Skip to content

Purge Redhat vulnerabilities when the database is updated#7133

Merged
chemamartinez merged 3 commits into4.0.4from
backport-7043-vdt-db
Jan 11, 2021
Merged

Purge Redhat vulnerabilities when the database is updated#7133
chemamartinez merged 3 commits into4.0.4from
backport-7043-vdt-db

Conversation

@chemamartinez
Copy link
Copy Markdown
Contributor

Related issue
#7043

Description

This PR is a backport of the fix added at #7050. It fixes the following:

  • Purge the Redhat vulnerabilities from the CVE database when an updated feed from the Redhat repositories is pulled. It prevents the database to grow with duplicated entries every time the feed was updated.
  • Prevent to insert duplicated CVEs at SQL level.

Tests

  • Compilation without warnings in every supported platform
    • Linux
  • Source installation
  • Review logs syntax and correct language
  • scan-build
  • Unit tests
  • Manual tests

Manual testing

1. Configure Vulnerability Detector to pull Redhat vulnerabilities:

<provider name="redhat">
    <enabled>yes</enabled>
    <os>5</os>
    <os>6</os>
    <os>7</os>
    <os>8</os>
    <update_interval>1h</update_interval>
</provider>

2. Run Vulnerability Detector and wait until the DB has been populated.
3. Stop the Wazuh manager.
4. Modify the feed's timestamp sqlite3 /var/ossec/queue/vulnerabilities/cve.db "UPDATE metadata set TIMESTAMP='2010-10-31T20:46:48' WHERE TARGET like 'RHEL%';" to force an update
5. Restart the manager.
6. Once the vulnerabilities are updated, check the number of Redhat vulnerabilities. sqlite3 /var/ossec/queue/vulnerabilities/cve.db "select count(*),TARGET from vulnerabilities group by TARGET;"

Copy link
Copy Markdown
Member

@vikman90 vikman90 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@chemamartinez chemamartinez merged commit 399b02d into 4.0.4 Jan 11, 2021
@chemamartinez chemamartinez deleted the backport-7043-vdt-db branch January 11, 2021 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants