Remove vulnerability related features we will no longer support #3384

lucasmoura · 2025-01-28T13:17:09Z

Why is this needed?

We are no longer addressing USNs in the new vulnerability design. Because of that, we are removing any USN related feature that is tied to the vulnerability work

Test Steps

Check that we are not removing any CVE specific code on this PR

(un)check this to re-run the checklist action

github-actions · 2025-01-28T13:17:24Z

PR Checklist

How to use this checklist

PR Author

For each section, check a box when it is true.
Uncheck a box if it becomes un-true.
Then check the box at the bottom of the PR description to re-run the action that creates this checklist.
The action that creates and updates this comment will retain your edits.
The action will fail if the checklist is not completed.

PR Reviewer

Check that the PR checklist action did not fail.
Double check that the author filled out the checklist accurately.
If you disagree with a checklist item, start a conversation.
For example, the author may say they don't think integration tests are necessary, but you may disagree.

Bug References

None.

Confirm

I've properly referenced all bugs that this PR fixes

How to properly reference fixed bugs

If this PR is related to a Jira item, include an SC-1234 reference in the PR title
If this PR is fixes a GitHub issue, include a Fixes: #1234 reference in the commit that fixes the issue
If this PR is fixes a Launchpad bug, include a LP: #12345678 reference in the commit that fixes the issue

Test Updates

Unit Tests

I have updated or added any unit tests accordingly
No unit test changes are necessary for this change

Integration Tests

I have updated or added any integration tests accordingly
No integration test changes are necessary for this change

Documentation

Changes here need to be documented and I have referenced the docs PR in the description
No documentation updates are necessary for this change

Does this PR require review from someone outside the core ubuntu-pro-client team?

Yes, and I have requested those reviews via GitHub
No

lucasmoura · 2025-01-28T13:45:38Z

I am removing the integration tests on this PR due to the fact that they will completely change for the new redesign

dheyay

what a cleanup this is 😅

orndorffgrant

There are a number of python 3.5 syntax errors caught by the Xenial package build failure in CI. Please fix those before merging.

Also, I think two files were included by mistake. Please remove them before merging.

Otherwise, looks good, so giving a preemptive "Approve", pending those fixes.

orndorffgrant · 2025-02-03T19:52:13Z

features/files/fix/usn_4539_1

@@ -0,0 +1 @@
+{"cves":[{"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956650"],"codename":null,"cvss3":7.5,"description":"\nAn issue was discovered in DAViCal Andrew's Web Libraries (AWL) through\n0.60. Session management does not use a sufficiently hard-to-guess session\nkey. Anyone who can guess the microsecond time (and the incrementing\nsession_id) can impersonate a session.","id":"CVE-2020-11728","impact":{"baseMetricV3":{"cvssV3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6}},"mitigation":"","notes":[],"notices_ids":["USN-4539-1"],"packages":[{"debian":"https://tracker.debian.org/pkg/awl","name":"awl","source":"https://ubuntu.com/security/cve?package=awl","statuses":[{"component":null,"description":"","pocket":"security","release_codename":"bionic","status":"needs-triage"},{"component":null,"description":"end of life","pocket":"security","release_codename":"eoan","status":"ignored"},{"component":null,"description":"0.60-1+deb10u1ubuntu1","pocket":"security","release_codename":"focal","status":"released"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"groovy","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"hirsute","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"impish","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"jammy","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"kinetic","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"lunar","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"mantic","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"noble","status":"not-affected"},{"component":null,"description":"","pocket":"security","release_codename":"trusty","status":"DNE"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"upstream","status":"released"},{"component":null,"description":"","pocket":"security","release_codename":"xenial","status":"needs-triage"}],"ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=awl"}],"patches":{"awl":[]},"priority":"medium","published":"2020-04-15T16:15:00","references":["https://gitlab.com/davical-project/awl/-/issues/19","https://gitlab.com/davical-project/awl/-/commit/c2e808cc2420f8d870ac0a4aa9cc1f2c90562428","https://ubuntu.com/security/notices/USN-4539-1","https://www.cve.org/CVERecord?id=CVE-2020-11728"],"status":"active","tags":{},"ubuntu_description":"","updated_at":"2024-07-24T15:57:39.284958+00:00"}],"cves_ids":["CVE-2020-11728"],"description":"Andrew Bartlett discovered that DAViCal Andrew's Web Libraries (AWL) did\nnot properly manage session keys. An attacker could possibly use this\nissue to impersonate a session. (CVE-2020-11728)\n","id":"USN-4539-1","instructions":"In general, a standard system update will make all the necessary changes.\n","is_hidden":false,"published":"2020-09-24T18:18:05.058599","references":[],"related_notices":[],"release_packages":{"focal":[{"description":"PHP Utility Libraries","is_source":true,"name":"awl","version":"0.60-1+deb10u1ubuntu1"},{"is_source":false,"is_visible":false,"name":"awl-doc","pocket":"security","source_link":"https://launchpad.net/ubuntu/+source/awl","version":"0.60-1+deb10u1ubuntu1","version_link":"https://launchpad.net/ubuntu/+source/awl/0.60-1+deb10u1ubuntu1"},{"is_source":false,"is_visible":true,"name":"libawl-php","pocket":"security","source_link":"https://launchpad.net/ubuntu/+source/awl","version":"0.60-1+deb10u1ubuntu1","version_link":"https://launchpad.net/ubuntu/+source/awl/0.60-1+deb10u1ubuntu1"}]},"releases":[{"codename":"focal","support_tag":"LTS","version":"20.04"}],"summary":"DAViCal Andrew's Web Libraries could be made to run programs as your login\nif it received specially crafted input.\n","title":"AWL vulnerability","type":"USN"}


