Using rhsecapi to query the Red Hat Security Data API

Updated -

Overview

Note: The following information has been provided by Red Hat, but is outside the scope of the posted Service Level Agreements and support procedures (Production Support - Red Hat Customer Portal). The information is provided as-is and any configuration settings or installed applications made from the information in this article could make the Operating System unsupported by Red Hat Global Support Services. The intent of this article is to provide information to accomplish the system's needs. Use of the information in this article at the user's own risk.

The Red Hat Security Data API 1 is the primary source of Red Hat Security team response. This differs from the OVAL definition dataset 2 provided with Red Hat Enterprise Linux 3 through Red Hat Enterprise Linux 8, as that dataset is only applicable to CVEs 3 that have been addressed via Errata 4.

To simplify the use of the Red Hat Security Data API, the rhsecapi utility is provided as a courtesy to those wishing to make use of that dataset.

Installation

The rhsecapi utility is available via an externally-available COPR repository.

kwalker/rhsecapi Copr

Using the instructions above, the following example commands install the script on a Red Hat Enterprise Linux 7 system.

$ sudo yum-config-manager --add-repo https://copr.fedorainfracloud.org/coprs/kwalker/rhsecapi/repo/epel-7/kwalker-rhsecapi-epel-7.repo
$ sudo yum install rhsecapi

Basic Usage

Query by CVE

Querying a single CVE is as simple as providing it on the command line.

$ rhsecapi CVE-2013-4113

CVE-2013-4113
  SEVERITY : Critical Impact
  DATE     : 2013-07-11
  BUGZILLA : 983689
  FIXED_RELEASES :
   Red Hat Enterprise Linux 5: [php-5.1.6-40.el5_9] via RHSA-2013:1049 (2013-07-12)
   Red Hat Enterprise Linux 5: [php53-5.3.3-13.el5_9.1] via RHSA-2013:1050 (2013-07-12)
   Red Hat Enterprise Linux 6: [php-5.3.3-23.el6_4] via RHSA-2013:1049 (2013-07-12)
   Red Hat Enterprise Linux Extended Lifecycle Support 3: [php-4.3.2-56.ent] via RHSA-2013:1063 (2013-07-15)
   Red Hat Enterprise Linux Extended Lifecycle Support 4: [php-4.3.9-3.37.el4] via RHSA-2013:1063 (2013-07-15)
   Red Hat Enterprise Linux EUS (v. 5.6 server): [php-5.1.6-27.el5_6.5] via RHSA-2013:1061 (2013-07-15)
   Red Hat Enterprise Linux EUS (v. 5.6 server): [php53-5.3.3-1.el5_6.3] via RHSA-2013:1062 (2013-07-15)
   Red Hat Enterprise Linux Extended Update Support 6.2: [php-5.3.3-3.el6_2.10] via RHSA-2013:1061 (2013-07-15)
   Red Hat Enterprise Linux Extended Update Support 6.3: [php-5.3.3-14.el6_3.1] via RHSA-2013:1061 (2013-07-15)
   Red Hat Enterprise Linux Long Life (v. 5.3 server): [php-5.1.6-23.4.el5_3] via RHSA-2013:1061 (2013-07-15)
  FIX_STATES :
   Affected: Red Hat Software Collections 1 for Red Hat Enterprise Linux [php54-php]
   Not affected: Red Hat Enterprise Linux 7 [php]

Multiple CVEs can be provided at one time and each will be retrieved.

$ rhsecapi CVE-2013-4113 CVE-2014-3669

CVE-2013-4113
  SEVERITY : Critical Impact
  DATE     : 2013-07-11
  BUGZILLA : 983689
  FIXED_RELEASES :
   Red Hat Enterprise Linux 5: [php-5.1.6-40.el5_9] via RHSA-2013:1049 (2013-07-12)
   Red Hat Enterprise Linux 5: [php53-5.3.3-13.el5_9.1] via RHSA-2013:1050 (2013-07-12)
   Red Hat Enterprise Linux 6: [php-5.3.3-23.el6_4] via RHSA-2013:1049 (2013-07-12)
   Red Hat Enterprise Linux Extended Lifecycle Support 3: [php-4.3.2-56.ent] via RHSA-2013:1063 (2013-07-15)
   Red Hat Enterprise Linux Extended Lifecycle Support 4: [php-4.3.9-3.37.el4] via RHSA-2013:1063 (2013-07-15)
   Red Hat Enterprise Linux EUS (v. 5.6 server): [php-5.1.6-27.el5_6.5] via RHSA-2013:1061 (2013-07-15)
   Red Hat Enterprise Linux EUS (v. 5.6 server): [php53-5.3.3-1.el5_6.3] via RHSA-2013:1062 (2013-07-15)
   Red Hat Enterprise Linux Extended Update Support 6.2: [php-5.3.3-3.el6_2.10] via RHSA-2013:1061 (2013-07-15)
   Red Hat Enterprise Linux Extended Update Support 6.3: [php-5.3.3-14.el6_3.1] via RHSA-2013:1061 (2013-07-15)
   Red Hat Enterprise Linux Long Life (v. 5.3 server): [php-5.1.6-23.4.el5_3] via RHSA-2013:1061 (2013-07-15)
  FIX_STATES :
   Affected: Red Hat Software Collections 1 for Red Hat Enterprise Linux [php54-php]
   Not affected: Red Hat Enterprise Linux 7 [php]

