aboutsummaryrefslogtreecommitdiff
{
  "CVE_data_type" : "CVE",
  "CVE_data_format" : "MITRE",
  "CVE_data_version" : "4.0",
  "CVE_data_numberOfCVEs" : "9826",
  "CVE_data_timestamp" : "2019-10-17T07:00Z",
  "CVE_Items" : [ {
    "cve" : {
      "data_type" : "CVE",
      "data_format" : "MITRE",
      "data_version" : "4.0",
      "CVE_data_meta" : {
        "ID" : "CVE-2019-0001",
        "ASSIGNER" : "cve@mitre.org"
      },
      "problemtype" : {
        "problemtype_data" : [ {
          "description" : [ {
            "lang" : "en",
            "value" : "CWE-400"
          } ]
        } ]
      },
      "references" : {
        "reference_data" : [ {
          "url" : "http://www.securityfocus.com/bid/106541",
          "name" : "106541",
          "refsource" : "BID",
          "tags" : [ "Third Party Advisory", "VDB Entry" ]
        }, {
          "url" : "https://kb.juniper.net/JSA10900",
          "name" : "https://kb.juniper.net/JSA10900",
          "refsource" : "CONFIRM",
          "tags" : [ "Vendor Advisory" ]
        } ]
      },
      "description" : {
        "description_data" : [ {
          "lang" : "en",
          "value" : "Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result in an extended denial of service condition for the device. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S1; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2."
        } ]
      }
    },
    "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:*:*:*:*:*:*:*"
        } ]
      }, {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.2:*:*:*:*:*:*:*"
        }  ]
      }, {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:r1:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:r2:*:*:*:*:*:*"
        } ]
      }, {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:juniper:junos:18.2:*:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:juniper:junos:18.2:r1-s3:*:*:*:*:*:*"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:juniper:junos:18.2:r1-s4:*:*:*:*:*:*"
        } ]
      } ]
    },
    "impact" : {
      "baseMetricV3" : {
        "cvssV3" : {
          "version" : "3.0",
          "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "attackVector" : "NETWORK",
          "attackComplexity" : "HIGH",
          "privilegesRequired" : "NONE",
          "userInteraction" : "NONE",
          "scope" : "UNCHANGED",
          "confidentialityImpact" : "NONE",
          "integrityImpact" : "NONE",
          "availabilityImpact" : "HIGH",
          "baseScore" : 5.9,
          "baseSeverity" : "MEDIUM"
        },
        "exploitabilityScore" : 2.2,
        "impactScore" : 3.6
      },
      "baseMetricV2" : {
        "cvssV2" : {
          "version" : "2.0",
          "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C",
          "accessVector" : "NETWORK",
          "accessComplexity" : "MEDIUM",
          "authentication" : "NONE",
          "confidentialityImpact" : "NONE",
          "integrityImpact" : "NONE",
          "availabilityImpact" : "COMPLETE",
          "baseScore" : 7.1
        },
        "severity" : "HIGH",
        "exploitabilityScore" : 8.6,
        "impactScore" : 6.9,
        "acInsufInfo" : false,
        "obtainAllPrivilege" : false,
        "obtainUserPrivilege" : false,
        "obtainOtherPrivilege" : false,
        "userInteractionRequired" : false
      }
    },
    "publishedDate" : "2019-01-15T21:29Z",
    "lastModifiedDate" : "2019-10-09T23:43Z"
  }, {
    "cve" : {
      "data_type" : "CVE",
      "data_format" : "MITRE",
      "data_version" : "4.0",
      "CVE_data_meta" : {
        "ID" : "CVE-2019-0005",
        "ASSIGNER" : "cve@mitre.org"
      },
      "problemtype" : {
        "problemtype_data" : [ {
          "description" : [ {
            "lang" : "en",
            "value" : "CWE-400"
          } ]
        } ]
      },
      "references" : {
        "reference_data" : [ {
          "url" : "http://www.securityfocus.com/bid/106665",
          "name" : "106665",
          "refsource" : "BID",
          "tags" : [ "Third Party Advisory" ]
        }, {
          "url" : "https://kb.juniper.net/JSA10905",
          "name" : "https://kb.juniper.net/JSA10905",
          "refsource" : "CONFIRM",
          "tags" : [ "Vendor Advisory" ]
        } ]
      },
      "description" : {
        "description_data" : [ {
          "lang" : "en",
          "value" : "On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may allow IPv6 packets that should have been blocked to be forwarded. IPv4 packet filtering is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS on EX and QFX series;: 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R7; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 series; 15.1X53 versions prior to 15.1X53-D591 on EX2300/EX3400 series; 16.1 versions prior to 16.1R7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2."
