tracker_service.py 77.8 KB
Newer Older
1 2 3 4 5 6 7 8
#!/usr/bin/python

import sys
sys.path.insert(0,'../lib/python')
import bugs
import re
import security_db
from web_support import *
9
import json
10 11
import time
import email.utils
12

13 14
if __name__ == "__main__":
    if len(sys.argv) not in (3, 5):
15 16
        print("usage: python tracker_service.py SOCKET-PATH DATABASE-PATH")
        print("       python tracker_service.py URL HOST PORT DATABASE-PATH")
17 18 19 20 21 22 23 24 25 26 27 28
        sys.exit(1)
    if len(sys.argv) == 3:
        socket_name = sys.argv[1]
        db_name = sys.argv[2]
        webservice_base_class = WebService
    else:
        server_base_url = sys.argv[1]
        server_address = sys.argv[2]
        server_port = int(sys.argv[3])
        socket_name = (server_base_url, server_address, server_port)
        db_name = sys.argv[4]
        webservice_base_class = WebServiceHTTP
29 30 31
else:
    webservice_base_class = WebServiceHTTP

32 33 34 35 36 37 38 39 40 41 42 43 44 45
def clean_dict(d):
    """ taken from http://w3facility.org/question/exclude-emptynull-values-from-json-serialization/
    Delete keys with the value ``None`` in a dictionary, recursively.

    This alters the input so you may wish to ``copy`` the dict first.
    """
    # d.iteritems isn't used as you can't del or the iterator breaks.
    for key, value in d.items():
        if value is None:
            del d[key]
        elif isinstance(value, dict):
            clean_dict(value)
    return d  # For convenience

46
class BugFilter:
47 48 49 50
    default_action_list = [('high_urgency', 'high', 'urgency'),
                           ('medium_urgency', 'medium', 'urgency'),
                           ('low_urgency', 'low', 'urgency'),
                           ('unimportant_urgency', 'unimportant', 'urgency'),
51
                           ('unassigned_urgency', 'not yet assigned', 'urgency'),
52
                           ('endoflife_urgency', 'end-of-life', 'urgency'),
53 54 55 56 57

                           ('remote', 'hide remote scope', 'scope'),
                           ('local', 'hide local scope', 'scope'),
                           ('unclear', 'hide unclear scope', 'scope'),

58
                           ('undetermined_issues', 'include issues to be checked (shown in purple)', 'extra'),]
59

60
    def __init__(self, params, nonodsa=False, noignored=False, nopostponed=False):
61 62
        self.action_list = self.default_action_list
        if not nonodsa:
63 64 65 66 67
            self.action_list = self.action_list +  [('nodsa', 'include issues tagged <no-dsa>', 'nodsa')]
        if not noignored:
            self.action_list = self.action_list +  [('noignored', 'include issues tagged <ignored>', 'nodsa')]
        if not nopostponed:
            self.action_list = self.action_list +  [('nopostponed', 'include issues tagged <postponed>', 'nodsa')]
68
        self.params = {}
69
        for (prop, desc, field) in self.action_list:
70
            self.params[prop] = int(params.get(prop, (0,))[0])
71 72
        self.filters=params.get('filter')
        if not self.filters:
73
            self.filters=['high_urgency', 'medium_urgency', 'low_urgency', 'unassigned_urgency']
74 75 76

    def actions(self, url):
        """Returns a HTML snippet which can be used to change the filter."""
77 78

        l = []
79 80 81
        l.append(INPUT(type='hidden', name='filter', value='1'))
        for (prop, desc, field) in self.action_list:
            if prop in self.filters:
82
                l.append(LABEL(INPUT(desc, type='checkbox', name='filter', value=prop, onChange='this.form.submit()', checked='checked'), rel=field))
83
                self.params[prop]=1
84
            else:
85
                l.append(LABEL(INPUT(desc, type='checkbox', name='filter', value=prop, onChange='this.form.submit()'), rel=field))
86

87 88
        return FORM(tag("SPAN",l, id="filters"),
                    tag("NOSCRIPT", [INPUT(type='submit', value='Apply')]),
89
                    method='get')
90

91 92
    def urgencyFiltered(self, urg, vuln):
        """Returns True for urgencies that should be filtered."""
93 94 95 96 97 98 99 100
        filterlow = not self.params['low_urgency'] and \
                    urg in ('low', 'low**')
        filtermed = not self.params['medium_urgency'] and \
                    urg in ('medium', 'medium**')
        filterhigh = not self.params['high_urgency'] and \
                    urg in ('high', 'high**')
        filterund = not self.params['undetermined_issues'] and vuln == 2
        filteruni = not self.params['unimportant_urgency'] \
101
                    and urg == 'unimportant'
102 103
        filteruna = not self.params['unassigned_urgency'] \
                    and urg ==  'not yet assigned'
104 105 106
        filterend = not self.params['endoflife_urgency'] \
                    and urg == 'end-of-life'
        return filterlow or filtermed or filterhigh or filterund or filteruni or filteruna or filterend
107 108

    def remoteFiltered(self, remote):
109 110 111 112
	filterr = self.params['remote'] and remote and remote is not None
	filterl = self.params['local'] and not remote and remote is not None
	filteru = self.params['unclear'] and remote is None
	return filterr or filterl or filteru
113 114

    def nodsaFiltered(self, nodsa):
115
        """Returns True for no DSA issues if filtered."""
116
        return nodsa and not self.params['nodsa']
117 118 119 120 121 122
    def ignoredFiltered(self, no_dsa_reason):
        """Returns True for ignored issues if filtered."""
        return no_dsa_reason == 'ignored' and not self.params['noignored']
    def postponedFiltered(self, no_dsa_reason):
        """Returns True for postponedissues if filtered."""
        return no_dsa_reason == 'postponed' and not self.params['nopostponed']
123

124
class TrackerService(webservice_base_class):
125 126 127 128 129 130 131 132
    nvd_text =  P('''If a "**" is included, the urgency field was automatically
        assigned by the NVD (National Vulnerability Database). Note that this
        rating is automatically derived from a set of known factors about the
        issue (such as access complexity, confidentiality impact, exploitability,
        remediation level, and others). Human intervention is involved in
        determining the values of these factors, but the rating itself comes
        from a fully automated formula.''')

