Auto detection mechanism of vulnerabilities for security updates
In an aspect of the disclosure, a method, a computer-readable medium, and a device are provided. The device the package determination component 430 determines one or more packages distributed in firmware of a BMC. The device determines a respective update of each of the one or more packages. The device determines a first set of security vulnerabilities of the each package that is addressed by the respective update. The device further determines a second set of security vulnerabilities of the each package after the respective update is applied. The device generates a first file indicating the first set of security vulnerabilities and the second set of security vulnerabilities.
1. A method of operating a computer system, comprising:
determining two or more packages distributed in firmware of a baseboard management controller (BMC);
determining a respective update of each of the two or more packages;
determining a first set of security vulnerabilities of the each package that is addressed by the each package;
determining a second set of security vulnerabilities of the each package that is addressed by the each package after the respective update is applied;
generating a first file indicating a difference between the first set of security vulnerabilities and the second set of security vulnerabilities;
determining a third set of security vulnerabilities of the each package that is discovered security vulnerabilities of the each package; and
generating a second file indicating a difference between the second set of security vulnerabilities and the third set of security vulnerabilities.
2. The method of claim 1 , further comprising:
determining a first version of the each package based on information stored in a package repository, wherein the respective update of the each package constitutes a second version of the each package.
3. The method of claim 2 , further comprising:
obtaining information of updates of the first version from a package release database, wherein the second version is determined based on the information of updates.
4. The method of claim 3 , further comprising:
obtaining, from the package release database, information of the first version including the first set of security vulnerabilities; and
obtaining, from the package release database, information of the second version including the second set of security vulnerabilities.
5. The method of claim 4 , further comprising:
obtaining, from a security vulnerability database, information of the each package including the third set of security vulnerabilities of the each package; and
comparing the third set of security vulnerabilities with the second set of the security vulnerabilities, wherein the difference between the second set of security vulnerabilities and the third set of security vulnerabilities is determined based on a result of the comparison.
6. The method of claim 3 , further comprising:
retrieving the respective update of the each package from the package release database; and
storing the respective update in the package repository.
7. An apparatus, comprising:
a memory; and
at least one processor coupled to the memory and configured to:
determine two or more packages distributed in firmware of a baseboard management controller (BMC);
determine a respective update of each of the two or more packages;
determine a first set of security vulnerabilities of the each package that is addressed by the each package;
determine a second set of security vulnerabilities of the each package that is addressed by the each package after the respective update is applied;
generate a first file indicating a difference between the first set of security vulnerabilities and the second set of security vulnerabilities;
determine a third set of security vulnerabilities of the each package that is discovered security vulnerabilities of the each package; and
generate a second file indicating a difference between the second set of security vulnerabilities and the third set of security vulnerabilities.
8. The apparatus of claim 7 , wherein the at least one processor is further configured to:
determine a first version of the each package based on information stored in a package repository, wherein the respective update of the each package constitutes a second version of the each package.
9. The apparatus of claim 8 , wherein the at least one processor is further configured to:
obtain information of updates of the first version from a package release database, wherein the second version is determined based on the information of updates.
10. The apparatus of claim 9 , wherein the at least one processor is further configured to:
obtain, from the package release database, information of the first version including the first set of security vulnerabilities; and
obtain, from the package release database, information of the second version including the second set of security vulnerabilities.
11. The apparatus of claim 10 , wherein the at least one processor is further configured to:
obtain, from a security vulnerability database, information of the each package including the third set of security vulnerabilities of the each package; and
compare the third set of security vulnerabilities with the second set of the security vulnerabilities, wherein the difference between the second set of security vulnerabilities and the third set of security vulnerabilities is determined based on a result of the comparison.
12. The apparatus of claim 9 , wherein the at least one processor is further configured to:
retrieve the respective update of the each package from the package release database; and
store the respective update in the package repository.
13. A non-transitory computer-readable medium storing computer executable code for operating a testing platform, comprising code to:
determine two or more packages distributed in firmware of a baseboard management controller (BMC);
determine a respective update of each of the two or more packages;
determine a first set of security vulnerabilities of the each package that is addressed by the each package;
determine a second set of security vulnerabilities of the each package that is addressed by the each package after the respective update is applied;
generate a first file indicating a difference between the first set of security vulnerabilities and the second set of security vulnerabilities;
determine a third set of security vulnerabilities of the each package that is discovered security vulnerabilities of the each package; and
generate a second file indicating a difference between the second set of security vulnerabilities and the third set of security vulnerabilities.
14. The non-transitory computer-readable medium of claim 13 , wherein the code is further configured to:
determine a first version of the each package based on information stored in a package repository, wherein the respective update of the each package constitutes a second version of the each package.
15. The non-transitory computer-readable medium of claim 14 , wherein the code is further configured to:
obtain information of updates of the first version from a package release database, wherein the second version is determined based on the information of updates.
16. The non-transitory computer-readable medium of claim 15 , wherein the code is further configured to:
obtain, from the package release database, information of the first version including the first set of security vulnerabilities; and
obtain, from the package release database, information of the second version including the second set of security vulnerabilities.
17. The non-transitory computer-readable medium of claim 16 , wherein the code is further configured to:
obtain, from a security vulnerability database, information of the each package including the third set of security vulnerabilities of the each package; and
compare the third set of security vulnerabilities with the second set of the security vulnerabilities, wherein the difference between the second set of security vulnerabilities and the third set of security vulnerabilities is determined based on a result of the comparison.