        } ]
      }
    },
    "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d10:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d15:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d16:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d25:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d26:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d27:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d30:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d35:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d40:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d42:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d43:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d44:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d45:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d46:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
          } ]
        } ]
      }, {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r1:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r2:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r3:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r4:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r5:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r6:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
          } ]
        } ]
      }, {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d20:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d21:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d30:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d32:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d33:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d34:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d50:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d51:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d52:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          } ]
        } ]
      }, {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d20:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d21:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d210:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d230:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d234:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d30:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d32:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d33:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d34:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d50:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d51:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d52:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d55:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d57:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d58:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d59:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d590:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          } ]
        } ]
      }, {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r1:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r2:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r3:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r3-s10:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r4:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r5:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r6:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r6-s6:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r7:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
          } ]
        } ]
      }, {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:r1:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
          } ]
        } ]
      }, {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.2:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.2:r1:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.2:r1-s7:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.2:r2:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
          } ]
        } ]
      }, {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.3:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.3:r1:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.3:r2:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:gfx3600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
          } ]
        } ]
      }, {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.4:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:o:juniper:junos:17.4:r1:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
          } ]
        } ]
      }, {
        "operator" : "AND",
        "children" : [ {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:a:juniper:junos:18.1:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : true,
            "cpe23Uri" : "cpe:2.3:a:juniper:junos:18.1:r1:*:*:*:*:*:*"
          } ]
        }, {
          "operator" : "OR",
          "cpe_match" : [ {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
          }, {
            "vulnerable" : false,
            "cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
          } ]
        } ]
      } ]
    },
    "impact" : {
      "baseMetricV3" : {
        "cvssV3" : {
          "version" : "3.0",
          "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "attackVector" : "NETWORK",
          "attackComplexity" : "LOW",
          "privilegesRequired" : "NONE",
          "userInteraction" : "NONE",
          "scope" : "UNCHANGED",
          "confidentialityImpact" : "NONE",
          "integrityImpact" : "LOW",
          "availabilityImpact" : "NONE",
          "baseScore" : 5.3,
          "baseSeverity" : "MEDIUM"
        },
        "exploitabilityScore" : 3.9,
        "impactScore" : 1.4
      },
      "baseMetricV2" : {
        "cvssV2" : {
          "version" : "2.0",
          "vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "accessVector" : "NETWORK",
          "accessComplexity" : "LOW",
          "authentication" : "NONE",
          "confidentialityImpact" : "NONE",
          "integrityImpact" : "PARTIAL",
          "availabilityImpact" : "NONE",
          "baseScore" : 5.0
        },
        "severity" : "MEDIUM",
        "exploitabilityScore" : 10.0,
        "impactScore" : 2.9,
        "acInsufInfo" : false,
        "obtainAllPrivilege" : false,
        "obtainUserPrivilege" : false,
        "obtainOtherPrivilege" : false,
        "userInteractionRequired" : false
      }
    },
    "publishedDate" : "2019-01-15T21:29Z",
    "lastModifiedDate" : "2019-02-14T18:40Z"
  }, {
    "cve" : {
      "data_type" : "CVE",
      "data_format" : "MITRE",
      "data_version" : "4.0",
      "CVE_data_meta" : {
        "ID" : "CVE-2019-14811",
        "ASSIGNER" : "cve@mitre.org"
      },
      "problemtype" : {
        "problemtype_data" : [ {
          "description" : [ {
            "lang" : "en",
            "value" : "CWE-264"
          } ]
        } ]
      },
      "references" : {
        "reference_data" : [ {
          "url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
          "name" : "openSUSE-SU-2019:2223",
          "refsource" : "SUSE",
          "tags" : [ ]
        }, {
          "url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
          "name" : "openSUSE-SU-2019:2222",
          "refsource" : "SUSE",
          "tags" : [ ]
        }, {
          "url" : "https://access.redhat.com/errata/RHBA-2019:2824",
          "name" : "RHBA-2019:2824",
          "refsource" : "REDHAT",
          "tags" : [ ]
        }, {
          "url" : "https://access.redhat.com/errata/RHSA-2019:2594",
          "name" : "RHSA-2019:2594",
          "refsource" : "REDHAT",
          "tags" : [ ]
        }, {
          "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811",
          "name" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811",
          "refsource" : "CONFIRM",
          "tags" : [ "Exploit", "Issue Tracking", "Mitigation", "Patch", "Third Party Advisory" ]
        }, {
          "url" : "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
          "name" : "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
          "refsource" : "MLIST",
          "tags" : [ ]
        }, {
          "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
          "name" : "FEDORA-2019-ebd6c4f15a",
          "refsource" : "FEDORA",
          "tags" : [ ]
        }, {
          "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
          "name" : "FEDORA-2019-0a9d525d71",
          "refsource" : "FEDORA",
          "tags" : [ ]
        }, {
          "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
          "name" : "FEDORA-2019-953fc0f16d",
          "refsource" : "FEDORA",
          "tags" : [ ]
        }, {
          "url" : "https://seclists.org/bugtraq/2019/Sep/15",
          "name" : "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
          "refsource" : "BUGTRAQ",
          "tags" : [ ]
        }, {
          "url" : "https://www.debian.org/security/2019/dsa-4518",
          "name" : "DSA-4518",
          "refsource" : "DEBIAN",
          "tags" : [ ]
        } ]
      },
      "description" : {
        "description_data" : [ {
          "lang" : "en",
          "value" : "A flaw was found in, ghostscript versions prior to 9.28, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands."
        } ]
      }
    },
    "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*",
          "versionEndExcluding" : "9.28"
        } ]
      } ]
    },
    "impact" : {
      "baseMetricV3" : {
        "cvssV3" : {
          "version" : "3.0",
          "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "attackVector" : "LOCAL",
          "attackComplexity" : "LOW",
          "privilegesRequired" : "NONE",
          "userInteraction" : "REQUIRED",
          "scope" : "UNCHANGED",
          "confidentialityImpact" : "HIGH",
          "integrityImpact" : "HIGH",
          "availabilityImpact" : "HIGH",
          "baseScore" : 7.8,
          "baseSeverity" : "HIGH"
        },
        "exploitabilityScore" : 1.8,
        "impactScore" : 5.9
      },
      "baseMetricV2" : {
        "cvssV2" : {
          "version" : "2.0",
          "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "accessVector" : "NETWORK",
          "accessComplexity" : "MEDIUM",
          "authentication" : "NONE",
          "confidentialityImpact" : "PARTIAL",
          "integrityImpact" : "PARTIAL",
          "availabilityImpact" : "PARTIAL",
          "baseScore" : 6.8
        },
        "severity" : "MEDIUM",
        "exploitabilityScore" : 8.6,
        "impactScore" : 6.4,
        "acInsufInfo" : false,
        "obtainAllPrivilege" : false,
        "obtainUserPrivilege" : false,
        "obtainOtherPrivilege" : false,
        "userInteractionRequired" : true
      }
    },
    "publishedDate" : "2019-09-03T16:15Z",
    "lastModifiedDate" : "2019-09-10T03:15Z"
  }, {
    "cve" : {
      "data_type" : "CVE",
      "data_format" : "MITRE",
      "data_version" : "4.0",
      "CVE_data_meta" : {
        "ID" : "CVE-2019-17365",
        "ASSIGNER" : "cve@mitre.org"
      },
      "problemtype" : {
        "problemtype_data" : [ {
          "description" : [ {
            "lang" : "en",
            "value" : "CWE-276"
          } ]
        } ]
      },
      "references" : {
        "reference_data" : [ {
          "url" : "http://www.openwall.com/lists/oss-security/2019/10/09/4",
          "name" : "http://www.openwall.com/lists/oss-security/2019/10/09/4",
          "refsource" : "MISC",
          "tags" : [ "Exploit", "Mailing List", "Third Party Advisory" ]
        }, {
          "url" : "http://www.openwall.com/lists/oss-security/2019/10/10/1",
          "name" : "[oss-security] 20191010 Re: CVE-2019-17365: Nix per-user profile directory hijack",
          "refsource" : "MLIST",
          "tags" : [ "Third Party Advisory" ]
        } ]
      },
      "description" : {
        "description_data" : [ {
          "lang" : "en",
          "value" : "Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable."