133 134
    json_generation_interval = 5 * 60 # in seconds

135
    def __init__(self, socket_name, db_name):
136
        webservice_base_class.__init__(self, socket_name)
137
        self.db = security_db.DB(db_name)
138 139
        self.json_data = None # the JSON dump itself
        self.json_timestamp = None # timestamp of JSON generation
140
        self.json_last_modified = None
141 142
        self.register('', self.page_home)
        self.register('*', self.page_object)
143
        self.register('redirect/*', self.page_redirect)
144
        self.register('source-package/*', self.page_source_package)
145 146
        self.register('status/release/oldoldstable',
                      self.page_status_release_oldoldstable)
Thijs Kinkhorst's avatar
Thijs Kinkhorst committed
147 148
        self.register('status/release/oldstable',
                      self.page_status_release_oldstable)
149
        self.register('status/release/stable', self.page_status_release_stable)
150
        self.register('status/release/stable-backports',
151
                      self.page_status_release_stable_backports)
152
        self.register('status/release/oldstable-backports',
153
                      self.page_status_release_oldstable_backports)
154 155
        self.register('status/release/oldoldstable-backports',
                      self.page_status_release_oldoldstable_backports)
156 157 158 159 160 161 162
        self.register('status/release/testing',
                      self.page_status_release_testing)
        self.register('status/release/unstable',
                      self.page_status_release_unstable)
        self.register('status/dtsa-candidates',
                      self.page_status_dtsa_candidates)
        self.register('status/todo', self.page_status_todo)
163 164
        self.register('status/undetermined', self.page_status_undetermined)
        self.register('status/unimportant', self.page_status_unimportant)
165
        self.register('status/itp', self.page_status_itp)
166
        self.register('status/unreported', self.page_status_unreported)
167 168
        self.register('data/unknown-packages', self.page_data_unknown_packages)
        self.register('data/missing-epochs', self.page_data_missing_epochs)
169 170
        self.register('data/latently-vulnerable',
                      self.page_data_latently_vulnerable)
171 172
        self.register('data/releases', self.page_data_releases)
        self.register('data/funny-versions', self.page_data_funny_versions)
173
        self.register('data/fake-names', self.page_data_fake_names)
174
        self.register('data/pts/1', self.page_data_pts)
175
        self.register('data/json', self.page_json)
176
        self.register('debsecan/**', self.page_debsecan)
177
        self.register('data/report', self.page_report)
178
        self.register('style.css', self.page_style_css)
179
        self.register('logo.png', self.page_logo_png)
180
        self.register('distributions.json', self.page_distributions_json)
181
        self.register('script.js', self.page_script_js)
182 183

    def page_style_css(self, path, params, url):
184
        f=open('../static/style.css', 'r')
185 186 187
	content=f.read()
	f.close()
        return BinaryResult(content,'text/css')
188

189 190 191 192 193 194
    def page_logo_png(self, path, params, url):
        f=open('../static/logo.png', 'r')
	content=f.read()
	f.close()
        return BinaryResult(content,'image/png')

195 196 197 198 199 200
    def page_distributions_json(self, path, params, url):
        f=open('../static/distributions.json', 'r')
        content=f.read()
        f.close()
        return BinaryResult(content,'application/json')

201 202 203 204 205 206 207
    def page_script_js(self, path, params, url):
        f=open('../static/script.js', 'r')
        content=f.read()
        f.close()
        return BinaryResult(content,'text/javascript')


208 209 210 211 212 213 214
    def page_home(self, path, params, url):
        query = params.get('query', ('',))[0]
        if query:
            if '/' in query:
                return self.page_not_found(url, query)
            else:
                return RedirectResult(url.scriptRelativeFull(query))
215

216 217 218
        return self.create_page(
            url, 'Security Bug Tracker',
            [P(
219
            """The data in this tracker comes solely from the bug database maintained
220 221
by Debian's security team located in the security-tracker Git """,
            A("https://salsa.debian.org/security-tracker-team/security-tracker/tree/master/data", "repository"),
222
            """.  The data represented here is derived from: """,
223
            A("https://www.debian.org/security/#DSAS", "DSAs"),
224
            """ issued by the Security Team; issues tracked in the """,
225
            A("https://cve.mitre.org/cve/", "CVE database"),
226
            """, issues tracked in the """,
227
            A("https://nvd.nist.gov/", "National Vulnerability Database"),
228 229
            """ (NVD), maintained by NIST; and security issues
discovered in Debian packages as reported in the BTS."""),
Stefan Fritsch's avatar
Stefan Fritsch committed
230
             P("""All external data (including Debian bug reports and official Debian
231
security advisories) must be added to this database before it appears
232
here. Please help us keep this information up-to-date by """,
233
               A(url.scriptRelative("data/report"), "reporting"),
Nicholas Luedtke's avatar
Nicholas Luedtke committed
234
               """ any discrepancies or change of status that you are
235
aware of and/or help us improve the quality of this information by """,
236
               A(url.scriptRelative("data/report"), "participating"),
237
               "."),
238

239
            NAV(make_menu(
240 241 242
            url.scriptRelative,
            ('status/release/unstable',
             'Vulnerable packages in the unstable suite'),
243 244 245 246
            ('status/release/testing',
             'Vulnerable packages in the testing suite'),
            ('status/release/stable',
             'Vulnerable packages in the stable suite'),
247 248
            ('status/release/stable-backports',
             'Vulnerable packages in backports for stable'),
249 250 251 252
            ('status/release/oldstable',
             'Vulnerable packages in the oldstable suite'),
            ('status/release/oldstable-backports',
             'Vulnerable packages in backports for oldstable'),
253 254 255 256
            ('status/release/oldoldstable',
             'Vulnerable packages in the oldoldstable suite'),
            ('status/release/oldoldstable-backports',
             'Vulnerable packages in backports for oldoldstable'),
257 258
            ('status/dtsa-candidates', "Candidates for DTSAs"),
            ('status/todo', 'TODO items'),
259 260
            ('status/undetermined', 'Packages that may be vulnerable but need to be checked (undetermined issues)'),
            ('status/unimportant', 'Packages that have open unimportant issues'),
261
            ('status/itp', 'ITPs with potential security issues'),
262
            ('status/unreported', 'Open vulnerabilities without filed Debian bugs'),
263 264
            ('data/unknown-packages',
             'Packages names not found in the archive'),
265
            ('data/fake-names', 'Tracked issues without a CVE name'),
266 267
            ('data/missing-epochs',
             'Package versions which might lack an epoch'),
268 269
            ('data/latently-vulnerable',
             'Packages which are latently vulnerable in unstable'),
270 271 272
            ('data/funny-versions',
             'Packages with strange version numbers'),
            ('data/releases',
273 274 275
             'Covered Debian releases and architectures'),
            ('data/json',
             'All information in JSON format')
276
			)),
277 278 279

            self.make_search_button(url),
            P("""(You can enter CVE names, Debian bug numbers and package
280
names in the search forms.)"""),
281

