Merge ~alexmurray/ubuntu-cve-tracker:fix-lp-2012327 into ubuntu-cve-tracker:master

[Alex Murray]

Fixes LP: #2012327

[amurray:~/ubuntu … ubuntu-cve-tracker] fix-lp-2012327(+1/-0)+* 130 ± unset CHECK_CVES_EXPERIMENTAL; ./scripts/check-cves --cve CVE-2021-46877 nvdcve-1.1-2021.json
Loading /home/amurray/ubuntu/git/security-tracker//data/CVE/list ...
Loading nvdcve-1.1-2021.json ...
 97% [=============================================== ] 130438317 ETA: 0:00:00

***********************************************************************
 CVE-2021-46877 (1/2: 50%)
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46877
***********************************************************************
 Published: 2023-03-18 22:15:00 UTC
 MISC: https://github.com/FasterXML/jackson-databind/issues/3328
 MISC: https://groups.google.com/g/jackson-user/c/OsBsirPM_Vw

======================== CVE details ==========================
 CVE-2021-46877
 jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

======================= Debian details ========================
 Debian CVE Tracker: FOUND
 NOTE: https://groups.google.com/g/jackson-user/c/OsBsirPM_Vw
 NOTE: https://github.com/FasterXML/jackson-databind/issues/3328
 NOTE: https://github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb (jackson-databind-2.12.6)
 NOTE: https://github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb (jackson-databind-3.13.1)
  Debian: jackson-databind: 2.13.2.2-1 (needs-triage)
    Ubuntu: jackson-databind | 2.9.8-1~18.04 | bionic-updates/universe
    Ubuntu: jackson-databind | 2.10.2-1 | focal/universe
    Ubuntu: jackson-databind | 2.13.0-2 | jammy/universe
    Ubuntu: jackson-databind | 2.13.2.2-1 | kinetic/universe
    Ubuntu: jackson-databind | 2.14.0-1 | lunar/universe

A]dd (or R]epeat), I]gnore forever, S]kip for now, or Q]uit? [add]
Package(s) affected? [jackson-databind]
Waiting for Emacs...

===================== Dependant packages ======================
 Detecting packages built using: jackson-databind...^P^Pnone detected

============================ Triage summary =============================

    1 CVEs added
    0 CVEs ignored
    0 CVEs skipped
---------------------------
    1 total CVEs triaged

====================== External updates detected ========================

 /home/amurray/ubuntu/git/ubuntu-cve-tracker/embargoed
 ?? pyrightconfig.json

 Please remember to push the above changes if appropriate
[amurray:~/ubuntu … ubuntu-cve-tracker] fix-lp-2012327(+2/-0)+* 34s ± cat active/CVE-2021-46877
Candidate: CVE-2021-46877
PublicDate: 2023-03-21
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46877
 https://groups.google.com/g/jackson-user/c/OsBsirPM_Vw
 https://github.com/FasterXML/jackson-databind/issues/3328
 https://github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb (jackson-databind-2.12.6)
 https://github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb (jackson-databind-3.13.1)
Description:
 jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before
 2.13.1 allows attackers to cause a denial of service (2 GB transient heap
 usage per read) in uncommon situations involving JsonNode JDK
 serialization.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: untriaged
Discovered-by:
Assigned-to:
CVSS:

Patches_jackson-databind:
upstream_jackson-databind: released (2.13.2.2-1)
trusty_jackson-databind: ignored (out of standard support)
trusty/esm_jackson-databind: needs-triage
xenial_jackson-databind: ignored (out of standard support)
esm-apps/xenial_jackson-databind: needs-triage
bionic_jackson-databind: needs-triage
esm-apps/bionic_jackson-databind: needs-triage
focal_jackson-databind: needs-triage
esm-apps/focal_jackson-databind: needs-triage
jammy_jackson-databind: needs-triage
esm-apps/jammy_jackson-databind: needs-triage
kinetic_jackson-databind: not-affected (2.13.2.2-1)
devel_jackson-databind: not-affected

[Steve Beattie (sbeattie)]

LGTM, and thanks for adding to the tests, appreciated!

