CVE-2022-23949 (Python, published 2022-09-21T19:15Z)
Description: value: In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-290 \u2014 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Repository: https://github.com/keylime/keylime
Files changed:
keylime/cloud_verifier_common.py
keylime/common/validators.py
keylime/config.py
keylime/ima.py
keylime/keylime_agent.py
test/test_validators.py
Commit message: validators: create validators module

Move from the config module some validators, and create the validators
module.  Add tests for them.

Signed-off-by: Alberto Planas <aplanas@suse.com>


Vulnerable code:
from keylime.common import algorithms
    is_valid, _, err_msg = config.valid_exclude_list(lists.get('exclude'))
import re
def valid_exclude_list(exclude_list):
    if not exclude_list:
        return True, None, None

    combined_regex = "(" + ")|(".join(exclude_list) + ")"
    return valid_regex(combined_regex)


def valid_regex(regex):
    if regex is None:
        return True, None, None

    try:
        compiled_regex = re.compile(regex)
    except re.error as regex_err:
        err = "Invalid regex: " + regex_err.msg + "."
        return False, None, err

    return True, compiled_regex, None


def valid_hex(value: str):
    if not value.isalnum():
        return False
    try:
        int(value, 16)
        return True
    except ValueError:
        return False


from keylime import keylime_logging
from keylime.agentstates import AgentAttestState
from keylime.common.algorithms import Hash
    ima_log_hash_alg = Hash.SHA1
            ima_log_hash_alg = Hash(allow_list["ima"]["log_hash_alg"])

    is_valid, compiled_regex, err_msg = config.valid_exclude_list(exclude_list)
                             boot_aggregates=None, hash_alg=Hash.SHA1):
from keylime.common import algorithms
                    (pcrmask is None or config.valid_hex(pcrmask)) and

Fixed code:
from keylime.common import algorithms, validators
    is_valid, _, err_msg = validators.valid_exclude_list(lists.get('exclude'))
"""Validators module."""
import re


def valid_regex(regex):
    """Check if string is a valid regular expression."""
    if regex is None:
        return True, None, None

    try:
        compiled_regex = re.compile(regex)
    except re.error as regex_err:
        err = "Invalid regex: " + regex_err.msg + "."
        return False, None, err

    return True, compiled_regex, None


def valid_exclude_list(exclude_list):
    """Check if the list is composed of valid regex."""
    if not exclude_list:
        return True, None, None

    combined_regex = "(" + ")|(".join(exclude_list) + ")"
    return valid_regex(combined_regex)


def valid_hex(value):
    """Check if the string is a valid hex number representation."""
    try:
        int(value, 16)
    except Exception:
        return False
    return True
from keylime import keylime_logging
from keylime.agentstates import AgentAttestState
from keylime.common import algorithms, validators
    ima_log_hash_alg = algorithms.Hash.SHA1
            ima_log_hash_alg = algorithms.Hash(allow_list["ima"]["log_hash_alg"])
    is_valid, compiled_regex, err_msg = validators.valid_exclude_list(exclude_list)
                             boot_aggregates=None, hash_alg=algorithms.Hash.SHA1):
from keylime.common import algorithms, validators
                    (pcrmask is None or validators.valid_hex(pcrmask)) and
import unittest

from keylime.common import validators


class TestValidRegex(unittest.TestCase):
    """Tests for valid_regex."""

    def test_none(self):
        """Check that None is a valid regex."""
        self.assertEqual(validators.valid_regex(None), (True, None, None))

    def test_valid(self):
        """Check a well formed regex."""
        value = validators.valid_regex(r"a.*")
        self.assertTrue(value[0])
        self.assertEqual(value[1].pattern, r"a.*")
        self.assertEqual(value[2], None)

    def test_invalid(self):
        """Check a not valid regex."""
        value = validators.valid_regex(r"a[")
        self.assertEqual(
            value, (False, None, "Invalid regex: unterminated character set.")
        )


class TestValidExcludeList(unittest.TestCase):
    """Tests for valid_exclude_list."""

    def test_none(self):
        """Check that the empty list is valid."""
        self.assertEqual(validators.valid_exclude_list(None), (True, None, None))

    def test_single(self):
        """Check a single exclude list element."""
        value = validators.valid_exclude_list([r"a.*"])
        self.assertTrue(value[0])
        self.assertEqual(value[1].pattern, r"(a.*)")
        self.assertEqual(value[2], None)

    def test_multi(self):
        """Check a multiple elements exclude list."""
        value = validators.valid_exclude_list([r"a.*", r"b.*"])
        self.assertTrue(value[0])
        self.assertEqual(value[1].pattern, r"(a.*)|(b.*)")
        self.assertEqual(value[2], None)

    def test_invalid(self):
        """Check an invalid exclude list."""
        value = validators.valid_exclude_list([r"a["])
        self.assertEqual(
            value, (False, None, "Invalid regex: unterminated character set.")
        )


class TestValidHex(unittest.TestCase):
    """Tests for valid_hex."""

    def test_none(self):
        """Check that None is not valid."""
        self.assertFalse(validators.valid_hex(None))

    def test_empty(self):
        """Check that the empty string is not valid."""
        self.assertFalse(validators.valid_hex(""))

    def test_valid_lower(self):
        """Check a valid lower case hexadecimal number."""
        self.assertTrue(validators.valid_hex("123abc"))

    def test_valid_upper(self):
        """Check a valid upper case hexadecimal number."""
        self.assertTrue(validators.valid_hex("123ABC"))

    def test_invalid(self):
        """Check and invalid hexadecimal number."""
        self.assertFalse(validators.valid_hex("123xyz"))


if __name__ == "__main__":
    unittest.main()