CVE-2014-3669
  SEVERITY : Moderate Impact
  DATE     : 2014-09-18
  BUGZILLA : 1154500
  FIXED_RELEASES :
   Red Hat Enterprise Linux 5: [php53-5.3.3-26.el5_11] via RHSA-2014:1768 (2014-10-30)
   Red Hat Enterprise Linux 5: [php-5.1.6-45.el5_11] via RHSA-2014:1824 (2014-11-06)
   Red Hat Enterprise Linux 6: [php-5.3.3-40.el6_6] via RHSA-2014:1767 (2014-10-30)
   Red Hat Enterprise Linux 7: [php-5.4.16-23.el7_0.3] via RHSA-2014:1767 (2014-10-30)
   Red Hat Enterprise Linux Extended Update Support 6.5: [php-5.3.3-27.el6_5.3] via RHSA-2015:0021 (2015-01-08)
   Red Hat Software Collections 1 for Red Hat Enterprise Linux 6: [php54-php-5.4.16-22.el6] via RHSA-2014:1765 (2014-10-30)
   Red Hat Software Collections 1 for Red Hat Enterprise Linux 6: [php55-php-5.5.6-13.el6] via RHSA-2014:1766 (2014-10-30)
   Red Hat Software Collections 1 for Red Hat Enterprise Linux 7: [php54-php-5.4.16-22.el7] via RHSA-2014:1765 (2014-10-30)
   Red Hat Software Collections 1 for Red Hat Enterprise Linux 7: [php55-php-5.5.6-13.el7] via RHSA-2014:1766 (2014-10-30)
Advanced Queries

The --q-product flag can be used to gather a list of CVEs applicable to a specific product. In the output below, this is being paired with the --q-after <date> flag to limit the returned CVEs to only those since July 1st 2019.

$ rhsecapi --q-product "Red Hat Enterprise Linux 8" --q-after 2019-07-01

CVE ID          PUB DATE    BUGZILLA  SEVERITY   CVSS2  CVSS3  RHSAS  PKGS
CVE-2019-2769   2019-07-16  1730056   moderate          5.3     7      5  
CVE-2019-2818   2019-07-16  1730078   low               3.1     2      2  
CVE-2019-2816   2019-07-16  1730099   moderate          4.8     7      5  
CVE-2019-2842   2019-07-16  1730110   moderate          3.7     5      3  
CVE-2019-2821   2019-07-16  1730251   moderate          5.3     2      2  
CVE-2019-2786   2019-07-16  1730255   low               3.1     7      5  
CVE-2019-2745   2019-07-16  1730411   moderate          5.1     7      5  
CVE-2019-2762   2019-07-16  1730415   moderate          5.3     7      5  
CVE-2019-11709  2019-07-10  1728430   critical          8.8     6      6  
CVE-2019-11711  2019-07-10  1728431   important         7.5     6      6  
CVE-2019-11712  2019-07-10  1728432   important         7.5     6      6  
CVE-2019-11713  2019-07-10  1728433   important         7.5     6      6  
CVE-2019-11715  2019-07-10  1728434   moderate          6.1     6      6  
CVE-2019-11717  2019-07-10  1728435   moderate          6.1     6      6  
CVE-2019-11730  2019-07-10  1728438   moderate          6.1     6      6  
CVE-2019-9811   2019-07-10  1728439   important         7.5     6      6

This can be further limited via the other --q-<type> flags. The example below shows that there has only been a single CVE ranked above a CVSSv3 score of 8:

# rhsecapi --q-product "Red Hat Enterprise Linux 8" --q-after 2019-07-01 --q-cvss3 "8"

CVE ID          PUB DATE    BUGZILLA  SEVERITY  CVSS2  CVSS3  RHSAS  PKGS
CVE-2019-11709  2019-07-10  1728430   critical         8.8     6      6

To show further details beyond the summary above, the -x flag can be provided. This results in the initail list of CVEs returned to be used as a starting point in which to conduct a full query for each.