review: Approve

diff --git a/scripts/active_edit b/scripts/active_edit
index 87d6fcc..43a3804 100755
--- a/scripts/active_edit
+++ b/scripts/active_edit
@@ -89,7 +89,7 @@ def _add_pkg(p, fp, fixed, parent, embargoed):
             fixed_in_release = fixed[p][1]
         if len(fixed[p]) > 2:
             fixed_in_release_version = fixed[p][2]
-    for rel in ['upstream'] + list(source.keys()):
+    for rel in ['upstream'] + cve_lib.release_sort(list(source.keys())):
         aliases = source_map.get_aliases_of_ubuntu_package(source, p, rel)
         pkgs_from_generic = source_map.get_packages_from_generic_name(source, p, rel)
         # determine default state but override this if pkg_db has a
diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index e10fb9d..0429f71 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -107,7 +107,6 @@ subprojects = {
         "ppa": "ubuntu-esm/esm/ubuntu",
         "parent": "ubuntu/precise",
         "description": "Available with UA Infra or UA Desktop: https://ubuntu.com/advantage",
-        "stamp": 1493521200,
     },
     "esm/trusty": {
         "eol": False,
@@ -119,7 +118,6 @@ subprojects = {
         "ppa": "ubuntu-esm/esm-infra-security/ubuntu",
         "parent": "ubuntu/trusty",
         "description": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
-        "stamp": 1556593200,
     },
     "esm-infra/xenial": {
         "eol": False,
@@ -131,7 +129,6 @@ subprojects = {
         "ppa": "ubuntu-esm/esm-infra-security/ubuntu",
         "parent": "ubuntu/xenial",
         "description": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
-        "stamp": 1618963200,
     },
     "esm-apps/xenial": {
         "eol": False,
@@ -143,7 +140,6 @@ subprojects = {
         "ppa": "ubuntu-esm/esm-apps-security/ubuntu",
         "parent": "esm-infra/xenial",
         "description": "Available with Ubuntu Pro: https://ubuntu.com/pro",
-        "stamp": 1618963200,
     },
     "esm-apps/bionic": {
         "eol": False,
@@ -155,7 +151,6 @@ subprojects = {
         "ppa": "ubuntu-esm/esm-apps-security/ubuntu",
         "parent": "ubuntu/bionic",
         "description": "Available with Ubuntu Pro: https://ubuntu.com/pro",
-        "stamp": 1524870000,
     },
     "esm-apps/focal": {
         "eol": False,
@@ -167,7 +162,6 @@ subprojects = {
         "ppa": "ubuntu-esm/esm-apps-security/ubuntu",
         "parent": "ubuntu/focal",
         "description": "Available with Ubuntu Pro: https://ubuntu.com/pro",
-        "stamp": 1587567600,
     },
     "esm-apps/jammy": {
         "eol": False,
@@ -179,7 +173,6 @@ subprojects = {
         "ppa": "ubuntu-esm/esm-apps-security/ubuntu",
         "parent": "ubuntu/jammy",
         "description": "Available with Ubuntu Pro: https://ubuntu.com/pro",
-        "stamp": 1650693600,
     },
     "fips/xenial": {
         "eol": False,
@@ -251,7 +244,6 @@ subprojects = {
         "ppa": "ubuntu-robotics-packagers/ros-security/ubuntu",
         "parent": "ubuntu/xenial",
         "description": "Available with Ubuntu Advantage: https://ubuntu.com/advantage",
-        "stamp": None,
     },
     "ros-esm/melodic": {
         "eol": False,
@@ -263,7 +255,6 @@ subprojects = {
         "ppa": "ubuntu-robotics-packagers/ros-security/ubuntu",
         "parent": "ubuntu/bionic",
         "description": "Available with Ubuntu Advantage: https://ubuntu.com/advantage",
-        "stamp": None,
     },
     "ubuntu/warty": {
         "eol": True,
@@ -642,7 +633,7 @@ def product_series(rel):
 
 # get the subproject details for rel along with it's canonical name, product and series
 def get_subproject_details(rel):
-    """Return the product,series,details tuple for rel."""
+    """Return the canonical name,product,series,details tuple for rel."""
     canon, product, series, details = None, None, None, None
     try:
         details = subprojects[rel]
@@ -652,7 +643,8 @@ def get_subproject_details(rel):
         # look for alias
         for r in subprojects:
             try:
-                if subprojects[r]["alias"] == rel:
+                if subprojects[r]["alias"] == rel \
+                   or (rel == "devel" and subprojects[r]["devel"]):
                     product, series = product_series(r)
                     details = subprojects[r]
                     canon = product + "/" + series
@@ -726,12 +718,19 @@ def release_progenitor(rel):
 
 def release_stamp(rel):
     """Return the time stamp for rel."""
-    stamp = 0
+    stamp = -1
     _, _, _, details = get_subproject_details(rel)
-    try:
-        stamp = details["stamp"]
-    except (KeyError, TypeError):
-        pass
+    if details:
+        # devel is special and so is assumed to be released in the future
+        if "devel" in details and details["devel"]:
+            stamp = sys.maxsize
+        try:
+            stamp = details["stamp"]
+        except KeyError:
+            rel = release_progenitor(rel)
+            _, _, _, details = get_subproject_details(rel)
+            if details:
+                stamp = details["stamp"]
     return stamp
 
 def release_ppa(rel):
@@ -889,6 +888,26 @@ for release in subprojects:
         releases.append(rel)
 