Did you mean to add this and cve_2020_28196 in this PR?

Good catch, I have removed the files

We are now removing all flags that will be no longer supported from all vulnerability related features

This endpoint will no longer be supported

lucasmoura · 2025-02-04T19:24:16Z

@orndorffgrant fixed

renanrodrigo · 2025-02-06T07:13:45Z

From the many integration test failures we have - most of them related to backend instability or to the fix fiesta - we have two introduced in this PR

features/api/api.feature:40  all API endpoints can be imported individually -- @1.1 ubuntu release
features/cli/help.feature:558  Help text for the Pro Client commands -- @1.1 ubuntu release

Besides those details, just running pro vulnerability commands from this branch causes

~# pro vulnerability
Processing vulnerability data...
|An unexpected error occurred: 'Namespace' object has no attribute 'data_file'
For more details, see the log: /var/log/ubuntu-advantage.log
If you think this is a bug, please run: ubuntu-bug ubuntu-advantage-tools
\

And then the spinner spins forever. The traceback ends with:

File \"/usr/lib/python3/dist-packages/uaclient/cli/vulnerability/util.py\", line 30, in new_f\n    if args.data_file:
AttributeError: 'Namespace' object has no attribute 'data_file'"

I understand this is a multi-PR effort and would not care about the integration tests so much - I can fix anything overseen later. Functionality-wise, #3387 should round everything up, and extensive testing of the functionality should be done there.

I am merging this, understanding that it breaks the daily package - but dailies can be broken for some days I guess.

@lucasmoura ^

Remove support for USNs in vulnerability feature

4e3a14f

lucasmoura changed the title ~~Remove support for USNs in vulnerability feature~~ Remove vulnerability related features we will no longer support Jan 28, 2025

lucasmoura mentioned this pull request Jan 31, 2025

Redesign pro vulnerability cli commands #3387

Open

1 task

dheyay approved these changes Jan 31, 2025

View reviewed changes

orndorffgrant approved these changes Feb 3, 2025

View reviewed changes

lucasmoura added 2 commits February 4, 2025 16:23

Remove vulnerability flags no longer supported

553f4b3

We are now removing all flags that will be no longer supported from all vulnerability related features

Remove updates_with_cves API endpoint

0b90b4e

This endpoint will no longer be supported

lucasmoura force-pushed the remove-some-scenarios-from-vulnerability-features branch from ec3cc6a to 0b90b4e Compare February 4, 2025 19:23

renanrodrigo merged commit 850c4ab into main Feb 6, 2025
18 of 24 checks passed

renanrodrigo deleted the remove-some-scenarios-from-vulnerability-features branch February 6, 2025 07:15

renanrodrigo mentioned this pull request Feb 6, 2025

Update vulnerabilities CVE endpoint #3386

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove vulnerability related features we will no longer support #3384