282
             H3("External interfaces"),
283 284 285 286 287 288
             P("""If you want to automatically open a relevant web page for
some object, use the """,
               CODE(str(url.scriptRelative("redirect/")), EM("object")),
               """ URL.  If no information is contained in this database,
the browser is automatically redirected to the corresponding external
data source.""")],
289 290 291 292
            search_in_page=True)

    def page_object(self, path, params, url):
        obj = path[0]
293 294 295
        return self.page_object_or_redirect(url, obj, False)

    def page_redirect(self, path, params, url):
296 297 298 299
        if path == ():
            obj = ''
        else:
            obj = path[0]
300 301 302 303
        return self.page_object_or_redirect(url, obj, True)

    def page_object_or_redirect(self, url, obj, redirect):
        c = self.db.cursor()
304 305 306 307 308

        if not obj:
            # Redirect to start page.
            return RedirectResult(url.scriptRelativeFull(""))

309 310
        # Attempt to decode a bug number.  TEMP-nnn bugs (but not
        # TEMP-nnn-mmm bugs) are treated as bug references, too.
311
        bugnumber = 0
312
        fake_bug = False
313
        try:
314
            if obj[0:5] == 'FAKE-' or obj[0:5] == 'TEMP-':
315 316 317 318
                bugnumber = int(obj[5:])
                fake_bug = True
            else:
                bugnumber = int(obj)
319 320 321
        except ValueError:
            pass
        if bugnumber:
322 323
            buglist = list(self.db.getBugsFromDebianBug(c, bugnumber))
            if buglist:
324
                return self.page_debian_bug(url, bugnumber, buglist, fake_bug)
325 326 327
            if redirect:
                return RedirectResult(self.url_debian_bug(url, str(bugnumber)),
                                      permanent=False)
328

329 330 331 332
        if 'A' <= obj[0] <= 'Z':
            # Bug names start with a capital letter.
            return self.page_bug(url, obj, redirect)

333 334 335 336 337
        if self.db.isSourcePackage(c, obj):
            return RedirectResult(self.url_source_package(url, obj, full=True))

        return self.page_not_found(url, obj)

338
    def page_bug(self, url, name, redirect):
339 340 341 342 343
        # FIXME: Normalize CAN-* to CVE-* when redirecting.  Too many
        # people still use CAN.
        if redirect and name[0:4] == 'CAN-':
            name = 'CVE-' + name[4:]

344 345 346 347
        cursor = self.db.cursor()
        try:
            bug = bugs.BugFromDB(cursor, name)
        except ValueError:
348
            if redirect:
349
                if name[0:4] == 'CVE-':
350 351
                    return RedirectResult(self.url_cve(url, name),
                                          permanent=False)
352
            return self.page_not_found(url, name)
353
        if bug.name != name or redirect:
354 355 356 357 358 359 360
            # Show the normalized bug name in the browser address bar.
            return RedirectResult(url.scriptRelativeFull(bug.name))

        page = []

        def gen_header():
            yield B("Name"), bug.name
361

362 363 364 365 366 367
            nvd = self.db.getNVD(cursor, bug.name)

            if nvd and nvd.cve_desc:
                yield B("Description"), nvd.cve_desc
            elif bug.description:
                yield B("Description"), bug.description
368 369

            source = bug.name.split('-')[0]
370
            if source == 'CVE':
371
                source_xref = compose(self.make_cve_ref(url, bug.name, 'CVE'),
372
                                      " (at ",
373
                                      self.make_nvd_ref(url, bug.name,
374 375
                                                        'NVD'),
                                      "; ",
376 377
                                      self.make_cert_bug_ref(url, bug.name, 'CERT'),
                                      ", ",
378 379
                                      self.make_lwn_bug_ref(url, bug.name, 'LWN'),
                                      ", ",
380 381
                                      self.make_osssec_bug_ref(url, bug.name, 'oss-sec'),
                                      ", ",
382 383
                                      self.make_fulldisc_bug_ref(url, bug.name, 'fulldisc'),
                                      ", ",
384 385
                                      self.make_bugtraq_bug_ref(url, bug.name, 'bugtraq'),
                                      ", ",
386 387
                                      self.make_edb_bug_ref(url, bug.name, 'EDB'),
                                      ", ",
388 389
                                      self.make_metasploit_bug_ref(url, bug.name, 'Metasploit'),
                                      ", ",
390
                                      self.make_rhbug_ref(url, bug.name,
391 392
                                                        'Red Hat'),
                                      ", ",
393
                                      self.make_ubuntu_bug_ref(url, bug.name, 'Ubuntu'),
394
                                      ", ",
395
                                      self.make_gentoo_bug_ref(url, bug.name, 'Gentoo'),
396 397 398 399
                                      ", SUSE ",
                                      self.make_suse_bug_ref(url, bug.name, 'bugzilla'),
                                      "/",
                                      self.make_suse_cve_ref(url, bug.name, 'CVE'),
400
                                      ", ",
401
                                      self.make_mageia_bug_ref(url, bug.name, 'Mageia'),
402 403 404 405
                                      ", GitHub ",
                                      self.make_github_code_ref(url, bug.name, 'code'),
                                      "/",
                                      self.make_github_issues_ref(url, bug.name, 'issues'),
406
                                      ", ",
407
                                      self.make_web_search_bug_ref(url, bug.name, 'web search'),
408
                                      ", ",
409
                                      A(url.absolute('http://oss-security.openwall.org/wiki/vendors'), 'more'),
410
                                      ")")
411 412 413 414
            elif source == 'DSA':
                source_xref = self.make_dsa_ref(url, bug.name, 'Debian')
            elif source == 'DTSA':
                source_xref = 'Debian Testing Security Team'
415
            elif source == 'DLA':
416
                source_xref = self.make_dla_ref(url, bug.name, 'Debian LTS')
417
            elif source == 'TEMP':
418 419 420 421 422 423 424 425 426 427 428
                source_xref = (
        'Automatically generated temporary name.  Not for external reference.')
            else:
                source_xref = None

            if source_xref:
                yield B("Source"), source_xref

            xref = list(self.db.getBugXrefs(cursor, bug.name))
            if xref:
                yield B("References"), self.make_xref_list(url, xref)
429 430 431

            if nvd:
                nvd_range = nvd.rangeString()
432 433 434 435 436 437
                if nvd.severity:
                    nvd_severity = nvd.severity.lower()
                    if nvd_range:
                        nvd_severity = "%s (attack range: %s)" \
                                       % (nvd_severity, nvd_range)
                    yield B("NVD severity"), nvd_severity
438