$ rhsecapi --q-product "Red Hat Enterprise Linux 8" --q-after 2019-07-01 --q-cvss3 "8" -x

CVE-2019-11709
  SEVERITY : Critical Impact
  DATE     : 2019-07-10
  BUGZILLA : 1728430
  FIXED_RELEASES :
   Red Hat Enterprise Linux 6: [firefox-60.8.0-1.el6_10] via RHSA-2019:1765 (2019-07-11)
   Red Hat Enterprise Linux 6: [thunderbird-60.8.0-1.el6_10] via RHSA-2019:1777 (2019-07-15)
   Red Hat Enterprise Linux 7: [firefox-60.8.0-1.el7_6] via RHSA-2019:1763 (2019-07-11)
   Red Hat Enterprise Linux 7: [thunderbird-60.8.0-1.el7_6] via RHSA-2019:1775 (2019-07-15)
   Red Hat Enterprise Linux 8: [firefox-60.8.0-1.el8_0] via RHSA-2019:1764 (2019-07-11)
   Red Hat Enterprise Linux 8: [thunderbird-60.8.0-1.el8_0] via RHSA-2019:1799 (2019-07-16)
  FIX_STATES :
   Out of support scope: Red Hat Enterprise Linux 5 [firefox]

All fields available via the API can be retrieved via the addition of the -a flag:

$ rhsecapi --q-product "Red Hat Enterprise Linux 8" --q-after 2019-07-01 --q-cvss3 "8" -x -a

CVE-2019-11709
  SEVERITY : Critical Impact
  DATE     : 2019-07-10
  CWE      : CWE-120
  CVSS3    : 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
  BUGZILLA : 1728430
  ACKNOWLEDGEMENT :  
   Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Andreea Pavel, Christian Holler, Honza Bambas, Jason Kratzer, and Jeff Gilbert as the original reporters.
  DETAILS  : 
   Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could
   be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
  REFERENCES :
   https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11709
  FIXED_RELEASES :
   Red Hat Enterprise Linux 6: [firefox-60.8.0-1.el6_10] via RHSA-2019:1765 (2019-07-11)
   Red Hat Enterprise Linux 6: [thunderbird-60.8.0-1.el6_10] via RHSA-2019:1777 (2019-07-15)
   Red Hat Enterprise Linux 7: [firefox-60.8.0-1.el7_6] via RHSA-2019:1763 (2019-07-11)
   Red Hat Enterprise Linux 7: [thunderbird-60.8.0-1.el7_6] via RHSA-2019:1775 (2019-07-15)
   Red Hat Enterprise Linux 8: [firefox-60.8.0-1.el8_0] via RHSA-2019:1764 (2019-07-11)
   Red Hat Enterprise Linux 8: [thunderbird-60.8.0-1.el8_0] via RHSA-2019:1799 (2019-07-16)
  FIX_STATES :
   Out of support scope: Red Hat Enterprise Linux 5 [firefox]

More Information

Contrary to the OVAL dataset, the rhsecapi and the Red hat Security Data API can be used to query CVEs that have not yet been identified as part of a particular product, or are in the process of being evaluated by Red Hat Security. Where the above Advanced Queries section shows only a single CVE with a CVSSv3 score above 8, the below query shows quite a few more:

$ rhsecapi --q-after 2019-07-01 --q-cvss3 "8"

CVE ID          PUB DATE    BUGZILLA  SEVERITY   CVSS2  CVSS3  RHSAS  PKGS
CVE-2019-13300  2019-07-17  1730580   moderate          8.8     0      0  
CVE-2019-13298  2019-07-17  1730590   moderate          8.8     0      0  
CVE-2019-13308  2019-07-16  1730342   moderate          8.8     0      0  
CVE-2019-13306  2019-07-16  1730357   moderate          8.8     0      0  
CVE-2019-13305  2019-07-16  1730361   moderate          8.8     0      0  
CVE-2019-13304  2019-07-16  1730364   moderate          8.8     0      0  
CVE-2019-13303  2019-07-16  1730368   moderate          8.8     0      0  
CVE-2019-5847   2019-07-15  1731071   important         8.8     0      0  
CVE-2018-17196  2019-07-11  1732309   important         8.8     0      0  
CVE-2019-11709  2019-07-10  1728430   critical          8.8     6      6  
CVE-2019-11710  2019-07-09  1730990   critical          8.8     0      0  
CVE-2019-10137  2019-07-01  1702604   important         8.1     1      1

Using the above list as a guide, we can see that at least one of the CVEs currently would not be reflected in the OVAL dataset as it doesn't have an associated Errata.

$ rhsecapi CVE-2019-11710

CVE-2019-11710
  SEVERITY : Critical Impact
  DATE     : 2019-07-09
  BUGZILLA : 1730990
  FIX_STATES :
   Out of support scope: Red Hat Enterprise Linux 5 [firefox]
   Not affected: Red Hat Enterprise Linux 6 [firefox]
   Not affected: Red Hat Enterprise Linux 7 [firefox]
   Not affected: Red Hat Enterprise Linux 8 [firefox]

  1. Product Documentation for Red Hat Security Data API 1.0 - Red Hat Customer Portal ↩︎

  2. redhat.com | Security Data ↩︎

  3. Red Hat CVE Database - Red Hat Customer Portal ↩︎

  4. Notifications and Advisories - Red Hat Customer Portal ↩︎

Comments