        } ]
      }
    },
    "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
          "versionEndIncluding" : "2.3"
        } ]
      } ]
    },
    "impact" : {
      "baseMetricV3" : {
        "cvssV3" : {
          "version" : "3.1",
          "vectorString" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "attackVector" : "LOCAL",
          "attackComplexity" : "LOW",
          "privilegesRequired" : "LOW",
          "userInteraction" : "NONE",
          "scope" : "UNCHANGED",
          "confidentialityImpact" : "HIGH",
          "integrityImpact" : "HIGH",
          "availabilityImpact" : "HIGH",
          "baseScore" : 7.8,
          "baseSeverity" : "HIGH"
        },
        "exploitabilityScore" : 1.8,
        "impactScore" : 5.9
      },
      "baseMetricV2" : {
        "cvssV2" : {
          "version" : "2.0",
          "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "accessVector" : "LOCAL",
          "accessComplexity" : "LOW",
          "authentication" : "NONE",
          "confidentialityImpact" : "PARTIAL",
          "integrityImpact" : "PARTIAL",
          "availabilityImpact" : "PARTIAL",
          "baseScore" : 4.6
        },
        "severity" : "MEDIUM",
        "exploitabilityScore" : 3.9,
        "impactScore" : 6.4,
        "acInsufInfo" : false,
        "obtainAllPrivilege" : false,
        "obtainUserPrivilege" : false,
        "obtainOtherPrivilege" : false,
        "userInteractionRequired" : false
      }
    },
    "publishedDate" : "2019-10-09T22:15Z",
    "lastModifiedDate" : "2019-10-11T13:19Z"
  }, {
    "cve" : {
      "data_type" : "CVE",
      "data_format" : "MITRE",
      "data_version" : "4.0",
      "CVE_data_meta" : {
        "ID" : "CVE-2019-1010180",
        "ASSIGNER" : "cve@mitre.org"
      },
      "problemtype" : {
        "problemtype_data" : [ {
          "description" : [ {
            "lang" : "en",
            "value" : "CWE-119"
          } ]
        } ]
      },
      "references" : {
        "reference_data" : [ {
          "url" : "http://www.securityfocus.com/bid/109367",
          "name" : "109367",
          "refsource" : "BID",
          "tags" : [ "Third Party Advisory", "VDB Entry" ]
        }, {
          "url" : "https://sourceware.org/bugzilla/show_bug.cgi?id=23657",
          "name" : "https://sourceware.org/bugzilla/show_bug.cgi?id=23657",
          "refsource" : "MISC",
          "tags" : [ "Exploit", "Issue Tracking", "Third Party Advisory" ]
        } ]
      },
      "description" : {
        "description_data" : [ {
          "lang" : "en",
          "value" : "GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet."
        } ]
      }
    },
    "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:gnu:gdb:*:*:*:*:*:*:*:*"
        } ]
      } ]
    },
    "impact" : {
      "baseMetricV3" : {
        "cvssV3" : {
          "version" : "3.0",
          "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "attackVector" : "LOCAL",
          "attackComplexity" : "LOW",
          "privilegesRequired" : "NONE",
          "userInteraction" : "REQUIRED",
          "scope" : "UNCHANGED",
          "confidentialityImpact" : "HIGH",
          "integrityImpact" : "HIGH",
          "availabilityImpact" : "HIGH",
          "baseScore" : 7.8,
          "baseSeverity" : "HIGH"
        },
        "exploitabilityScore" : 1.8,
        "impactScore" : 5.9
      },
      "baseMetricV2" : {
        "cvssV2" : {
          "version" : "2.0",
          "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "accessVector" : "NETWORK",
          "accessComplexity" : "MEDIUM",
          "authentication" : "NONE",
          "confidentialityImpact" : "PARTIAL",
          "integrityImpact" : "PARTIAL",
          "availabilityImpact" : "PARTIAL",
          "baseScore" : 6.8
        },
        "severity" : "MEDIUM",
        "exploitabilityScore" : 8.6,
        "impactScore" : 6.4,
        "acInsufInfo" : false,
        "obtainAllPrivilege" : false,
        "obtainUserPrivilege" : false,
        "obtainOtherPrivilege" : false,
        "userInteractionRequired" : true
      }
    },
    "publishedDate" : "2019-07-24T13:15Z",
    "lastModifiedDate" : "2019-08-01T15:39Z"
  }, {
    "cve" : {
      "data_type" : "CVE",
      "data_format" : "MITRE",
      "data_version" : "4.0",
      "CVE_data_meta" : {
        "ID" : "CVE-2019-1010204",
        "ASSIGNER" : "cve@mitre.org"
      },
      "problemtype" : {
        "problemtype_data" : [ {
          "description" : [ {
            "lang" : "en",
            "value" : "CWE-125"
          }, {
            "lang" : "en",
            "value" : "CWE-20"
          } ]
        } ]
      },
      "references" : {
        "reference_data" : [ {
          "url" : "https://security.netapp.com/advisory/ntap-20190822-0001/",
          "name" : "https://security.netapp.com/advisory/ntap-20190822-0001/",
          "refsource" : "CONFIRM",
          "tags" : [ ]
        }, {
          "url" : "https://sourceware.org/bugzilla/show_bug.cgi?id=23765",
          "name" : "https://sourceware.org/bugzilla/show_bug.cgi?id=23765",
          "refsource" : "MISC",
          "tags" : [ "Issue Tracking", "Third Party Advisory" ]
        } ]
      },
      "description" : {
        "description_data" : [ {
          "lang" : "en",
          "value" : "GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened."