439 440 441 442 443
            debian_bugs = bug.getDebianBugs(cursor)
            if debian_bugs:
                yield (B("Debian Bugs"),
                       self.make_debian_bug_list(url, debian_bugs))

444 445 446 447 448
# Disable table with fixed status per release.
#           if not bug.not_for_us:
#               for (release, status, reason) in bug.getStatus(cursor):
#                   if status == 'undetermined':
#                       reason = self.make_purple(reason)
449
#                   elif status != 'fixed':
450 451
#                       reason = self.make_red(reason)
#                   yield B('Debian/%s' % release), reason
452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467

        page.append(make_table(gen_header()))

        if bug.notes:

            def gen_source():
                old_pkg = ''
                for (package, release, version, vulnerable) \
                        in self.db.getSourcePackages(cursor, bug.name):
                    if package == old_pkg:
                        package = ''
                    else:
                        old_pkg = package
                        package = compose(
                            self.make_source_package_ref(url, package),
                            " (", self.make_pts_ref(url, package, 'PTS'), ")")
468
                    if vulnerable == 1:
469 470
                        vuln = self.make_red('vulnerable')
                        version = self.make_red(version)
471 472 473
                    elif vulnerable == 2:
                        vuln = self.make_purple('undetermined')
                        version = self.make_purple(version)
474 475 476 477 478 479
                    else:
                        vuln = 'fixed'

                    yield package, ', '.join(release), version, vuln

            page.append(make_table(gen_source(),
480 481 482
                title=H2('Vulnerable and fixed packages'),
                caption=("Source Package", "Release", "Version", "Status"),
                introduction=P('The table below lists information on source packages.')))
483 484 485 486 487 488 489 490 491 492

            def gen_data():
                notes_sorted = bug.notes[:]
                notes_sorted.sort(lambda a, b: cmp(a.package, b.package))
                for n in notes_sorted:
                    if n.release:
                        rel = str(n.release)
                    else:
                        rel = '(unstable)'
                    urgency = str(n.urgency)
493 494
		    if urgency == 'end-of-life':
			urgency = self.make_purple('end-of-life')
495 496 497 498 499 500 501
                    if n.fixed_version:
                        ver = str(n.fixed_version)
                        if ver == '0':
                            ver = '(not affected)'
                            urgency = ''
                    else:
                        ver = self.make_red('(unfixed)')
502 503
                    if urgency == 'not yet assigned':
                        urgency = ''
504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528

                    pkg = n.package
                    pkg_kind = n.package_kind
                    if pkg_kind == 'source':
                        pkg = self.make_source_package_ref(url, pkg)
                    elif pkg_kind == 'itp':
                        pkg_kind = 'ITP'
                        rel = ''
                        ver = ''
                        urgency = ''

                    bugs = n.bugs
                    bugs.sort()
                    bugs = make_list(
                        map(lambda x: self.make_debian_bug(url, x), bugs))
                    if n.bug_origin:
                        origin = self.make_xref(url, n.bug_origin)
                    else:
                        origin = ''
                    yield (pkg, pkg_kind, rel, ver, urgency, origin, bugs)

            page.append(
                make_table(gen_data(),
                    caption=("Package", "Type", "Release", "Fixed Version",
                             "Urgency", "Origin", "Debian Bugs"),
529
                    introduction=P("The information below is based on the following data on fixed versions.")))
530 531 532 533 534 535

        if bug.comments:
            page.append(H2("Notes"))
            def gen_comments():
                for (t, c) in bug.comments:
                    yield c
536
            page.append(make_pre(gen_comments()))
537 538 539

        return self.create_page(url, bug.name, page)

540 541 542 543 544
    def page_debian_bug(self, url, bugnumber, buglist, fake_bug):
        if fake_bug:
            new_buglist = []
            for b in buglist:
                (bug_name, urgency, description) = b
545
                if bug_name[0:5] == 'FAKE-' or bug_name[0:5] == 'TEMP-':
546 547 548 549 550 551
                    new_buglist.append(b)
            if len(new_buglist) > 0:
                # Only replace the bug list if there are still fake
                # bug reports.
                buglist = new_buglist

552 553 554 555 556 557 558 559 560 561
        if len(buglist) == 1:
            # Single issue, redirect.
            return RedirectResult(url.scriptRelativeFull(buglist[0][0]))

        def gen():
            for (name, urgency, description) in buglist:
                if urgency == "unknown":
                    urgency = ""
                yield self.make_xref(url, name), urgency, description

562 563 564 565 566 567 568
        if fake_bug:
            intro = """The URL you used contained a non-stable name
based on a Debian bug number.  This name cannot be mapped to a specific
issue. """
        else:
            intro = ""

569 570
        return self.create_page(
            url, "Information related to Debian bug #%d" % bugnumber,
571
            [P(intro + "The following issues reference to Debian bug ",
572 573 574
               self.make_debian_bug(url, bugnumber), ":"),
             make_table(gen(),
                        caption=("Name", "Urgency", "Description"))])
575 576 577 578 579 580 581 582

    def page_not_found(self, url, query):
        return self.create_page(url, 'Not found',
                                [P('Your query ',
                                   CODE(query),
                                   ' matched no results.')],
                                status=404)

583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602
    def page_report(self, path, params, url):
        return self.create_page(
            url, 'Reporting discrepancies in the data',
            [P("""The data in this tracker is always in flux, as bugs are fixed and new
issues disclosed, the data contained herein is updated. We strive to
maintain complete and accurate state information, and appreciate any
updates in status, information or new issues."""),
             P("There are three ways that you can report updates to this information:"),
             make_numbered_list(
            [P("""IRC: We can be found at """,
               CODE("irc.oftc.net"),
               ", ",
               CODE("#debian-security"),
    """. If you have information to report, please go ahead and join
the channel and tell us.  Please feel free to state the issue,
regardless if there is someone who has acknowledged you. Many of us
idle on this channel and may not be around when you join, but we read
the backlog and will see what you have said. If you require a
response, do not forget to let us know how to get a hold of you."""),
             P("Mailing list: Our mailing list is: ",
603 604
               A("mailto:debian-security-tracker@lists.debian.org",
                 "debian-security-tracker@lists.debian.org")),
605 606 607
             P("""Helping out: We welcome people who wish to join us in tracking
issues. The process is designed to be easy to learn and participate,
please read our """,
608
               A("https://security-team.debian.org/security_tracker.html",
609 610
                 "Introduction"),
               """ to get familiar with how things work.  Join us on
611 612
our mailing list, and on IRC and request to be added to the Salsa """,
               A("https://salsa.debian.org/security-tracker-team/security-tracker/", "project"),
613 614 615 616
               """. We are really quite friendly. If you have a
question about how things work, don't be afraid to ask, we would like
to improve our documentation and procedures, so feedback is welcome.""")])])