 
+def release_sort(release_list):
+    '''takes a list of release names and sorts them in release order'''
+
+    # turn list into a tuples of (name, release stamp)
+    rels = [(x, release_stamp(x)) for x in release_list]
+    # sort list by release stamp (formatted to 20 places so we don't have to
+    # worry about the number of digits in the stamp) but also prepend the
+    # release name so releases that have the same stamp sort in alphabetical
+    # order by name, then pull out just the names
+    return [x[0] for x in sorted(rels, key=lambda x: ("%020d" % x[1]) + x[0])]
+
+
+def release_is_older_than(release_a, release_b):
+    '''return True if release_a appeared before release_b'''
+
+    # NOTE: foo/esm will be considered older than foo+1, even if the
+    # actual esm event occurred far later than foo+1's release
+    return all_releases.index(release_a) < all_releases.index(release_b)
+
+
 # releases to display for flavors
 flavor_releases = [
     'lucid', 'precise', 'trusty', 'utopic', 'vivid', 'wily', 'xenial',
@@ -896,6 +915,10 @@ flavor_releases = [
     'focal', 'groovy', 'hirsute', 'impish', 'jammy', 'kinetic', "lunar",
 ]
 
+all_releases = release_sort(all_releases)
+flavor_releases = release_sort(flavor_releases)
+releases = release_sort(releases)
+
 # primary name of extended support maintenance (esm) releases
 esm_releases = [x.split('/esm')[0] for x in all_releases if x.endswith('/esm')]
 
@@ -1322,23 +1345,6 @@ CVE_RE = re.compile(r'^CVE-\d\d\d\d-[N\d]{4,7}$')
 NOTE_RE = re.compile(r'^\s+([A-Za-z0-9-]+)([>|]) *(.*)$')
 
 
-def release_sort(release_list):
-    '''takes a list of release names and sorts them in release order'''
-
-    # turn list into a tuples of (name, release index)
-    rels = [(x, all_releases.index(x)) for x in release_list]
-    # sort list by release index, then pull out just the names
-    return [x[0] for x in sorted(rels, key=lambda x: x[1])]
-
-
-def release_is_older_than(release_a, release_b):
-    '''return True if release_a appeared before release_b'''
-
-    # NOTE: foo/esm will be considered older than foo+1, even if the
-    # actual esm event occurred far later than foo+1's release
-    return all_releases.index(release_a) < all_releases.index(release_b)
-
-
 
 cve_dirs = [active_dir, retired_dir, ignored_dir]
 if os.path.islink(embargoed_dir):
diff --git a/scripts/test_cve_lib.py b/scripts/test_cve_lib.py
index 8bf4509..8d9792c 100755
--- a/scripts/test_cve_lib.py
+++ b/scripts/test_cve_lib.py
@@ -4,6 +4,7 @@ import datetime
 import json
 import os
 import pytest
+import random
 import sys
 import cve_lib
 
@@ -68,6 +69,31 @@ class TestPackageOverrideTests:
         assert len(title) > 0
         assert len(desc) > 0
 
+class TestReleaseSort:
+    def test_release_sort(self):
+        print(cve_lib.all_releases)
+        assert cve_lib.release_sort(
+            ["jammy", "focal", "xenial", "bionic", "esm-apps/jammy"]) == \
+            ["xenial", "bionic", "focal", "esm-apps/jammy", "jammy"]
+
+    # check all release lists in cve_lib are sorted OOTB
+    @pytest.mark.parametrize("releases",
+                             [cve_lib.all_releases, cve_lib.flavor_releases,
+                              cve_lib.releases, cve_lib.esm_releases,
+                              cve_lib.esm_apps_releases,
+                              cve_lib.esm_infra_releases,
+                              cve_lib.ros_esm_releases])
+    def test_release_lists_are_sorted_by_default(self, releases):
+        assert cve_lib.release_sort(releases) == releases
+
+    def test_release_sort_stable(self):
+        # unsort list of releases
+        unsorted = list(cve_lib.all_releases)
+        while unsorted == cve_lib.all_releases:
+            random.shuffle(unsorted)
+        # check sort order is stable
+        sortd = cve_lib.release_sort(unsorted)
+        assert sortd == cve_lib.all_releases
 
 TEST_DATA_DIR = "test/"