vulncheck
7078f5e024
A hypervisor runs no agent. Wazuh cannot reach it, Intune does not know it,
and Nessus only sees it if someone scoped a credentialed scan at it — so the
machines whose compromise takes every VM on them down were the ones with no
vulnerability coverage at all.
The connector reads the vCenter appliance and every ESXi host in its
inventory over the vSphere SOAP API (pyVmomi): hostname, management IP,
hardware model, product version and BUILD. One PropertyCollector pass, so a
500-host estate is one round trip. Read-only rights are enough.
The build is the point. NVD carries nothing usable — CVE-2026-47876 and
CVE-2026-59310 both sit there with no configuration — and the bounds
cvelistV5 does state are build identifiers, not versions:
ESX 8.0 lessThan "ESXi80U3k-25595708"
vCenter 8.0 lessThan "8.0 U3k"
_is_version rejects both, so _ranges_from_affected dropped the entries and
every vSphere CVE was invisible. They are now indexed verbatim and resolved
to build numbers: ESXi bounds carry one inline, vCenter bounds name a release
whose build comes from Broadcom KB 326316 (seeded in full, re-read weekly,
merged never replaced). A bound that resolves to no build produces no
verdict, and neither does a host with no build recorded.
Comparing builds alone is wrong in both directions. CVE-2025-22224 names two
fixes for the 8.0 line at once — U3d (24585383) for 8.0.3 and U2d (24585300)
for 8.0.2 — so the U2d host is patched despite the higher number existing.
And vCenter 8.0 U2f shipped four days AFTER the U3k fix on the older update
line, with a higher build, because Broadcom ships async patches there. So the
decision is scoped to the update line first, then still checked against the
build.
What must never resolve is asserted in the tests: the same advisories file
"VMware Cloud Foundation (vCenter Server)" and "vSphere Foundation" with the
SUITE's version numbers, and matching those would compare a vCenter 8.0.3
appliance against a VCF 5.x range.
EOL comes from endoflife.date (esxi / vcenter), keyed by major line — which
is also the honest granularity, one end-of-support date per line. 7.0 ended
2025-10-02, 6.7/6.5 in 2022. Both slugs are single-release, so an upgrade
retires the old finding. The OS patterns are shared with the CVE pass so a
machine cannot be a hypervisor for its CVEs and something else for its dates.
Checked against all 189 vSphere CVE records currently in cvelistV5: 64 bounds
indexed, none unresolvable, and every current release comes out clean while
each one behind gets its own line's fix named.
Migration 045 adds AssetSource.VCENTER, assets.vmware_uuid (the pin) and
assets.vmware_build.
77 lines
2.1 KiB
Plaintext
77 lines
2.1 KiB
Plaintext
# VulnManager Dependencies (Python 3.13 kompatibel)
|
|
|
|
# FastAPI & Server
|
|
# fastapi 0.115.6 hat starlette auf <0.42 festgenagelt — und genau dort
|
|
# hingen 14 Advisories. Die Starlette-Aktualisierung geht nur über fastapi.
|
|
fastapi==0.141.1
|
|
uvicorn[standard]==0.32.1
|
|
python-multipart==0.0.32
|
|
|
|
# Database
|
|
sqlalchemy==2.0.36
|
|
alembic==1.14.0
|
|
psycopg2-binary==2.9.10 # Updated für Python 3.13
|
|
|
|
# Authentication & Security
|
|
pyjwt[crypto]==2.13.0
|
|
bcrypt==5.0.0 # direkt genutzt (app/auth/jwt_handler.py); passlib ist raus
|
|
|
|
# HTTP Clients
|
|
httpx==0.28.1 # Updated
|
|
tenacity==9.0.0 # Updated
|
|
|
|
# Rate Limiting
|
|
slowapi==0.1.9
|
|
|
|
# Validation
|
|
pydantic==2.10.5 # Updated für Python 3.13
|
|
pydantic-settings==2.7.1 # Updated
|
|
email-validator==2.2.0 # Updated
|
|
|
|
# Scheduling
|
|
apscheduler==3.10.4
|
|
|
|
# Environment
|
|
python-dotenv==1.2.2
|
|
|
|
# Logging & Monitoring (optional)
|
|
python-json-logger==3.2.1 # Updated
|
|
|
|
# Testing (Development)
|
|
pytest==9.1.1
|
|
pytest-asyncio==1.4.0 # verlangt pytest>=8.4
|
|
|
|
# Reporting
|
|
reportlab==4.4.9
|
|
|
|
# ============================================
|
|
# Multi-provider authentication (Phase 1: foundation; Phase 2+: LDAP/OIDC/SAML)
|
|
# ============================================
|
|
# TOTP / MFA
|
|
pyotp==2.9.0
|
|
# Fernet for encrypting LDAP bind-pw + TOTP secrets at rest
|
|
cryptography==50.0.0
|
|
|
|
# LDAPS (Phase 2)
|
|
ldap3==2.9.1
|
|
|
|
# OAuth2 / OIDC (Phase 3)
|
|
authlib==1.7.2
|
|
itsdangerous==2.2.0
|
|
|
|
# SAML 2.0 (Phase 4) — requires system libs xmlsec1, libxml2-dev, libxmlsec1-dev
|
|
python3-saml==1.16.0
|
|
# lxml parst hier NICHT die Advisory-Feeds (die laufen über stdlib
|
|
# xml.etree.ElementTree), sondern Microsoft-HTML in m365_service.py.
|
|
lxml==6.1.1
|
|
|
|
# Microsoft product-lifecycle EOL export parsing (Plan O) — reads the
|
|
# monthly eos-product-listing .xlsx from download.microsoft.com.
|
|
openpyxl==3.1.5
|
|
|
|
# VMware vSphere inventory (vCenter connector). Broadcom's own SDK, and the
|
|
# only practical way to read a per-host BUILD number: the vCenter REST API's
|
|
# /api/vcenter/host returns name and power state and no version at all, while
|
|
# every VMware advisory states its fix as a build ("ESXi80U3k-25595708").
|
|
pyvmomi==9.1.0.0
|