617 618
    def page_source_package(self, path, params, url):
        pkg = path[0]
619
        data = security_db.getBugsForSourcePackage(self.db.cursor(), pkg)
620

621
        def gen_versions():
622 623 624
            for (release, version) in self.db.getSourcePackageVersions(
                    self.db.cursor(), pkg):
                yield release, version
625
        def gen_bug_list(lst):
626 627
            for bug in lst:
                yield self.make_xref(url, bug.bug), bug.description
628

629 630 631 632 633
        def format_summary_entry(per_release):
            if per_release is None:
                return self.make_purple('unknown')
            if per_release.vulnerable == 1:
                if per_release.state == 'no-dsa':
634 635 636 637 638 639 640
                    if per_release.reason:
                        text = 'vulnerable (no DSA, %s)' % per_release.reason
                    else:
                        text = 'vulnerable (no DSA)'
                    hint = per_release.comment
                    return self.make_mouseover((self.make_yellow(text),),
                                               text=hint)
641 642 643 644 645 646
                else:
                    return self.make_red('vulnerable')
            if per_release.vulnerable == 2:
                return self.make_purple('undetermined')
            assert per_release.vulnerable == 0
            return self.make_green('fixed')
647 648

        def gen_summary(bugs):
649
            for bug in bugs:
650 651 652
                status_row = tuple(
                    format_summary_entry(bug.releases.get(rel, None))
                    for rel in data.all_releases)
653 654
                yield (self.make_xref(url, bug.bug),) + status_row \
                    + (bug.description,)
655

656
        return self.create_page(
657
            url, 'Information on source package ' + pkg,
658 659 660 661 662
            [make_menu(lambda x: x,
                       (self.url_pts(url, pkg),
                        pkg + ' in the Package Tracking System'),
                       (self.url_debian_bug_pkg(url, pkg),
                        pkg + ' in the Bug Tracking System'),
663 664
                       (self.url_source_code(url, pkg),
                        pkg + ' source code'),
665 666
                       (self.url_testing_status(url, pkg),
                        pkg + ' in the testing migration checker')),
667
             make_table(gen_versions(), title=H2('Available versions'), caption=('Release', 'Version')),
668

669
             make_table(
670
                 gen_summary(data.open),
671
                 title=H2('Open issues'),
672
                 caption=('Bug',) + data.all_releases + ('Description',),
673 674 675
                 replacement='No known open issues.'
             ),

676

677
             make_table(
678
                 gen_summary(data.unimportant),
679
                 title=H2('Open unimportant issues'),
680
                 caption=('Bug',) + data.all_releases + ('Description',),
681 682
                 replacement='No known unimportant issues.'
             ),
683

684
             make_table(gen_bug_list(data.resolved),
685
                        title=H2('Resolved issues'),
686
                        caption=('Bug', 'Description'),
687
                        replacement='No known resolved issues.'),
688

689 690
             make_table(gen_bug_list(self.db.getDSAsForSourcePackage
                                     (self.db.cursor(), pkg)),
691
                        title=H2('Security announcements'),
Holger Levsen's avatar
Holger Levsen committed
692
                        caption=('DSA / DLA', 'Description'),
693 694
                        replacement='No known security announcements.')
             ])
695

696 697
    def page_status_release_stable_oldstable_oldoldstable(self, release, params, url):
        assert release in ('stable', 'oldstable', 'oldoldstable',)
698

699
        bf = BugFilter(params)
700

701 702
        def gen():
            old_pkg_name = ''
703
            for (pkg_name, bug_name, archive, urgency, vulnerable, remote, no_dsa, no_dsa_reason) in \
704
                    self.db.cursor().execute(
705
                """SELECT package, bug, section, urgency, vulnerable, remote, no_dsa, no_dsa_reason
706 707
                FROM %s_status
                WHERE (bug LIKE 'CVE-%%' OR bug LIKE 'TEMP-%%')""" % release):
708
                if bf.urgencyFiltered(urgency, vulnerable):
709 710 711
                    continue
                if bf.remoteFiltered(remote):
                    continue
712 713
                if bf.nodsaFiltered(no_dsa):
                    continue
714 715 716 717
                if bf.ignoredFiltered(no_dsa_reason):
                    continue
                if bf.postponedFiltered(no_dsa_reason):
                    continue
718

719 720
                if pkg_name == old_pkg_name:
                    pkg_name = ''
721
                    title = None
722 723
                else:
                    old_pkg_name = pkg_name
724
                    title = None
725
                    if archive != 'main':
726
                        title = "%s (%s)" % (pkg_name, archive)
727

728
                if remote is None:
729
                    remote = '?'
730 731 732 733 734
                elif remote:
                    remote = 'yes'
                else:
                    remote = 'no'

735
                if urgency.startswith('high'):
736
                    urgency = self.make_red(urgency)
737 738
                elif vulnerable == 2:
                    urgency = self.make_purple(urgency)
739 740 741
                else:
                    if no_dsa:
                        urgency = urgency + '*'
742

743
                yield self.make_source_package_ref(url, pkg_name, title), self.make_xref(url, bug_name), urgency, remote
744 745

        return self.create_page(
746
            url, 'Vulnerable source packages in the %s suite' % release,
747
            [bf.actions(url), BR(),
748 749 750 751
             make_table(gen(), caption=("Package", "Bug", "Urgency", "Remote")),
             P('''If a "*" is included in the urgency field, no DSA is planned
                  for this vulnerability.'''),
             self.nvd_text])
752 753

    def page_status_release_stable(self, path, params, url):
754
        return self.page_status_release_stable_oldstable_oldoldstable('stable', params, url)
Thijs Kinkhorst's avatar
Thijs Kinkhorst committed
755
    def page_status_release_oldstable(self, path, params, url):
756 757
        return self.page_status_release_stable_oldstable_oldoldstable('oldstable',
                                                         params, url)
Holger Levsen's avatar
Holger Levsen committed
758
    def page_status_release_oldoldstable(self, path, params, url):
759
        return self.page_status_release_stable_oldstable_oldoldstable('oldoldstable',
Thijs Kinkhorst's avatar
Thijs Kinkhorst committed
760
                                                         params, url)
761

762
    def page_status_release_testing(self, path, params, url):
763
        bf = BugFilter(params)
764

