Hide CVE for packages yet to be fixed upstream

[vpetersson]

We need to filter out CVEs where there is no fix available upstream. We've had a few situations where users complain about them because they are unactionable.

Later on, I want to introduce a filter mechanism in the interface that allows users to perform more granular views, including to include these unfixed these issues.

[a-martynovich]

There may be cases when some packages affected by a CVE have fixes for, let's say, Debian, but not for Ubuntu. How can we filter out a CVE if it was fixed in one distro and wasn't fixed on another?

[vpetersson]

I don't know exactly how we solve this, but I do know that users don't want to see RAs or CVEs that they cannot take action on. Hence we need to figure this out, as it is part of our "secret sauce."

One ugly solution would be to simply crawl/index the apt repositories for the latest version of package X, and compare it to the the affected version.

[a-martynovich]

@vpetersson We have all the data. We know if a fix is available or not.
However, suppose the user has two nodes, one is Debian, another is Ubuntu. Suppose a package named random is installed on both of them. Suppose it's vulnerable to CVE-xxx on both nodes, and the fix for it is available in Ubuntu, but not in Debian. Should we display CVE-xxx or not? Should we display package random or not? Should we adjust the "Nodes Affected" list for it (which may be incorrect in this case)?

[vpetersson]

Suppose it's vulnerable to CVE-xxx on both nodes, and the fix for it is available in Ubuntu, but not in Debian. Should we display CVE-xxx or not?

That's a good question. I'd consider it an edge case, but in such case, I would display it, but filter out the Debian node from the list.

[a-martynovich]

@vpetersson Right now I'm positive that there's no change needed in the current implementation. I thought there was a bug somewhere, but in the case which I've given above the nodes which have no fixes for a CVE are not displayed, I designed it this way initially. I wrote this as a test case and the test passes.

Please provide some real data or at least screenshots which can prove me wrong.

[vpetersson]

So it appears as the implementation is correct, and we just need to filter out unused kernels (and related packages). Hence, the implementation would have to hide all kernels that are vulnerable but not active. I.e. we need to check the kernel version running in the agent.

[a-martynovich]

@vpetersson As I have already mentioned on Slack, this is not an easy task, and we might need to write bistro-specific logic. I estimate it to take 2d at least.

[vpetersson]

Yeah, i recall the discussion. Maybe we should just apply the Pareto principle and do a quick regex that solves 80% of them. If we do a match of linux*X*, where X is is a negative regex for the currently running kernel seems to work for Debian/Ubuntu, and kernel*X* appears to match for the RedHat world.