漏洞数据

  2 分钟阅读  

简要概述

漏洞数据的来源，数据库的下载与制作。

数据库下载

通过 trivy 下载漏洞库

各组件安全漏洞列表已由工具 trivy-db 通过 GitHub Action 每 6 小时聚合并更新漏洞库，上传至 GHCR（为 GitHub 镜像中心服务），我们可同步该漏洞库用于离线扫描镜像、K8S 集群、本地文件系统等。

通过 trivy 工具下载至本地缓存，取保网络连接可达：

# 线路加速，根据事情情况是否开启
#export HTTPS_PROXY=http://127.0.0.1:1087

trivy --cache-dir ./cache image --download-db-only

制作私有漏洞库

TODO;

思路：

  1. 获取仓库 https://github.com/aquasecurity/trivy-db.git
  2. 更改流水线 .github/workflows/cron.yml
  3. 生成漏洞库上传至内部存储中心

漏洞数据来源

操作系统

名称漏洞库地址
Alpine Linuxsecdbhttps://secdb.alpinelinux.org/
aquasecurityhttps://github.com/aquasecurity/vuln-list
DebianSecurity Bug Trackerhttps://security-tracker.debian.org/tracker/
OVALhttps://www.debian.org/security/oval/
aquasecurityhttps://github.com/aquasecurity/vuln-list-debian
UbuntuUbuntu CVE Trackerhttps://ubuntu.com/security/cve
aquasecurityhttps://github.com/aquasecurity/vuln-list
RHEL/CentOSOVALhttps://www.redhat.com/security/data/oval/v2/
Security Datahttps://www.redhat.com/security/data/metrics/
aquasecurityhttps://github.com/aquasecurity/vuln-list-redhat
Arch LinuxVulnerable Issueshttps://security.archlinux.org/
Wolfi Linuxsecdbhttps://secdb.alpinelinux.org/
Chainguardsecdbhttps://secdb.alpinelinux.org/
Amazon LinuxAmazon Linux Security Centerhttps://alas.aws.amazon.com/
AlmaLinuxAlmaLinux Product Erratahttps://errata.almalinux.org/
Rocky LinuxRocky Linux UpdateInfohttps://download.rockylinux.org/pub/rocky/
Oracle LinuxOVALhttps://linux.oracle.com/security/oval/
CBL-MarinerOVALhttps://github.com/microsoft/CBL-MarinerVulnerabilityData/
OpenSUSE/SLESCVRFhttp://ftp.suse.com/pub/projects/security/cvrf/
Photon OSPhoton Security Advisoryhttps://packages.vmware.com/photon/photon_cve_metadata/

语言框架

名称漏洞库地址
PHPPHP Security Advisories Databasehttps://github.com/FriendsOfPHP/security-advisories
GitHub Advisory Database (Composer)https://github.com/advisories?query=ecosystem%3Acomposer
PythonGitHub Advisory Database (pip)https://github.com/advisories?query=ecosystem%3Apip
Open Source Vulnerabilities (PyPI)https://osv.dev/list?q=&ecosystem=PyPI
RubyRuby Advisory Databasehttps://github.com/rubysec/ruby-advisory-db
GitHub Advisory Database (RubyGems)https://github.com/advisories?query=ecosystem%3Arubygems
Node.jsEcosystem Security Working Grouphttps://github.com/nodejs/security-wg
GitHub Advisory Database (npm)https://github.com/advisories?query=ecosystem%3Anpm
JavaGitHub Advisory Database (Maven)https://github.com/advisories?query=ecosystem%3Amaven
GoGitHub Advisory Database (Go)https://github.com/advisories?query=ecosystem%3Ago
RustOpen Source Vulnerabilities (crates.io)https://osv.dev/list?q=&ecosystem=crates.io
.NETGitHub Advisory Database (NuGet)https://github.com/advisories?query=ecosystem%3Anuget
C/C++GitLab Advisories Communityhttps://gitlab.com/gitlab-org/advisories-community
DartGitHub Advisory Database (Pub)https://github.com/advisories?query=ecosystem%3Apub
ElixirGitHub Advisory Database (Erlang)https://github.com/advisories?query=ecosystem%3Aerlang
SwiftGitHub Advisory Database (Swift)https://github.com/advisories?query=ecosystem%3Aswift

Kubernetes

名称漏洞库地址
Bitnamibitnamihttps://github.com/bitnami/vulndb
KubernetesCVE feedhttps://kubernetes.io/docs/reference/issues-security/official-cve-feed/
aquasecurityhttps://github.com/aquasecurity/vuln-list-k8s

其他来源

名称漏洞库地址
GitHubGitHubhttps://github.com/github/advisory-database
NVDNVDhttps://nvd.nist.gov/
aquasecurityhttps://github.com/aquasecurity/vuln-list-nvd
CocoaPodsCocoaPodshttps://github.com/CocoaPods/Specs

使用 bbolt 存储的数据结构

获取 buckets 列表

$ bbolt buckets assets/trivy.db
$
...
pub::GitHub Security Advisory Pub
rocky 8
rocky 9
rubygems::GitHub Security Advisory RubyGems
...
ubuntu 22.04
...
vulnerability
wolfi
$

查找 buckets 下的 keys

$ bbolt keys assets/trivy.db vulnerability
$
CVE-1234-0007
CVE-1234-1234
CVE-1999-0150
CVE-1999-0163
CVE-1999-0199
CVE-1999-0236
...
openSUSE-SU-2023:0396-1
openSUSE-SU-2023:0397-1
openSUSE-SU-2023:0404-1
openSUSE-SU-2023:0405-1

获取 buckets 下 key 内容

$ bbolt get assets/trivy.db vulnerability CVE-1999-0150

{
    "Title": "CVE-1999-0150 affecting package finger 0.17-4",
    "Description": "The Perl fingerd program allows arbitrary command execution from remote users.",
    "Severity": "HIGH",
    "VendorSeverity": {
        "cbl-mariner": 3,
        "nvd": 3
    },
    "CVSS": {
        "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
        }
    },
    "References": [
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0150",
        "https://nvd.nist.gov/vuln/detail/CVE-1999-0150"
    ],
    "PublishedDate": "1997-07-01T04:00:00Z",
    "LastModifiedDate": "2022-08-17T07:15:00Z"
}

几个关键的 buckets

  • 漏洞官方数据来源
data-source

$ bbolt get assets/trivy.db data-source "k8s::Official Kubernetes CVE Feed"

{
    "ID": "k8s",
    "Name": "Official Kubernetes CVE Feed",
    "URL": "https://kubernetes.io/docs/reference/issues-security/official-cve-feed/index.json"
}


最后修改 2024.01.05: docs: 添加 falco 内容 (b084241)