765 766
        def gen():
            old_pkg_name = ''
767
            for (pkg_name, bug_name, archive, urgency, vulnerable,
768 769
                 sid_vulnerable, ts_fixed, remote, no_dsa) \
                 in self.db.cursor().execute(
770 771
                """SELECT package, bug, section, urgency, vulnerable,
                unstable_vulnerable, testing_security_fixed, remote, no_dsa
772
                FROM testing_status"""):
773
                if bf.urgencyFiltered(urgency, vulnerable):
774 775 776
                    continue
                if bf.remoteFiltered(remote):
                    continue
777 778
                if bf.nodsaFiltered(no_dsa):
                    continue
779

780 781
                if pkg_name == old_pkg_name:
                    pkg_name = ''
782
                    title = None
783 784
                else:
                    old_pkg_name = pkg_name
785
                    title = None
786
                    if archive != 'main':
787
                        title = "%s (%s)" % (pkg_name, archive)
788

789
                if remote is None:
790
                    remote = '?'
791 792 793 794 795
                elif remote:
                    remote = 'yes'
                else:
                    remote = 'no'

796 797 798 799 800 801 802 803
                if ts_fixed:
                    status = 'fixed in testing-security'
                else:
                    if sid_vulnerable:
                        status = self.make_red('unstable is vulnerable')
                    else:
                        status = self.make_dangerous('fixed in unstable')

804 805 806 807 808
                if urgency.startswith('high'):
                    urgency = self.make_red(urgency)
                elif vulnerable == 2:
                    urgency = self.make_purple(urgency)

809
                yield (self.make_source_package_ref(url, pkg_name, title), self.make_xref(url, bug_name),
810
                       urgency, remote, status)
811 812 813 814 815

        return self.create_page(
            url, 'Vulnerable source packages in the testing suite',
            [make_menu(url.scriptRelative,
                       ("status/dtsa-candidates", "Candidates for DTSAs")),
816
             bf.actions(url), BR(),
817
             make_table(gen(), caption=("Package", "Bug", "Urgency", "Remote", 'Status')),
818
             self.nvd_text])
819

820
    def page_status_release_unstable_like(self, path, params, url,
821
                                          rel, title, subrel=""):
822
        bf = BugFilter(params,nonodsa=True,noignored=True,nopostponed=True)
823

824 825
        def gen():
            old_pkg_name = ''
826
            for (pkg_name, bug_name, section, urgency, vulnerable, remote) \
827 828
                    in self.db.cursor().execute(
                """SELECT DISTINCT sp.name, st.bug_name,
829
                sp.archive, st.urgency, st.vulnerable,
830 831
                (SELECT range_remote FROM nvd_data
                 WHERE cve_name = st.bug_name)
832
                FROM source_package_status AS st, source_packages AS sp
833
                WHERE st.vulnerable AND sp.rowid = st.package
834 835
                AND sp.release = ?  AND sp.subrelease = ''
                ORDER BY sp.name, st.bug_name""", (rel,)):
836
                if bf.urgencyFiltered(urgency, vulnerable):
837 838 839 840
                    continue
                if bf.remoteFiltered(remote):
                    continue

841 842
                if pkg_name == old_pkg_name:
                    pkg_name = ''
843
                    title = None
844 845
                else:
                    old_pkg_name = pkg_name
846
                    title = None
847
                    if section != 'main':
848
                        title = "%s (%s)" % (pkg_name, section)
849

850
                if remote is None:
851
                    remote = '?'
852 853 854 855 856
                elif remote:
                    remote = 'yes'
                else:
                    remote = 'no'

857
                if urgency.startswith('high'):
858
                    urgency = self.make_red(urgency)
859
                elif vulnerable == 2:
860
                    urgency = self.make_purple(urgency)
861

862
                yield self.make_source_package_ref(url, pkg_name, title), self.make_xref(url, bug_name), urgency, remote
863

864
        return self.create_page(
865
            url, title,
866 867 868
            [P("""Note that the list below is based on source packages.
            This means that packages are not listed here once a new,
            fixed source version has been uploaded to the archive, even
Thijs Kinkhorst's avatar
Thijs Kinkhorst committed
869
            if there are still some vulnerable binary packages present
870
            in the archive."""),
871
             bf.actions(url), BR(),
872 873
             make_table(gen(), caption=('Package', 'Bug', 'Urgency', 'Remote')),
             self.nvd_text])
874

875 876 877 878
    def page_status_release_unstable(self, path, params, url):
        return self.page_status_release_unstable_like(
            path, params, url,
            title='Vulnerable source packages in the unstable suite',
879
            rel='sid')
880 881 882 883 884

    def page_status_release_stable_backports(self, path, params, url):
        return self.page_status_release_unstable_like(
            path, params, url,
            title='Vulnerable source packages among backports for stable',
885
            rel='buster-backports')
886

887 888 889 890
    def page_status_release_oldstable_backports(self, path, params, url):
        return self.page_status_release_unstable_like(
            path, params, url,
            title='Vulnerable source packages among backports for oldstable',
891
            rel='stretch-backports')
892 893 894 895 896

    def page_status_release_oldoldstable_backports(self, path, params, url):
        return self.page_status_release_unstable_like(
            path, params, url,
            title='Vulnerable source packages among backports for oldoldstable',
897
            rel='jessie-backports')
898

899

900
    def page_status_dtsa_candidates(self, path, params, url):
901
        bf = BugFilter(params,nonodsa=True,noignored=True,nopostponed=True)
902

903 904
        def gen():
            old_pkg_name = ''
905 906
            for (pkg_name, bug_name, archive, urgency, vulnerable,
                 stable_later, remote) \
907
                    in self.db.cursor().execute(
908
                """SELECT package, bug, section, urgency, vulnerable,
909 910 911
                (SELECT testing.version_id < stable.version_id
                 FROM source_packages AS testing, source_packages AS stable
                 WHERE testing.name = testing_status.package
912
                 AND testing.release = 'bullseye'
913 914 915
                 AND testing.subrelease = ''
                 AND testing.archive = testing_status.section
                 AND stable.name = testing_status.package
916
                 AND stable.release = 'buster'
917
                 AND stable.subrelease = 'security'
918 919 920
                 AND stable.archive = testing_status.section),
                (SELECT range_remote FROM nvd_data
                 WHERE cve_name = bug)
921 922 923
                FROM testing_status
                WHERE (NOT unstable_vulnerable)
                AND (NOT testing_security_fixed)"""):
924
                if bf.urgencyFiltered(urgency, vulnerable):
925 926 927 928
                    continue
                if bf.remoteFiltered(remote):
                    continue

929 930 931
                if pkg_name == old_pkg_name:
                    pkg_name = ''
                    migration = ''
932
                    title = None
933 934
                else:
                    old_pkg_name = pkg_name
935
                    title = None
936 937
                    migration = A(self.url_testing_status(url, pkg_name),
                                  "check")
938
                    if archive != 'main':
939
                        title = "%s (%s)" % (pkg_name, archive)
940