Remove vulnerability related features we will no longer support #3384

lucasmoura commented Jan 28, 2025 •

edited

Loading

github-actions bot commented Jan 28, 2025 •

edited by lucasmoura

Loading

How to use this checklist

PR Author

PR Reviewer

lucasmoura commented Jan 28, 2025

dheyay left a comment

orndorffgrant left a comment

orndorffgrant Feb 3, 2025

lucasmoura Feb 4, 2025

lucasmoura commented Feb 4, 2025

renanrodrigo commented Feb 6, 2025 •

edited

Loading

		@@ -0,0 +1 @@
		{"cves":[{"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956650"],"codename":null,"cvss3":7.5,"description":"\nAn issue was discovered in DAViCal Andrew's Web Libraries (AWL) through\n0.60. Session management does not use a sufficiently hard-to-guess session\nkey. Anyone who can guess the microsecond time (and the incrementing\nsession_id) can impersonate a session.","id":"CVE-2020-11728","impact":{"baseMetricV3":{"cvssV3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6}},"mitigation":"","notes":[],"notices_ids":["USN-4539-1"],"packages":[{"debian":"https://tracker.debian.org/pkg/awl","name":"awl","source":"https://ubuntu.com/security/cve?package=awl","statuses":[{"component":null,"description":"","pocket":"security","release_codename":"bionic","status":"needs-triage"},{"component":null,"description":"end of life","pocket":"security","release_codename":"eoan","status":"ignored"},{"component":null,"description":"0.60-1+deb10u1ubuntu1","pocket":"security","release_codename":"focal","status":"released"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"groovy","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"hirsute","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"impish","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"jammy","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"kinetic","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"lunar","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"mantic","status":"not-affected"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"noble","status":"not-affected"},{"component":null,"description":"","pocket":"security","release_codename":"trusty","status":"DNE"},{"component":null,"description":"0.61-1","pocket":"security","release_codename":"upstream","status":"released"},{"component":null,"description":"","pocket":"security","release_codename":"xenial","status":"needs-triage"}],"ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=awl"}],"patches":{"awl":[]},"priority":"medium","published":"2020-04-15T16:15:00","references":["https://gitlab.com/davical-project/awl/-/issues/19","https://gitlab.com/davical-project/awl/-/commit/c2e808cc2420f8d870ac0a4aa9cc1f2c90562428","https://ubuntu.com/security/notices/USN-4539-1","https://www.cve.org/CVERecord?id=CVE-2020-11728"],"status":"active","tags":{},"ubuntu_description":"","updated_at":"2024-07-24T15:57:39.284958+00:00"}],"cves_ids":["CVE-2020-11728"],"description":"Andrew Bartlett discovered that DAViCal Andrew's Web Libraries (AWL) did\nnot properly manage session keys. An attacker could possibly use this\nissue to impersonate a session. (CVE-2020-11728)\n","id":"USN-4539-1","instructions":"In general, a standard system update will make all the necessary changes.\n","is_hidden":false,"published":"2020-09-24T18:18:05.058599","references":[],"related_notices":[],"release_packages":{"focal":[{"description":"PHP Utility Libraries","is_source":true,"name":"awl","version":"0.60-1+deb10u1ubuntu1"},{"is_source":false,"is_visible":false,"name":"awl-doc","pocket":"security","source_link":"https://launchpad.net/ubuntu/+source/awl","version":"0.60-1+deb10u1ubuntu1","version_link":"https://launchpad.net/ubuntu/+source/awl/0.60-1+deb10u1ubuntu1"},{"is_source":false,"is_visible":true,"name":"libawl-php","pocket":"security","source_link":"https://launchpad.net/ubuntu/+source/awl","version":"0.60-1+deb10u1ubuntu1","version_link":"https://launchpad.net/ubuntu/+source/awl/0.60-1+deb10u1ubuntu1"}]},"releases":[{"codename":"focal","support_tag":"LTS","version":"20.04"}],"summary":"DAViCal Andrew's Web Libraries could be made to run programs as your login\nif it received specially crafted input.\n","title":"AWL vulnerability","type":"USN"}

Remove vulnerability related features we will no longer support #3384

Remove vulnerability related features we will no longer support #3384

Conversation

lucasmoura commented Jan 28, 2025 • edited Loading

Why is this needed?

Test Steps

Check that we are not removing any CVE specific code on this PR

github-actions bot commented Jan 28, 2025 • edited by lucasmoura Loading

PR Checklist

How to use this checklist

PR Author

PR Reviewer

Bug References

Confirm

Test Updates

Unit Tests

Integration Tests

Documentation

Does this PR require review from someone outside the core ubuntu-pro-client team?

lucasmoura commented Jan 28, 2025

dheyay left a comment

Choose a reason for hiding this comment

orndorffgrant left a comment

Choose a reason for hiding this comment

orndorffgrant Feb 3, 2025

Choose a reason for hiding this comment

lucasmoura Feb 4, 2025

Choose a reason for hiding this comment

lucasmoura commented Feb 4, 2025

renanrodrigo commented Feb 6, 2025 • edited Loading

lucasmoura commented Jan 28, 2025 •

edited

Loading

github-actions bot commented Jan 28, 2025 •

edited by lucasmoura

Loading

renanrodrigo commented Feb 6, 2025 •

edited

Loading