|
||||
"physicalLocation": {
|
||||
"artifactLocation": {
|
||||
"uri": "infr/testcloud2202"
|
||||
}
|
||||
},
|
||||
"message": {
|
||||
"text": "infr/testcloud2202: libssl3t64@3.0.13"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "CVE-2024-2511",
|
||||
"ruleIndex": 2,
|
||||
"level": "none",
|
||||
"message": {
|
||||
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-2511\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-2511](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-2511.html)"
|
||||
},
|
||||
"locations": [
|
||||
{
|
||||
"physicalLocation": {
|
||||
"artifactLocation": {
|
||||
"uri": "infr/testcloud2202"
|
||||
}
|
||||
},
|
||||
"message": {
|
||||
"text": "infr/testcloud2202: libssl3t64@3.0.13"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "CVE-2024-4741",
|
||||
"ruleIndex": 3,
|
||||
"level": "none",
|
||||
"message": {
|
||||
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-4741\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-4741](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4741.html)"
|
||||
},
|
||||
"locations": [
|
||||
{
|
||||
"physicalLocation": {
|
||||
"artifactLocation": {
|
||||
"uri": "infr/testcloud2202"
|
||||
}
|
||||
},
|
||||
"message": {
|
||||
"text": "infr/testcloud2202: libssl3t64@3.0.13"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"properties": {
|
||||
"imageID": "sha256:a616befefefd567cd27092f0eacaa057e3e9592b3c1c57110800f2a43828994f",
|
||||
"imageName": "infr/testcloud2202",
|
||||
"repoDigests": [
|
||||
"infr/testcloud2202@sha256:a616befefefd567cd27092f0eacaa057e3e9592b3c1c57110800f2a43828994f"
|
||||
],
|
||||
"repoTags": [
|
||||
"infr/testcloud2202:main"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
Reference in New Issue