941
                if remote is None:
942
                    remote = '?'
943 944 945 946 947
                elif remote:
                    remote = 'yes'
                else:
                    remote = 'no'

948
                if urgency.startswith('high'):
949
                    urgency = self.make_red(urgency)
950 951
                elif vulnerable == 2:
                    urgency = self.make_purple(urgency)
952 953 954 955 956 957

                if stable_later:
                    notes = "(fixed in stable?)"
                else:
                    notes = ''

958
                yield (self.make_source_package_ref(url, pkg_name, title), migration, self.make_xref(url, bug_name),
959
                       urgency, remote, notes)
960 961 962 963 964

        return self.create_page(
            url, "Candidates for DTSAs",
            [P("""The table below lists packages which are fixed
in unstable, but unfixed in testing.  Use the testing migration
965
checker to find out why they have not entered testing yet."""),
966 967 968
             make_menu(url.scriptRelative,
                       ("status/release/testing",
                        "List of vulnerable packages in testing")),
969
             bf.actions(url), BR(),
970
             make_table(gen(),
971
                        caption=("Package", "Migration", "Bug", "Urgency",
972
                                 "Remote", ""))])
973 974

    def page_status_todo(self, path, params, url):
975 976 977 978 979 980 981
        hide_check = params.get('hide_check', False)
        if hide_check:
            flags = A(url.updateParamsDict({'hide_check' : None}),
                      'Show "check" TODOs')
        else:
            flags = A(url.updateParamsDict({'hide_check' : '1'}),
                  'Hide "check" TODOs')
982

983
        def gen():
984 985
            for (bug, description, note) in self.db.getTODOs(hide_check=hide_check):
                yield self.make_xref(url, bug), description, note
986
        return self.create_page(
987 988
            url, 'Bugs with TODO items',
            [P(flags), make_table(gen(), caption=('Bug', 'Description', 'Note'))])
989 990 991 992 993 994 995 996

    def page_status_undetermined(self, path, params, url):
        def gen():
            outrel = []
            old_bug = ''
            old_pkg = ''
            old_dsc = ''
            last_displayed = ''
997
            releases = ('sid', 'bullseye', 'buster', 'stretch', 'jessie')
998 999 1000 1001 1002 1003
            for (pkg_name, bug_name, release, desc) in self.db.cursor().execute(
                    """SELECT DISTINCT sp.name, st.bug_name, sp.release,
                    bugs.description
                    FROM source_package_status AS st, source_packages AS sp, bugs
                    WHERE st.vulnerable == 2 AND sp.rowid = st.package
                    AND ( sp.release = ? OR sp.release = ? OR sp.release = ?
1004
                    OR sp.release = ? OR sp.release = ? )
1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041
                    AND sp.subrelease = '' AND st.bug_name == bugs.name
                    ORDER BY sp.name, st.bug_name""", releases):

                if old_bug == '':
                    old_bug = bug_name
                    old_pkg = pkg_name
                    old_dsc = desc
                elif old_bug != bug_name:
                    if old_pkg == last_displayed:
                        to_display = ''
                    else:
                        to_display = old_pkg
                    yield to_display, self.make_xref(url, old_bug), old_dsc, ', '.join(outrel)
                    last_displayed = old_pkg
                    old_bug = bug_name
                    old_pkg = pkg_name
                    old_dsc = desc
                    outrel = []
                outrel.append( release )
            yield old_pkg, self.make_xref(url, old_bug), old_dsc, ', '.join(outrel)

        return self.create_page(url, 'Packages that may be vulnerable but need to be checked      (undetermined issues)',
            [P("""This page lists packages that may or may not be affected
            by known issues.  This means that some additional work needs to
            be done to determined whether the package is actually
            vulnerable or not.  This list is a good area for new
            contributors to make quick and meaningful contributions."""),
            make_table(gen(), caption=('Package', 'Bug', 'Description', 'Releases'))])

    def page_status_unimportant(self, path, params, url):
        def gen():
            outrel = []
            old_bug = ''
            old_pkg = ''
            old_dsc = ''
            old_name = ''
            last_displayed = ''
1042
            releases = ('sid', 'bullseye', 'buster', 'stretch', 'jessie')
1043 1044 1045 1046 1047 1048
            for (pkg_name, bug_name, release, desc) in self.db.cursor().execute(
                    """SELECT DISTINCT sp.name, st.bug_name, sp.release,
                    bugs.description
                    FROM source_package_status AS st, source_packages AS sp, bugs
                    WHERE st.vulnerable > 0 AND sp.rowid = st.package
                    AND ( sp.release = ? OR sp.release = ? OR sp.release = ?
1049
                    OR sp.release = ? OR sp.release = ? ) AND st.urgency == 'unimportant'
1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076
                    AND sp.subrelease = '' AND st.bug_name == bugs.name
                    ORDER BY sp.name, st.bug_name""", releases):

                if old_bug == '':
                    old_bug = bug_name
                    old_pkg = pkg_name
                    old_dsc = desc
                elif old_bug != bug_name:
                    if old_pkg == last_displayed:
                        to_display = ''
                    else:
                        to_display = old_pkg
                    yield to_display, self.make_xref(url, old_bug), old_dsc, ', '.join(outrel)
                    last_displayed = old_pkg
                    old_bug = bug_name
                    old_pkg = pkg_name
                    old_dsc = desc
                    outrel = []
                outrel.append( release )
            yield old_pkg, self.make_xref(url, old_bug), old_dsc, ', '.join(outrel)

        return self.create_page(url, 'Packages that have open unimportant issues',
            [P("""This page lists packages that are affected by issues
            that are considered unimportant from a security perspective.
            These issues are thought to be unexploitable or uneffective
            in most situations (for example, browser denial-of-services)."""),
            make_table(gen(), caption=('Package', 'Bug', 'Description', 'Releases'))])
1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092

    def page_status_itp(self, path, params, url):
        def gen():
            old_pkg = ''
            for pkg, bugs, debian_bugs in self.db.getITPs(self.db.cursor()):
                if pkg == old_pkg:
                    pkg = ''
                else:
                    old_pkg = pkg
                yield (pkg, self.make_xref_list(url, bugs),
                       self.make_debian_bug_list(url, debian_bugs))
        return self.create_page(
            url, "ITPs with potential security issues",
            [make_table(gen(), caption=("Package", "Issue", "Debian Bugs"),
                        replacement="No ITP bugs are currently known.")])

