vulncheck/vulncheck
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(aruba): map "(AOS-10 & AOS-8)" to aruba-os, mark the Instant AP record reviewed

Browse Source 
The 17.10 Netdisco run ended "1 ERR": the spelling guard from 89800c5c
found three HPE names no Aruba key knew. Two causes:

"HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)"
(CVE-2026-23601, -23808, -23809) is the controller line, the same
product as CVE-2026-23812's "(AOS-8 & AOS-10)" with the generations in
the other order. The pattern only knew that order, so no controller
got these three CVEs. The aruba-os product_re now takes both.

"HPE/Hpe Aruba Networking InstantOS and Aruba Access Points running
ArubaOS 10" (CVE-2024-42393..42396) is Instant AP firmware, bounded at
8.10/8.12, which are controller build numbers too; HPE says controllers
are not affected. Mapping it would put findings on the wrong box, so it
goes into _ARUBA_KNOWN_UNMATCHED (lowercase covers both spellings).

The test builds these two records in an index of their own: their
ranges overlap CVE-2026-44857's builds that the shared fixture asserts on.
This commit is contained in:
vulncheck
2026-10-17 11:59:15 +02:00
parent 697360a093
commit d78baeaf93
2 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/services/cvelistv5_scan_service.py
+6 -1
View File
@@ -619,6 +619,7 @@ _PRODUCT_PATTERNS: List[dict] = [
# Devices" (CVE-2022-23677) and "AOS-Switch (AOS-S)" (CVE-2026-76742 ff.,
# HPESBNW05156); "HPE Aruba Networking Wireless Operating System (AOS)"
# (CVE-2026-44857), "... Systems (AOS-8 & AOS-10)" (CVE-2026-23812),
# "... System (AOS-10 & AOS-8)" (CVE-2026-23601, -23808, -23809),
# "ArubaOS (AOS)" (CVE-2026-23821) and "HPE Aruba Networking AOS"
# (CVE-2025-23051). HPE renames the product between batches, and an
# unknown spelling is a silent false negative: the 2026-10 AOS-S batch is
@@ -647,7 +648,7 @@ _PRODUCT_PATTERNS: List[dict] = [
"product_re": r"^(arubaos(\s+\(aos\))?|aruba\s+os|aos-w|"
r"(hpe\s+)?aruba\s+networking\s+aos|"
r"(hpe\s+)?aruba\s+networking\s+wireless\s+operating\s+"
r"systems?\s+\(aos(-8\s*&\s*aos-10)?\)|"
r"systems?\s+\(aos(-8\s*&\s*aos-10|-10\s*&\s*aos-8)?\)|"
# The 2022-2024 controller records name the hardware, and
# state each branch as prose (see aruba_switch_entries).
r"aruba\s+mobility\s+conductor\s+\(formerly\s+mobility\s+"
@@ -2546,6 +2547,10 @@ _ARUBA_KNOWN_UNMATCHED = frozenset({
"aos-8 instant and aos-10 ap",
"aruba access points running instantos and arubaos 10",
"hpe aruba networking access points, instant aos-8, and aos-10",
# CVE-2024-42393..42396: Instant AP firmware, bounded 8.10/8.12 — the
# controllers' numbers too, so mapping it to aruba-os would be a finding
# on the wrong box. HPE writes it "HPE" and "Hpe"; lowercase covers both.
"hpe aruba networking instantos and aruba access points running arubaos 10",
# CVE-2023-38484..38486: NVD carries them under arubanetworks:arubaos.
"9200 series mobility controllers and sd-wan gateways, 9000 series "
"mobility controllers and sd-wan gateways",
tests/test_aruba_firmware.py
+30 -2
View File
@@ -237,6 +237,27 @@ KNOWN_AP = [
"versions": [{"lessThanOrEqual": "10.7.1.0", "status": "affected",
"version": "10.7.0.0", "versionType": "semver"}]},
]
# CVE-2026-23601, verbatim affected[]: the controller line again, with the
# AOS generations named in the OTHER order than CVE-2026-23812 does.
AOS_23601 = [
{"product": "HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{"status": "affected", "version": "10.7.0.0", "lessThanOrEqual": "10.7.2.2",
"versionType": "semver"},
{"status": "affected", "version": "8.13.0.0", "lessThanOrEqual": "8.13.1.1",
"versionType": "semver"}]},
]
# CVE-2024-42394, verbatim: Instant AP firmware. Its 8.10/8.12 numbers are the
# controllers' numbers too, so it must stay out of aruba-os — and quiet.
INSTANT_42394 = [
{"product": "HPE Aruba Networking InstantOS and Aruba Access Points running "
"ArubaOS 10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [{"lessThanOrEqual": "<=8.12.0.1", "status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"}]},
]
# Must NOT enter the index: HPE files the whole Aruba management stack under
# the same vendor, and every one of those carries a version line that would
@@ -290,12 +311,12 @@ class FakeAsset:
self.os_version = os_version
def _build_index():
def _build_index(records=RECORDS):
"""Run the REAL index build over a ZIP shaped like cvelistV5's."""
fd, path = tempfile.mkstemp(suffix=".zip")
os.close(fd)
with zipfile.ZipFile(path, "w") as zf:
for cve, affected in RECORDS.items():
for cve, affected in records.items():
zf.writestr(
f"cvelistV5-main/cves/{cve.split('-')[1]}/x/{cve}.json",
json.dumps({"cveMetadata": {"cveId": cve},
@@ -474,6 +495,13 @@ def demo():
assert note and "HPE Aruba Networking AOS-CX Switch Series" in note, note
assert "CVE-2026-99991" in note
assert "AOS-10 AP" not in note and "ClearPass" not in note, note
# "(AOS-10 & AOS-8)" is the controller line; the Instant AP record is not,
# and neither name is news. Own build: their branches are 44857's builds.
idx = _build_index({"CVE-2026-23601": AOS_23601, "CVE-2024-42394": INSTANT_42394})
assert c5.aruba_unmatched_note() is None
assert [c for c, *_ in _scan(idx, "8.13.1.0", "ArubaOS")] == ["CVE-2026-23601"]
assert _scan(idx, "8.13.1.2", "ArubaOS") == []
assert "CVE-2024-42394" not in {e["cve"] for k in idx for e in idx[k]}
# --- ArubaOS-Switch: the prose bounds ---------------------------------
# A switch that has NOT been updated: inside both 16.11 prose bounds.