From 4a15208b84d480ec3135b39c87b59234232e8d51 Mon Sep 17 00:00:00 2001 From: Hans-Christoph Steiner Date: Thu, 6 Jul 2017 13:25:14 +0200 Subject: [PATCH] update: update openssl KnownVuln scan to handle all recent versions Thanks to @bubu for reporting! --- fdroidserver/update.py | 5 +++-- tests/openssl-version-check-test.py | 31 +++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 2 deletions(-) create mode 100755 tests/openssl-version-check-test.py diff --git a/fdroidserver/update.py b/fdroidserver/update.py index 286a5510..f554987b 100644 --- a/fdroidserver/update.py +++ b/fdroidserver/update.py @@ -513,8 +513,9 @@ def has_known_vulnerability(filename): m = has_known_vulnerability.pattern.search(chunk) if m: version = m.group(1).decode('ascii') - if version.startswith('1.0.1') and version[5] >= 'r' \ - or version.startswith('1.0.2') and version[5] >= 'f': + if (version.startswith('1.0.1') and len(version) > 5 and version[5] >= 'r') \ + or (version.startswith('1.0.2') and len(version) > 5 and version[5] >= 'f') \ + or re.match(r'[1-9]\.[1-9]\.[0-9].*', version): logging.debug('"%s" contains recent %s (%s)', filename, name, version) else: logging.warning('"%s" contains outdated %s (%s)', filename, name, version) diff --git a/tests/openssl-version-check-test.py b/tests/openssl-version-check-test.py new file mode 100755 index 00000000..69d4d1ce --- /dev/null +++ b/tests/openssl-version-check-test.py @@ -0,0 +1,31 @@ +#!/usr/bin/env python3 +# +# implementing a version check of known bad OpenSSL versions, for example: +# https://support.google.com/faqs/answer/6376725?hl=en +# +# This is used in update.has_known_vulnerability() + +import re +import requests + +# this list was generated using: +# for f in `curl | grep -Eo '[0-9]\.[0-9]\.[0-9][a-z]?' | sort -u`; do echo "'$f',"; done +versions = [ +] + +r = requests.get('https://www.openssl.org/news/changelog.html') + +safe = set() +bad = set() + +for m in re.findall(b'[0-9]\.[0-9]\.[0-9][a-z]?', r.content): + version = str(m, encoding='utf-8') + if (version.startswith('1.0.1') and len(version) > 5 and version[5] >= 'r') \ + or (version.startswith('1.0.2') and len(version) > 5 and version[5] >= 'f') \ + or re.match(r'[1-9]\.[1-9]\.[0-9].*', version): + safe.add(version) + else: + bad.add(version) + +print('safe:', sorted(safe)) +print('bad:', sorted(bad))