        } ]
      }
    },
    "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*",
          "versionStartIncluding" : "2.21",
          "versionEndIncluding" : "2.31.1"
        }, {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:gnu:binutils_gold:*:*:*:*:*:*:*:*",
          "versionStartIncluding" : "1.11",
          "versionEndIncluding" : "1.16"
        } ]
      } ]
    },
    "impact" : {
      "baseMetricV3" : {
        "cvssV3" : {
          "version" : "3.0",
          "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "attackVector" : "LOCAL",
          "attackComplexity" : "LOW",
          "privilegesRequired" : "NONE",
          "userInteraction" : "REQUIRED",
          "scope" : "UNCHANGED",
          "confidentialityImpact" : "NONE",
          "integrityImpact" : "NONE",
          "availabilityImpact" : "HIGH",
          "baseScore" : 5.5,
          "baseSeverity" : "MEDIUM"
        },
        "exploitabilityScore" : 1.8,
        "impactScore" : 3.6
      },
      "baseMetricV2" : {
        "cvssV2" : {
          "version" : "2.0",
          "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "accessVector" : "NETWORK",
          "accessComplexity" : "MEDIUM",
          "authentication" : "NONE",
          "confidentialityImpact" : "NONE",
          "integrityImpact" : "NONE",
          "availabilityImpact" : "PARTIAL",
          "baseScore" : 4.3
        },
        "severity" : "MEDIUM",
        "exploitabilityScore" : 8.6,
        "impactScore" : 2.9,
        "acInsufInfo" : false,
        "obtainAllPrivilege" : false,
        "obtainUserPrivilege" : false,
        "obtainOtherPrivilege" : false,
        "userInteractionRequired" : true
      }
    },
    "publishedDate" : "2019-07-23T14:15Z",
    "lastModifiedDate" : "2019-08-22T07:15Z"
  }, {
    "cve" : {
      "data_type" : "CVE",
      "data_format" : "MITRE",
      "data_version" : "4.0",
      "CVE_data_meta" : {
        "ID" : "CVE-2019-18192",
        "ASSIGNER" : "cve@mitre.org"
      },
      "problemtype" : {
        "problemtype_data" : [ {
          "description" : [ ]
        } ]
      },
      "references" : {
        "reference_data" : [ {
          "url" : "http://www.openwall.com/lists/oss-security/2019/10/17/3",
          "name" : "[oss-security] 20191017 CVE-2019-18192: Insecure permissions on Guix profile directory",
          "refsource" : "MLIST",
          "tags" : [ ]
        }, {
          "url" : "https://issues.guix.gnu.org/issue/37744",
          "name" : "https://issues.guix.gnu.org/issue/37744",
          "refsource" : "MISC",
          "tags" : [ ]
        } ]
      },
      "description" : {
        "description_data" : [ {
          "lang" : "en",
          "value" : "GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365."
        } ]
      }
    },
    "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ ]
    },
    "impact" : { },
    "publishedDate" : "2019-10-17T20:15Z",
    "lastModifiedDate" : "2019-10-17T20:29Z"
  } ]
}
generated by cgit
mu-command system)) ,@(if (file-exists? "/dev/kvm") '("-enable-kvm") '()) "-no-reboot" "-m" #$(number->string memory-size) "-drive" "file=disk.img,if=virtio"))))) (define %test-installed-os (system-test (name "installed-os") (description "Test basic functionality of an OS installed like one would do by hand. This test is expensive in terms of CPU and storage usage since we need to build (current-guix) and then store a couple of full system images.") (value (mlet* %store-monad ((image (run-install %minimal-os %minimal-os-source)) (command (qemu-command/writable-image image))) (run-basic-test %minimal-os command "installed-os"))))) (define %test-installed-extlinux-os (system-test (name "installed-extlinux-os") (description "Test basic functionality of an OS booted with an extlinux bootloader. As per %test-installed-os, this test is expensive in terms of CPU and storage.") (value (mlet* %store-monad ((image (run-install %minimal-extlinux-os %minimal-extlinux-os-source #:packages (list syslinux) #:script %extlinux-gpt-installation-script)) (command (qemu-command/writable-image image))) (run-basic-test %minimal-extlinux-os command "installed-extlinux-os"))))) ;;; ;;; Installation through an ISO image. ;;; (define-os-with-source (%minimal-os-on-vda %minimal-os-on-vda-source) ;; The OS we want to install. (use-modules (gnu) (gnu tests) (srfi srfi-1)) (operating-system (host-name "liberigilo") (timezone "Europe/Paris") (locale "en_US.UTF-8") (bootloader (bootloader-configuration (bootloader grub-bootloader) (target "/dev/vda"))) (kernel-arguments '("console=ttyS0")) (file-systems (cons (file-system (device (file-system-label "my-root")) (mount-point "/") (type "ext4")) %base-file-systems)) (users (cons (user-account (name "alice") (comment "Bob's sister") (group "users") (supplementary-groups '("wheel" "audio" "video"))) %base-user-accounts)) (services (cons (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix build utils) (guix combinators))))) %base-services)))) (define %simple-installation-script-for-/dev/vda ;; Shell script of a simple installation. "\ . /etc/profile set -e -x guix --version export GUIX_BUILD_OPTIONS=--no-grafts guix build isc-dhcp parted --script /dev/vda mklabel gpt \\ mkpart primary ext2 1M 3M \\ mkpart primary ext2 3M 1.6G \\ set 1 boot on \\ set 1 bios_grub on mkfs.ext4 -L my-root /dev/vda2 mount /dev/vda2 /mnt df -h /mnt herd start cow-store /mnt mkdir /mnt/etc cp /etc/target-config.scm /mnt/etc/config.scm guix system init /mnt/etc/config.scm /mnt --no-substitutes sync reboot\n") (define %test-iso-image-installer (system-test (name "iso-image-installer") (description "") (value (mlet* %store-monad ((image (run-install %minimal-os-on-vda %minimal-os-on-vda-source #:script %simple-installation-script-for-/dev/vda #:installation-disk-image-file-system-type "iso9660")) (command (qemu-command/writable-image image))) (run-basic-test %minimal-os-on-vda command name))))) ;;; ;;; Separate /home. ;;; (define-os-with-source (%separate-home-os %separate-home-os-source) ;; The OS we want to install. (use-modules (gnu) (gnu tests) (srfi srfi-1)) (operating-system (host-name "liberigilo") (timezone "Europe/Paris") (locale "en_US.utf8") (bootloader (bootloader-configuration (bootloader grub-bootloader) (target "/dev/vdb"))) (kernel-arguments '("console=ttyS0")) (file-systems (cons* (file-system (device (file-system-label "my-root")) (mount-point "/") (type "ext4")) (file-system (device "none") (mount-point "/home") (type "tmpfs")) %base-file-systems)) (users (cons* (user-account (name "alice") (group "users")) (user-account (name "charlie") (group "users")) %base-user-accounts)) (services (cons (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix combinators))))) %base-services)))) (define %test-separate-home-os (system-test (name "separate-home-os") (description "Test basic functionality of an installed OS with a separate /home partition. In particular, home directories must be correctly created (see <https://bugs.gnu.org/21108>).") (value (mlet* %store-monad ((image (run-install %separate-home-os %separate-home-os-source #:script %simple-installation-script)) (command (qemu-command/writable-image image))) (run-basic-test %separate-home-os command "separate-home-os"))))) ;;; ;;; Separate /gnu/store partition. ;;; (define-os-with-source (%separate-store-os %separate-store-os-source) ;; The OS we want to install. (use-modules (gnu) (gnu tests) (srfi srfi-1)) (operating-system (host-name "liberigilo") (timezone "Europe/Paris") (locale "en_US.UTF-8") (bootloader (bootloader-configuration (bootloader grub-bootloader) (target "/dev/vdb"))) (kernel-arguments '("console=ttyS0")) (file-systems (cons* (file-system (device (file-system-label "root-fs")) (mount-point "/") (type "ext4")) (file-system (device (file-system-label "store-fs")) (mount-point "/gnu") (type "ext4")) %base-file-systems)) (users %base-user-accounts) (services (cons (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix combinators))))) %base-services)))) (define %separate-store-installation-script ;; Installation with a separate /gnu partition. "\ . /etc/profile set -e -x guix --version export GUIX_BUILD_OPTIONS=--no-grafts guix build isc-dhcp parted --script /dev/vdb mklabel gpt \\ mkpart primary ext2 1M 3M \\ mkpart primary ext2 3M 400M \\ mkpart primary ext2 400M 2.1G \\ set 1 boot on \\ set 1 bios_grub on mkfs.ext4 -L root-fs /dev/vdb2 mkfs.ext4 -L store-fs /dev/vdb3 mount /dev/vdb2 /mnt mkdir /mnt/gnu mount /dev/vdb3 /mnt/gnu df -h /mnt df -h /mnt/gnu herd start cow-store /mnt mkdir /mnt/etc cp /etc/target-config.scm /mnt/etc/config.scm guix system init /mnt/etc/config.scm /mnt --no-substitutes sync reboot\n") (define %test-separate-store-os (system-test (name "separate-store-os") (description "Test basic functionality of an OS installed like one would do by hand, where /gnu lives on a separate partition.") (value (mlet* %store-monad ((image (run-install %separate-store-os %separate-store-os-source #:script %separate-store-installation-script)) (command (qemu-command/writable-image image))) (run-basic-test %separate-store-os command "separate-store-os"))))) ;;; ;;; RAID root device. ;;; (define-os-with-source (%raid-root-os %raid-root-os-source) ;; An OS whose root partition is a RAID partition. (use-modules (gnu) (gnu tests)) (operating-system (host-name "raidified") (timezone "Europe/Paris") (locale "en_US.utf8") (bootloader (bootloader-configuration (bootloader grub-bootloader) (target "/dev/vdb"))) (kernel-arguments '("console=ttyS0")) ;; Add a kernel module for RAID-1 (aka. "mirror"). (initrd-modules (cons "raid1" %base-initrd-modules)) (mapped-devices (list (mapped-device (source (list "/dev/vda2" "/dev/vda3")) (target "/dev/md0") (type raid-device-mapping)))) (file-systems (cons (file-system (device (file-system-label "root-fs")) (mount-point "/") (type "ext4") (dependencies mapped-devices)) %base-file-systems)) (users %base-user-accounts) (services (cons (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix combinators))))) %base-services)))) (define %raid-root-installation-script ;; Installation with a separate /gnu partition. See ;; <https://raid.wiki.kernel.org/index.php/RAID_setup> for more on RAID and ;; mdadm. "\ . /etc/profile set -e -x guix --version export GUIX_BUILD_OPTIONS=--no-grafts parted --script /dev/vdb mklabel gpt \\ mkpart primary ext2 1M 3M \\ mkpart primary ext2 3M 1.6G \\ mkpart primary ext2 1.6G 3.2G \\ set 1 boot on \\ set 1 bios_grub on yes | mdadm --create /dev/md0 --verbose --level=mirror --raid-devices=2 \\ /dev/vdb2 /dev/vdb3 mkfs.ext4 -L root-fs /dev/md0 mount /dev/md0 /mnt df -h /mnt herd start cow-store /mnt mkdir /mnt/etc cp /etc/target-config.scm /mnt/etc/config.scm guix system init /mnt/etc/config.scm /mnt --no-substitutes sync reboot\n") (define %test-raid-root-os (system-test (name "raid-root-os") (description "Test functionality of an OS installed with a RAID root partition managed by 'mdadm'.") (value (mlet* %store-monad ((image (run-install %raid-root-os %raid-root-os-source #:script %raid-root-installation-script #:target-size (* 3200 MiB))) (command (qemu-command/writable-image image))) (run-basic-test %raid-root-os `(,@command) "raid-root-os"))))) ;;; ;;; LUKS-encrypted root file system. ;;; (define-os-with-source (%encrypted-root-os %encrypted-root-os-source) ;; The OS we want to install. (use-modules (gnu) (gnu tests) (srfi srfi-1)) (operating-system (host-name "liberigilo") (timezone "Europe/Paris") (locale "en_US.UTF-8") (bootloader (bootloader-configuration (bootloader grub-bootloader) (target "/dev/vdb"))) ;; Note: Do not pass "console=ttyS0" so we can use our passphrase prompt ;; detection logic in 'enter-luks-passphrase'. (mapped-devices (list (mapped-device (source (uuid "12345678-1234-1234-1234-123456789abc")) (target "the-root-device") (type luks-device-mapping)))) (file-systems (cons (file-system (device "/dev/mapper/the-root-device") (mount-point "/") (type "ext4")) %base-file-systems)) (users (cons (user-account (name "charlie") (group "users") (supplementary-groups '("wheel" "audio" "video"))) %base-user-accounts)) (services (cons (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix combinators))))) %base-services)))) (define %luks-passphrase ;; LUKS encryption passphrase used in tests. "thepassphrase") (define %encrypted-root-installation-script ;; Shell script of a simple installation. (string-append "\ . /etc/profile set -e -x guix --version export GUIX_BUILD_OPTIONS=--no-grafts ls -l /run/current-system/gc-roots parted --script /dev/vdb mklabel gpt \\ mkpart primary ext2 1M 3M \\ mkpart primary ext2 3M 1.6G \\ set 1 boot on \\ set 1 bios_grub on echo -n " %luks-passphrase " | \\ cryptsetup luksFormat --uuid=12345678-1234-1234-1234-123456789abc -q /dev/vdb2 - echo -n " %luks-passphrase " | \\ cryptsetup open --type luks --key-file - /dev/vdb2 the-root-device mkfs.ext4 -L my-root /dev/mapper/the-root-device mount LABEL=my-root /mnt herd start cow-store /mnt mkdir /mnt/etc cp /etc/target-config.scm /mnt/etc/config.scm guix system build /mnt/etc/config.scm guix system init /mnt/etc/config.scm /mnt --no-substitutes sync reboot\n")) (define (enter-luks-passphrase marionette) "Return a gexp to be inserted in the basic system test running on MARIONETTE to enter the LUKS passphrase." (let ((ocrad (file-append ocrad "/bin/ocrad"))) #~(begin (define (passphrase-prompt? text) (string-contains (pk 'screen-text text) "Enter pass")) (define (bios-boot-screen? text) ;; Return true if TEXT corresponds to the boot screen, before GRUB's ;; menu. (string-prefix? "SeaBIOS" text)) (test-assert "enter LUKS passphrase for GRUB" (begin ;; At this point we have no choice but to use OCR to determine ;; when the passphrase should be entered. (wait-for-screen-text #$marionette passphrase-prompt? #:ocrad #$ocrad) (marionette-type #$(string-append %luks-passphrase "\n") #$marionette) ;; Now wait until we leave the boot screen. This is necessary so ;; we can then be sure we match the "Enter passphrase" prompt from ;; 'cryptsetup', in the initrd. (wait-for-screen-text #$marionette (negate bios-boot-screen?) #:ocrad #$ocrad #:timeout 20))) (test-assert "enter LUKS passphrase for the initrd" (begin ;; XXX: Here we use OCR as well but we could instead use QEMU ;; '-serial stdio' and run it in an input pipe, (wait-for-screen-text #$marionette passphrase-prompt? #:ocrad #$ocrad #:timeout 60) (marionette-type #$(string-append %luks-passphrase "\n") #$marionette) ;; Take a screenshot for debugging purposes. (marionette-control (string-append "screendump " #$output "/post-initrd-passphrase.ppm") #$marionette)))))) (define %test-encrypted-root-os (system-test (name "encrypted-root-os") (description "Test basic functionality of an OS installed like one would do by hand. This test is expensive in terms of CPU and storage usage since we need to build (current-guix) and then store a couple of full system images.") (value (mlet* %store-monad ((image (run-install %encrypted-root-os %encrypted-root-os-source #:script %encrypted-root-installation-script)) (command (qemu-command/writable-image image))) (run-basic-test %encrypted-root-os command "encrypted-root-os" #:initialization enter-luks-passphrase))))) ;;; ;;; Btrfs root file system. ;;; (define-os-with-source (%btrfs-root-os %btrfs-root-os-source) ;; The OS we want to install. (use-modules (gnu) (gnu tests) (srfi srfi-1)) (operating-system (host-name "liberigilo") (timezone "Europe/Paris") (locale "en_US.UTF-8") (bootloader (bootloader-configuration (bootloader grub-bootloader) (target "/dev/vdb"))) (kernel-arguments '("console=ttyS0")) (file-systems (cons (file-system (device (file-system-label "my-root")) (mount-point "/") (type "btrfs")) %base-file-systems)) (users (cons (user-account (name "charlie") (group "users") (supplementary-groups '("wheel" "audio" "video"))) %base-user-accounts)) (services (cons (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix combinators))))) %base-services)))) (define %btrfs-root-installation-script ;; Shell script of a simple installation. "\ . /etc/profile set -e -x guix --version export GUIX_BUILD_OPTIONS=--no-grafts ls -l /run/current-system/gc-roots parted --script /dev/vdb mklabel gpt \\ mkpart primary ext2 1M 3M \\ mkpart primary ext2 3M 2G \\ set 1 boot on \\ set 1 bios_grub on mkfs.btrfs -L my-root /dev/vdb2 mount /dev/vdb2 /mnt btrfs subvolume create /mnt/home herd start cow-store /mnt mkdir /mnt/etc cp /etc/target-config.scm /mnt/etc/config.scm guix system build /mnt/etc/config.scm guix system init /mnt/etc/config.scm /mnt --no-substitutes sync reboot\n") (define %test-btrfs-root-os (system-test (name "btrfs-root-os") (description "Test basic functionality of an OS installed like one would do by hand. This test is expensive in terms of CPU and storage usage since we need to build (current-guix) and then store a couple of full system images.") (value (mlet* %store-monad ((image (run-install %btrfs-root-os %btrfs-root-os-source #:script %btrfs-root-installation-script)) (command (qemu-command/writable-image image))) (run-basic-test %btrfs-root-os command "btrfs-root-os"))))) ;;; ;;; Btrfs root file system on a subvolume. ;;; (define-os-with-source (%btrfs-root-on-subvolume-os %btrfs-root-on-subvolume-os-source) ;; The OS we want to install. (use-modules (gnu) (gnu tests) (srfi srfi-1)) (operating-system (host-name "hurd") (timezone "America/Montreal") (locale "en_US.UTF-8") (bootloader (bootloader-configuration (bootloader grub-bootloader) (target "/dev/vdb"))) (kernel-arguments '("console=ttyS0")) (file-systems (cons* (file-system (device (file-system-label "btrfs-pool")) (mount-point "/") (options "subvol=rootfs,compress=zstd") (type "btrfs")) (file-system (device (file-system-label "btrfs-pool")) (mount-point "/home") (options "subvol=homefs,compress=lzo") (type "btrfs")) %base-file-systems)) (users (cons (user-account (name "charlie") (group "users") (supplementary-groups '("wheel" "audio" "video"))) %base-user-accounts)) (services (cons (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix combinators))))) %base-services)))) (define %btrfs-root-on-subvolume-installation-script ;; Shell script of a simple installation. "\ . /etc/profile set -e -x guix --version export GUIX_BUILD_OPTIONS=--no-grafts ls -l /run/current-system/gc-roots parted --script /dev/vdb mklabel gpt \\ mkpart primary ext2 1M 3M \\ mkpart primary ext2 3M 2G \\ set 1 boot on \\ set 1 bios_grub on # Setup the top level Btrfs file system with its subvolume. mkfs.btrfs -L btrfs-pool /dev/vdb2 mount /dev/vdb2 /mnt btrfs subvolume create /mnt/rootfs btrfs subvolume create /mnt/homefs umount /dev/vdb2 # Mount the subvolumes, ready for installation. mount LABEL=btrfs-pool -o 'subvol=rootfs,compress=zstd' /mnt mkdir /mnt/home mount LABEL=btrfs-pool -o 'subvol=homefs,compress=zstd' /mnt/home herd start cow-store /mnt mkdir /mnt/etc cp /etc/target-config.scm /mnt/etc/config.scm guix system build /mnt/etc/config.scm guix system init /mnt/etc/config.scm /mnt --no-substitutes sync reboot\n") (define %test-btrfs-root-on-subvolume-os (system-test (name "btrfs-root-on-subvolume-os") (description "Test basic functionality of an OS installed like one would do by hand. This test is expensive in terms of CPU and storage usage since we need to build (current-guix) and then store a couple of full system images.") (value (mlet* %store-monad ((image (run-install %btrfs-root-on-subvolume-os %btrfs-root-on-subvolume-os-source #:script %btrfs-root-on-subvolume-installation-script)) (command (qemu-command/writable-image image))) (run-basic-test %btrfs-root-on-subvolume-os command "btrfs-root-on-subvolume-os"))))) ;;; ;;; JFS root file system. ;;; (define-os-with-source (%jfs-root-os %jfs-root-os-source) ;; The OS we want to install. (use-modules (gnu) (gnu tests) (srfi srfi-1)) (operating-system (host-name "liberigilo") (timezone "Europe/Paris") (locale "en_US.UTF-8") (bootloader (bootloader-configuration (bootloader grub-bootloader) (target "/dev/vdb"))) (kernel-arguments '("console=ttyS0")) (file-systems (cons (file-system (device (file-system-label "my-root")) (mount-point "/") (type "jfs")) %base-file-systems)) (users (cons (user-account (name "charlie") (group "users") (supplementary-groups '("wheel" "audio" "video"))) %base-user-accounts)) (services (cons (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix combinators))))) %base-services)))) (define %jfs-root-installation-script ;; Shell script of a simple installation. "\ . /etc/profile set -e -x guix --version export GUIX_BUILD_OPTIONS=--no-grafts ls -l /run/current-system/gc-roots parted --script /dev/vdb mklabel gpt \\ mkpart primary ext2 1M 3M \\ mkpart primary ext2 3M 2G \\ set 1 boot on \\ set 1 bios_grub on jfs_mkfs -L my-root -q /dev/vdb2 mount /dev/vdb2 /mnt herd start cow-store /mnt mkdir /mnt/etc cp /etc/target-config.scm /mnt/etc/config.scm guix system build /mnt/etc/config.scm guix system init /mnt/etc/config.scm /mnt --no-substitutes sync reboot\n") (define %test-jfs-root-os (system-test (name "jfs-root-os") (description "Test basic functionality of an OS installed like one would do by hand. This test is expensive in terms of CPU and storage usage since we need to build (current-guix) and then store a couple of full system images.") (value (mlet* %store-monad ((image (run-install %jfs-root-os %jfs-root-os-source #:script %jfs-root-installation-script)) (command (qemu-command/writable-image image))) (run-basic-test %jfs-root-os command "jfs-root-os"))))) ;;; ;;; F2FS root file system. ;;; (define-os-with-source (%f2fs-root-os %f2fs-root-os-source) ;; The OS we want to install. (use-modules (gnu) (gnu tests) (srfi srfi-1)) (operating-system (host-name "liberigilo") (timezone "Europe/Paris") (locale "en_US.UTF-8") (bootloader (bootloader-configuration (bootloader grub-bootloader) (target "/dev/vdb"))) (kernel-arguments '("console=ttyS0")) (file-systems (cons (file-system (device (file-system-label "my-root")) (mount-point "/") (type "f2fs")) %base-file-systems)) (users (cons (user-account (name "charlie") (group "users") (supplementary-groups '("wheel" "audio" "video"))) %base-user-accounts)) (services (cons (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix combinators))))) %base-services)))) (define %f2fs-root-installation-script ;; Shell script of a simple installation. "\ . /etc/profile set -e -x guix --version export GUIX_BUILD_OPTIONS=--no-grafts ls -l /run/current-system/gc-roots parted --script /dev/vdb mklabel gpt \\ mkpart primary ext2 1M 3M \\ mkpart primary ext2 3M 2G \\ set 1 boot on \\ set 1 bios_grub on mkfs.f2fs -l my-root -q /dev/vdb2 mount /dev/vdb2 /mnt herd start cow-store /mnt mkdir /mnt/etc cp /etc/target-config.scm /mnt/etc/config.scm guix system build /mnt/etc/config.scm guix system init /mnt/etc/config.scm /mnt --no-substitutes sync reboot\n") (define %test-f2fs-root-os (system-test (name "f2fs-root-os") (description "Test basic functionality of an OS installed like one would do by hand. This test is expensive in terms of CPU and storage usage since we need to build (current-guix) and then store a couple of full system images.") (value (mlet* %store-monad ((image (run-install %f2fs-root-os %f2fs-root-os-source #:script %f2fs-root-installation-script)) (command (qemu-command/writable-image image))) (run-basic-test %f2fs-root-os command "f2fs-root-os"))))) ;;; ;;; Installation through the graphical interface. ;;; (define %syslog-conf ;; Syslog configuration that dumps to /dev/console, so we can see the ;; installer's messages during the test. (computed-file "syslog.conf" #~(begin (copy-file #$%default-syslog.conf #$output) (chmod #$output #o644) (let ((port (open-file #$output "a"))) (display "\n*.info /dev/console\n" port) #t)))) (define (operating-system-with-console-syslog os) "Return OS with a syslog service that writes to /dev/console." (operating-system (inherit os) (services (modify-services (operating-system-user-services os) (syslog-service-type config => (syslog-configuration (inherit config) (config-file %syslog-conf))))))) (define %root-password "foo") (define* (gui-test-program marionette #:key (desktop? #f) (encrypted? #f)) #~(let () (define (screenshot file) (marionette-control (string-append "screendump " file) #$marionette)) (define-syntax-rule (marionette-eval* exp marionette) (or (marionette-eval exp marionette) (throw 'marionette-eval-failure 'exp))) (setvbuf (current-output-port) 'none) (setvbuf (current-error-port) 'none) (marionette-eval* '(use-modules (gnu installer tests)) #$marionette) ;; Arrange so that 'converse' prints debugging output to the console. (marionette-eval* '(let ((console (open-output-file "/dev/console"))) (setvbuf console 'none) (conversation-log-port console)) #$marionette) ;; Tell the installer to not wait for the Connman "online" status. (marionette-eval* '(call-with-output-file "/tmp/installer-assume-online" (const #t)) #$marionette) ;; Run 'guix system init' with '--no-grafts', to cope with the lack of ;; network access. (marionette-eval* '(call-with-output-file "/tmp/installer-system-init-options" (lambda (port) (write '("--no-grafts" "--no-substitutes") port))) #$marionette) (marionette-eval* '(define installer-socket (open-installer-socket)) #$marionette) (screenshot "installer-start.ppm") (marionette-eval* '(choose-locale+keyboard installer-socket) #$marionette) (screenshot "installer-locale.ppm") ;; Choose the host name that the "basic" test expects. (marionette-eval* '(enter-host-name+passwords installer-socket #:host-name "liberigilo" #:root-password #$%root-password #:users '(("alice" "pass1") ("bob" "pass2"))) #$marionette) (screenshot "installer-services.ppm") (marionette-eval* '(choose-services installer-socket #:choose-desktop-environment? (const #$desktop?) #:choose-network-service? (const #f)) #$marionette) (screenshot "installer-partitioning.ppm") (marionette-eval* '(choose-partitioning installer-socket #:encrypted? #$encrypted? #:passphrase #$%luks-passphrase) #$marionette) (screenshot "installer-run.ppm") (marionette-eval* '(conclude-installation installer-socket) #$marionette) (sync) #t)) (define %extra-packages ;; Packages needed when installing with an encrypted root. (list isc-dhcp lvm2-static cryptsetup-static e2fsck/static loadkeys-static)) (define installation-os-for-gui-tests ;; Operating system that contains all of %EXTRA-PACKAGES, needed for the ;; target OS, as well as syslog output redirected to the console so we can ;; see what the installer is up to. (marionette-operating-system (operating-system (inherit (operating-system-with-console-syslog (operating-system-add-packages (operating-system-with-current-guix installation-os) %extra-packages))) (kernel-arguments '("console=ttyS0"))) #:imported-modules '((gnu services herd) (gnu installer tests) (guix combinators)))) (define* (installation-target-os-for-gui-tests #:key (encrypted? #f)) (operating-system (inherit %minimal-os-on-vda) (users (append (list (user-account (name "alice") (comment "Bob's sister") (group "users") (supplementary-groups '("wheel" "audio" "video"))) (user-account (name "bob") (comment "Alice's brother") (group "users") (supplementary-groups '("wheel" "audio" "video")))) %base-user-accounts)) ;; The installer does not create a swap device in guided mode with ;; encryption support. (swap-devices (if encrypted? '() '("/dev/vda2"))) (services (cons (service dhcp-client-service-type) (operating-system-user-services %minimal-os-on-vda))))) (define* (installation-target-desktop-os-for-gui-tests #:key (encrypted? #f)) (operating-system (inherit (installation-target-os-for-gui-tests #:encrypted? encrypted?)) (keyboard-layout (keyboard-layout "us" "altgr-intl")) ;; Make sure that all the packages and services that may be used by the ;; graphical installer are available. (packages (append (list openbox awesome i3-wm i3status dmenu st ratpoison xterm) %base-packages)) (services (append (list (service gnome-desktop-service-type) (service xfce-desktop-service-type) (service mate-desktop-service-type) (service enlightenment-desktop-service-type) (set-xorg-configuration (xorg-configuration (keyboard-layout keyboard-layout))) (service marionette-service-type (marionette-configuration (imported-modules '((gnu services herd) (guix build utils) (guix combinators)))))) %desktop-services)))) (define* (guided-installation-test name #:key (desktop? #f) (encrypted? #f) target-os (install-size 'guess) (target-size (* 2200 MiB))) (system-test (name name) (description "Install an OS using the graphical installer and test it.") (value (mlet* %store-monad ((image (run-install target-os '(this is unused) #:script #f #:os installation-os-for-gui-tests #:install-size install-size #:target-size target-size #:installation-disk-image-file-system-type "iso9660" #:gui-test (lambda (marionette) (gui-test-program marionette #:desktop? desktop? #:encrypted? encrypted?)))) (command (qemu-command/writable-image image))) (run-basic-test target-os command name #:initialization (and encrypted? enter-luks-passphrase) #:root-password %root-password))))) (define %test-gui-installed-os (guided-installation-test "gui-installed-os" #:target-os (installation-target-os-for-gui-tests))) (define %test-gui-installed-os-encrypted (guided-installation-test "gui-installed-os-encrypted" #:encrypted? #t #:target-os (installation-target-os-for-gui-tests #:encrypted? #t))) ;; Building a desktop image is very time and space consuming. Install all ;; desktop environments in a single test to reduce the overhead. (define %test-gui-installed-desktop-os-encrypted (guided-installation-test "gui-installed-desktop-os-encrypted" #:desktop? #t #:encrypted? #t #:target-os (installation-target-desktop-os-for-gui-tests #:encrypted? #t) ;; XXX: The disk-image size guess is too low. Use ;; a constant value until this is fixed. #:install-size (* 8000 MiB) #:target-size (* 9000 MiB))) ;;; install.scm ends here
generated by cgit