From ff74e2a1bc7f3bf723760dbefc926fab261450b3 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Wed, 21 Apr 2021 23:49:59 +0200 Subject: cve: Gracefully handle bogus CVE entries. Fixes . Reported by Jack Hill . * guix/cve.scm (reference-data->cve-references): Gracefully handle lack of "reference_data". (cpe-match->cve-configuration): Gracefully handle lack of "cpe23Uri". --- guix/cve.scm | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/guix/cve.scm b/guix/cve.scm index b3a8b13a06..9e1cf5b587 100644 --- a/guix/cve.scm +++ b/guix/cve.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès +;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021 Ludovic Courtès ;;; ;;; This file is part of GNU Guix. ;;; @@ -99,7 +99,9 @@ (define (reference-data->cve-references alist) (map json->cve-reference - (vector->list (assoc-ref alist "reference_data")))) + ;; Normally "reference_data" is always present but rejected CVEs such + ;; as CVE-2020-10020 can lack it. + (vector->list (or (assoc-ref alist "reference_data") '#())))) (define %cpe-package-rx ;; For applications: "cpe:2.3:a:VENDOR:PACKAGE:VERSION", or sometimes @@ -137,17 +139,20 @@ package." (starte (assoc-ref alist "versionStartExcluding")) (endi (assoc-ref alist "versionEndIncluding")) (ende (assoc-ref alist "versionEndExcluding"))) - (let-values (((package version) (cpe->package-name cpe))) - (and package - `(,package - ,(cond ((and (or starti starte) (or endi ende)) - `(and ,(if starti `(>= ,starti) `(> ,starte)) - ,(if endi `(<= ,endi) `(< ,ende)))) - (starti `(>= ,starti)) - (starte `(> ,starte)) - (endi `(<= ,endi)) - (ende `(< ,ende)) - (else version))))))) + ;; Normally "cpe23Uri" is here in each "cpe_match" item, but CVE-2020-0534 + ;; has a configuration that lacks it. + (and cpe + (let-values (((package version) (cpe->package-name cpe))) + (and package + `(,package + ,(cond ((and (or starti starte) (or endi ende)) + `(and ,(if starti `(>= ,starti) `(> ,starte)) + ,(if endi `(<= ,endi) `(< ,ende)))) + (starti `(>= ,starti)) + (starte `(> ,starte)) + (endi `(<= ,endi)) + (ende `(< ,ende)) + (else version)))))))) (define (configuration-data->cve-configurations alist) "Given ALIST, a JSON dictionary for the baroque \"configurations\" -- cgit 1.4.1