vulncheck
0b71453c48
Comments across the codebase credited one individual by role and, in places, described that person's own machines: which SQL Server versions a host ran, which devices were enrolled, what a particular dashboard showed, how many findings sat open on which server. In a public repository that reads as a profile of someone's unpatched estate. The observations are why the code looks the way it does, so they stay. Every CVE id, version, build number, count and date is preserved, as are the verbatim quotes that motivated specific sort and filter rules — only the attribution changes, to "field report", "observed", "a host". A local variable in tests/test_autodesk_year.py was renamed for the same reason; its value and every assertion around it are byte-identical. PROJECT_OVERVIEW.md additionally loses a subtitle naming the kind of organisation this was built for, and a support section pointing at an internal team, both replaced with neutral wording. Comments, docstrings and markdown prose only: 74 files, 200 lines, one-for-one swaps. detect_changes reports 104 touched symbols and zero affected execution flows, and all 55 test scripts pass. Nothing here needs re-testing.
69 lines
2.5 KiB
Python
69 lines
2.5 KiB
Python
"""Adobe changed its version scheme; both spellings must still be judged right.
|
|
|
|
Acrobat/Reader DC shipped as 2019.010.20098 until the 2020 release and as
|
|
20.001.30005 / 26.001.21771 after it. NVD writes the pre-2020 bounds without
|
|
the century, cvelistV5 with it, so the two forms meet in every comparison.
|
|
Read as plain numbers 26 < 2019, and CVE-2019-7819 sat open on 18 hosts.
|
|
"""
|
|
import sys
|
|
import os
|
|
|
|
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
|
|
|
|
from app.services.app_cve_scanner_service import _vcmp, _vtuple # noqa: E402
|
|
from app.services.cvelistv5_scan_service import ( # noqa: E402
|
|
_affected, _ranges_from_affected)
|
|
|
|
|
|
# CVE-2019-7819 as cvelistV5 states it: "0" up to and including 2019.010.20098.
|
|
CVE_2019_7819 = {
|
|
"vendor": "Adobe", "product": "Acrobat Reader", "defaultStatus": "unaffected",
|
|
"versions": [{"version": "0", "lessThanOrEqual": "2019.010.20098",
|
|
"versionType": "semver", "status": "affected"}],
|
|
}
|
|
|
|
|
|
def _hit(installed, aff=CVE_2019_7819):
|
|
return any(_affected(installed, s, lt, lte)
|
|
for s, lt, lte in _ranges_from_affected(aff))
|
|
|
|
|
|
def test_both_spellings_are_the_same_build():
|
|
assert _vtuple("2019.010.20098") == _vtuple("19.010.20098")
|
|
assert _vcmp("2019.010.20098", "19.010.20098") == 0
|
|
|
|
|
|
def test_current_acrobat_is_not_affected_by_a_2019_cve():
|
|
# The reported false positives, verbatim from a field inventory.
|
|
assert not _hit("26.001.21771") # Adobe Acrobat (64-bit)
|
|
assert not _hit("26.001.21662") # same, older host
|
|
assert not _hit("19.012.20035") # Acrobat Reader DC - Deutsch, patched
|
|
assert not _hit("23.008.20421") # 2023 build
|
|
|
|
|
|
def test_genuinely_old_acrobat_is_still_affected():
|
|
for old in ("19.010.20098", "2019.010.20098", "19.008.20081",
|
|
"15.006.30482", "17.011.30127"):
|
|
assert _hit(old), old
|
|
|
|
|
|
def test_ordering_inside_the_old_scheme_survives():
|
|
# The rewrite must not reorder anything within one scheme.
|
|
assert _vcmp("2019.010.20098", "2020.001.30005") < 0
|
|
assert _vcmp("2019.008.20081", "2019.010.20098") < 0
|
|
|
|
|
|
def test_release_years_are_left_alone():
|
|
# Autodesk versions ARE years — rewriting them would break every range.
|
|
assert _vtuple("2026") == (2026,)
|
|
assert _vtuple("2026.0.0") == (2026, 0, 0)
|
|
assert _vcmp("2026.1", "2027") < 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
for name, fn in sorted(globals().items()):
|
|
if name.startswith("test_"):
|
|
fn()
|
|
print(f"ok {name}")
|
|
print("\nall green")
|