1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104
    def page_status_unreported(self, path, params, url):
        def gen():
            for (bug, packages) in self.db.getUnreportedVulnerabilities():
                pkgs = make_list([self.make_source_package_ref(url, pkg)
                                  for pkg in packages], ", ")
                yield self.make_xref(url, bug), pkgs
        return self.create_page(
            url, "Unfixed vulnerabilities in unstable without a filed bug",
            [P("""The list below contains vulnerabilities for which no matching
Debian bug has been filed, and there is still an unfixed package in sid."""),
             make_table(gen(), caption=("Bug", "Packages"))])

1105 1106 1107 1108 1109 1110 1111 1112
    def page_data_unknown_packages(self, path, params, url):
        def gen():
            for name, bugs in self.db.getUnknownPackages(self.db.cursor()):
                yield name, self.make_xref_list(url, bugs)
        return self.create_page(
            url, "Unknown packages",
            [P("""Sometimes, a package referenced in a bug report
cannot be found in the database.  This can be the result of a spelling
Thijs Kinkhorst's avatar
Thijs Kinkhorst committed
1113 1114
error, or a historic entry refers to a
package which is no longer in the archive."""),
1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151
             make_table(gen(), caption=("Package", "Bugs"),
        replacement="No unknown packages are referenced in the database.")])

    def page_data_missing_epochs(self, path, params, url):
        def gen():
            old_bug = ''
            old_pkg = ''
            for bug, pkg, ver1, ver2 in self.db.cursor().execute(
                """SELECT DISTINCT bug_name, n.package,
                n.fixed_version, sp.version
                FROM package_notes AS n, source_packages AS sp
                WHERE n.package_kind = 'source'
                AND n.fixed_version NOT LIKE '%:%'
                AND n.fixed_version <> '0'
                AND n.bug_origin = ''
                AND sp.name = n.package
                AND sp.version LIKE '%:%'
                ORDER BY bug_name, package"""):
                if bug == old_bug:
                    bug = ''
                else:
                    old_bug = bug
                    old_pkg = ''
                    bug = self.make_xref(url, bug)
                if pkg == old_pkg:
                    pkg = ''
                else:
                    old_pkg = pkg
                    pkg = self.make_source_package_ref(url, pkg)
                yield bug, pkg, ver1, ver2

        return self.create_page(
            url, "Missing epochs in package versions",
            [make_table(gen(),
                caption=("Bug", "Package", "Version 1", "Version 2"),
                replacement="No source package version with missing epochs.")])

1152 1153 1154 1155 1156 1157
    def page_data_latently_vulnerable(self, path, params, url):
        def gen():
            for pkg, bugs in self.db.cursor().execute(
                """SELECT package, string_set(bug_name)
                FROM package_notes AS p1
                WHERE release <> ''
1158
                AND (bug_name LIKE 'CVE-%' OR bug_name LIKE 'TEMP-%')
1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170
                AND NOT EXISTS (SELECT 1 FROM package_notes AS p2
                                WHERE p2.bug_name = p1.bug_name
                                AND p2.package = p1.package
                                AND release = '')
                AND EXISTS (SELECT 1 FROM source_packages
                           WHERE name = p1.package AND release = 'sid')
                GROUP BY package
                ORDER BY package"""):
                pkg = self.make_source_package_ref(url, pkg)
                bugs = bugs.split(',')
                yield pkg, self.make_xref_list(url, bugs)

1171 1172 1173 1174 1175 1176
        def gen_unimportant():
            for pkg, bugs in self.db.cursor().execute(
                """SELECT package, string_set(bug_name)
                FROM package_notes AS p1
                WHERE release <> ''
                AND urgency <> 'unimportant'
1177
                AND (bug_name LIKE 'CVE-%' OR bug_name LIKE 'TEMP-%')
1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194
                AND EXISTS (SELECT 1 FROM package_notes AS p2
                                WHERE p2.bug_name = p1.bug_name
                                AND p2.package = p1.package
                                AND release = '')
                AND NOT EXISTS (SELECT 1 FROM package_notes AS p2
                                WHERE p2.bug_name = p1.bug_name
                                AND p2.package = p1.package
                                AND urgency <> 'unimportant'
                                AND release = '')
                AND EXISTS (SELECT 1 FROM source_packages
                           WHERE name = p1.package AND release = 'sid')
                GROUP BY package
                ORDER BY package"""):
                pkg = self.make_source_package_ref(url, pkg)
                bugs = bugs.split(',')
                yield pkg, self.make_xref_list(url, bugs)

1195 1196 1197 1198 1199 1200 1201 1202 1203
        return self.create_page(
            url, "Latently vulnerable packages in unstable",
            [P(
"""A package is latently vulnerable in unstable if it is vulnerable in
any release, and there is no package note for the same vulnerability
and package in unstable (and the package is still available in
unstable, of course)."""),
             make_table(gen(),
                caption=("Package", "Bugs"),
1204 1205 1206 1207 1208 1209 1210 1211 1212 1213
                replacement="No latently vulnerable packages were found."),
             P(
"""The next table lists issues which are marked unimportant for
unstable, but for which release-specific annotations exist which are
not unimportant."""),
             make_table(gen_unimportant(),
                caption=("Package", "Bugs"),
                replacement=
    "No packages with unimportant latent vulnerabilities were found."),
            ])
1214

1215 1216 1217 1218 1219 1220 1221 1222
    def page_data_releases(self, path, params, url):
        def gen():
            for (rel, subrel, archive, sources, archs) \
                    in self.db.availableReleases():
                if sources:
                    sources = 'yes'
                else:
                    sources = 'no'
1223 1224
                if 'source' in archs:
                    archs.remove('source')
1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249
                yield rel, subrel, archive, sources, make_list(archs)
        return self.create_page(
            url, "Available releases",
            [P("""The security issue database is checked against
the Debian releases listed in the table below."""),
             make_table(gen(),
                        caption=("Release", "Subrelease", "Archive",
                                 "Sources", "Architectures"))])

    def page_data_funny_versions(self, path, params, url):
        def gen():
            for name, release, archive, version, source_version \
                in self.db.getFunnyPackageVersions():
                yield name, release, archive, source_version, version

        return self.create_page(
            url, "Version conflicts between source/binary packages",
            [P("""The table below lists source packages
            which have a binary package of the same name, but with a different
            version.  This means that extra care is necessary to determine
            the version of a package which has been fixed.  (Note that
            the bug tracker prefers source versions to binary versions
            in this case.)"""),
             make_table(gen(),
                        caption=("Package",
1250
                                 "Release",
1251 1252 1253 1254 1255 1256 1257 1258 1259 1260
                                 "Archive",
                                 "Source Version",
                                 "Binary Version")),