5 ms·

I can't for the life of me find a list of 210 sudo CVE's. Are you sure this is correct?

pona-a 1y ago
I got it from here [0]. I didn't notice it was a keyword search, so it's an overcount. Thanks for correcting me. Going off its security advisories page [1] and this tracker [2], it seems to be around 43 CVEs, most rated high severity. So the actual rate would be 43 CVE / 430 kLoC = ~0.01 CVE per kLoC, so ~2.65 CVEs for udisks and ~0.2 for pmount. [0] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo [1] https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/ [2] https://security.snyk.io/package/linux/debian%3A10/sudo https://security.snyk.io/package/linux/debian%3A10/sudo
- mrspuratic 1y ago
  You can search by CPE here: https://nvd.nist.gov/products/cpe/search https://nvd.nist.gov/products/cpe/search and search for e.g.: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* cpe:2.3:a:todd_miller:sudo:*:*:*:*:*:*:*:* The above pair are the same "sudo", but split arbitrarily, perhaps varying by assigning authority preference. (There are some other "sudo" named projects too). Those CPE IDs were determined by a brute-force-ish XML grep: xml select -N cpe-23="http://scap.nist.gov/schema/cpe-extension/2.3" -t --match '//cpe-23:cpe23-item' --if 'contains(@name,":sudo:")' -v "@name" -n official-cpe-dictionary_v2.3.xml Now, mapping CVE<->CPE is a tricker problem, it's not 1:1 (a single CVE can affect multiple product versions), and harder here since sudo (1986-ish) predates CVEs (1999) by a decade, and CPE (2009) by two. The most capable searches seem to be via non-free APIs or "vulnerability management $olutions", plus a few CLIs tools that need a lot of care and feeding. This web service is free: https://cve.circl.lu/ https://cve.circl.lu/ But, you cannot search directly by CPE right now; you can start a search by vendor, then filter by product: todd_miller sudo: 58 vulnerabilities sudo_project sudo: 42 vulnerabilities Except, for reasons I don't understand, there are duplicates because they somehow source "unique" but overlapping CVEs from multiple databases. The true number might be 50 combined, of varying severity/concern, but I give up now. I'm going to go mutter into my beard for a while.

I got it from here [0]. I didn't notice it was a keyword search, so it's an overcount. Thanks for correcting me. Going off its security advisories page [1] and this tracker [2], it seems to be around 43 CVEs, most rated high severity. So the actual rate would be 43 CVE / 430 kLoC = ~0.01 CVE per kLoC, so ~2.65 CVEs for udisks and ~0.2 for pmount. [0] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo [1] https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/ [2] https://security.snyk.io/package/linux/debian%3A10/sudo https://security.snyk.io/package/linux/debian%3A10/sudo

mrspuratic 1y ago
You can search by CPE here: https://nvd.nist.gov/products/cpe/search https://nvd.nist.gov/products/cpe/search and search for e.g.: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* cpe:2.3:a:todd_miller:sudo:*:*:*:*:*:*:*:* The above pair are the same "sudo", but split arbitrarily, perhaps varying by assigning authority preference. (There are some other "sudo" named projects too). Those CPE IDs were determined by a brute-force-ish XML grep: xml select -N cpe-23="http://scap.nist.gov/schema/cpe-extension/2.3" -t --match '//cpe-23:cpe23-item' --if 'contains(@name,":sudo:")' -v "@name" -n official-cpe-dictionary_v2.3.xml Now, mapping CVE<->CPE is a tricker problem, it's not 1:1 (a single CVE can affect multiple product versions), and harder here since sudo (1986-ish) predates CVEs (1999) by a decade, and CPE (2009) by two. The most capable searches seem to be via non-free APIs or "vulnerability management $olutions", plus a few CLIs tools that need a lot of care and feeding. This web service is free: https://cve.circl.lu/ https://cve.circl.lu/ But, you cannot search directly by CPE right now; you can start a search by vendor, then filter by product: todd_miller sudo: 58 vulnerabilities sudo_project sudo: 42 vulnerabilities Except, for reasons I don't understand, there are duplicates because they somehow source "unique" but overlapping CVEs from multiple databases. The true number might be 50 combined, of varying severity/concern, but I give up now. I'm going to go mutter into my beard for a while.