Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Refactor E2E Vulnerability Detection tests cases to remove false positive CVE-2023-4822 #5369

Merged
merged 16 commits into from
May 22, 2024
Merged

Refactor E2E Vulnerability Detection tests cases to remove false positive CVE-2023-4822 #5369

merged 16 commits into from
May 22, 2024

Conversation

Rebits
Copy link
Member

@Rebits Rebits commented May 13, 2024 •
edited

Description

It has been detected that vulnerability CVE-2023-4822 was not expected for test defined grafana packages. This PR removes this vulnerability for grafana packages metadata along with including new grafana-enterprise packages that match with non-vulnerable-to-vulnerable test case

Warning

The proposed new Grafana nonvulnerable package has some vulnerabilities. However, this package has been selected due to these vulnerabilities has not been validated by NVD. When this occur, Grafana packages should be updated by the proposed in #5368 (comment)

Testing performed

Build: https://ci.wazuh.info/job/Test_e2e_system/287/console

Validation Jenkins Local OS Commit Notes
⚫⚫ 🟢 Nothing to highlight
Result analysis 
root:conftest.py:353 Running teardown for agent: ['agent1', 'agent3', 'agent4', 'agent5', 'agent6', 'agent2']
root:conftest.py:356 Teardown Results: {'agent6': True, 'agent4': True, 'agent1': True, 'agent5': True, 'agent3': True, 'agent2': True}
  • False positive now is correctly detected as unexpected vulnerability

@Rebits Rebits self-assigned this May 13, 2024
@Rebits Rebits linked an issue May 13, 2024 that may be closed by this pull request
False positive CVE-2023-4822 was included in E2E Vulnerability detection tests #5368
Closed
1 task
@Rebits Rebits marked this pull request as ready for review May 14, 2024 18:11
@Rebits Rebits mentioned this pull request May 20, 2024
Closed
2 tasks
@MARCOSD4 MARCOSD4 mentioned this pull request May 22, 2024
Closed
3 tasks
@juliamagan juliamagan merged commit ec9be1a into 4.8.0 May 22, 2024
0 of 2 checks passed
@juliamagan juliamagan deleted the fix/5368-remove-false-positive-CVE-2023-4822 branch May 22, 2024 17:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@juliamagan juliamagan juliamagan approved these changes

@santipadilla santipadilla santipadilla approved these changes

Assignees

@Rebits Rebits

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

False positive CVE-2023-4822 was included in E2E Vulnerability detection tests
3 participants
@Rebits @juliamagan @santipadilla