Skip to content

Commit ee6c68b

Browse files
netpickermailsanjayhere
netpicker
and
mailsanjayhere
authored
xr and nxos 2023 CVEs (#173)
* arista 2021 cves * Fix flake8 and syntax errors in Arista CVE scripts * cisco_ios 2022 cves * cisco_xe 2022 cves * cisco_xe 2022 cves * cisco_xr 2022 cves * cisco_xr 2022 cves * cisco_nxos 2022 cves * cisco_nxos 2022 cves * arista 2022 2024 cve * arista 2022 2024 cve * Arista 2023 * Arista 2023 * cisco_ios 2023 cve * cisco_ios 2023 cve * cisco_xe cve 2023 * cisco_xe cve 2023 * xr and nxos 2023 CVEs * xr and nxos 2023 CVEs * fixed cve 2023 nxos xe --------- Co-authored-by: mailsanjayhere <mailsanjayhere@gmail.com>
1 parent e902624 commit ee6c68b

18 files changed

+910
-6
lines changed

‎CVEasy/Cisco/2023/cisco_nxos/__init__.py‎

Whitespace-only changes.

‎CVEasy/Cisco/2023/cisco_nxos/cve202320050.py‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320050',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
check_cli='show running-config | include cli'
9+
),
10+
)
11+
def rule_cve202320050(configuration, commands, device, devices):
12+
"""
13+
This rule checks for the CVE-2023-20050 vulnerability in Cisco NX-OS Software.
14+
The vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands.
15+
An attacker could exploit this vulnerability by including crafted input as the argument of an affected command.
16+
"""
17+
# Extract the output of the command to check CLI configuration
18+
cli_output = commands.check_cli
19+
20+
# Check if CLI command is configured
21+
cli_configured = 'cli' in cli_output
22+
23+
# Assert that the device is not vulnerable
24+
assert not cli_configured, (
25+
f"Device {device.name} is vulnerable to CVE-2023-20050. "
26+
"The device has CLI command enabled, which could allow an attacker to execute arbitrary commands. "
27+
"For more information, see"
28+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-"
29+
"sa-nxos-cli-cmdinject-euQVK9u"
30+
)

‎CVEasy/Cisco/2023/cisco_nxos/cve202320089.py‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320089',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_lldp='show running-config | include lldp'
10+
),
11+
)
12+
def rule_cve202320089(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20089 vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI Mode.
15+
The vulnerability is due to incorrect error checking when parsing ingress LLDP packets, which could allow
16+
an unauthenticated, adjacent attacker to cause a memory leak, resulting in a denial of service (DoS) condition.
17+
"""
18+
# Extract the output of the command to check LLDP configuration
19+
lldp_output = commands.check_lldp
20+
21+
# Check if LLDP is enabled
22+
lldp_enabled = 'lldp' in lldp_output
23+
24+
# Assert that the device is not vulnerable
25+
assert not lldp_enabled, (
26+
f"Device {device.name} is vulnerable to CVE-2023-20089. "
27+
"The device is running in ACI Mode AND has LLDP enabled, "
28+
"which could allow an attacker to cause a memory leak and DoS condition. "
29+
"For more information, see"
30+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-lldp-dos-ySCNZOpX"
31+
)

‎CVEasy/Cisco/2023/cisco_nxos/cve202320115.py‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320115',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_sftp='show running-config | include sftp'
10+
),
11+
)
12+
def rule_cve202320115(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20115 vulnerability in Cisco NX-OS Software.
15+
The vulnerability is due to a logic error when verifying the user role when an SFTP connection is opened,
16+
which could allow an authenticated, remote attacker to download or overwrite files from the underlying
17+
operating system of an affected device.
18+
"""
19+
# Extract the version information from the command output
20+
version_output = commands.show_version
21+
22+
# List of vulnerable software versions
23+
vulnerable_versions = [
24+
'9.2(1)', '9.2(2)', '9.2(2t)', '9.2(3)', '9.2(4)', '9.2(2v)',
25+
'9.3(1)', '9.3(2)', '9.3(3)', '9.3(4)', '9.3(5)', '9.3(6)', '9.3(7)', '9.3(7a)',
26+
'9.3(8)', '9.3(9)', '9.3(10)', '9.3(11)', '10.1(1)', '10.1(2)', '10.1(2t)',
27+
'10.2(1)', '10.2(1q)', '10.2(2)', '10.2(3)', '10.2(3t)', '10.2(4)', '10.2(5)',
28+
'10.3(1)', '10.3(2)'
29+
]
30+
31+
# Check if the current device's software version is in the list of vulnerable versions
32+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
33+
34+
# If version is not vulnerable, no need to check further
35+
if not version_vulnerable:
36+
return
37+
38+
# Extract the output of the command to check SFTP configuration
39+
sftp_output = commands.check_sftp
40+
41+
# Check if SFTP is configured
42+
sftp_configured = 'sftp' in sftp_output
43+
44+
# Assert that the device is not vulnerable
45+
assert not sftp_configured, (
46+
f"Device {device.name} is vulnerable to CVE-2023-20115. "
47+
"The device is running a vulnerable version AND has SFTP configured, "
48+
"which could allow an attacker to download or overwrite files. "
49+
"For more information, see"
50+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-sftp-xVAp5Hfd"
51+
)

‎CVEasy/Cisco/2023/cisco_nxos/cve202320168.py‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320168',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_tacacs_radius='show running-config | include tacacs|radius'
10+
),
11+
)
12+
def rule_cve202320168(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20168 vulnerability in Cisco NX-OS Software.
15+
The vulnerability is due to incorrect input validation when processing an authentication attempt
16+
if the directed request option is enabled for TACACS+ or RADIUS, which could allow an unauthenticated,
17+
local attacker to cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition.
18+
"""
19+
# Extract the version information from the command output
20+
version_output = commands.show_version
21+
22+
# List of vulnerable software versions
23+
vulnerable_versions = [
24+
# 4.2 versions
25+
'4.2(1)SV1(4)', '4.2(1)SV1(4a)', '4.2(1)SV1(4b)', '4.2(1)SV1(5.1)', '4.2(1)SV1(5.1a)',
26+
'4.2(1)SV1(5.2)', '4.2(1)SV1(5.2b)', '4.2(1)SV2(1.1)', '4.2(1)SV2(1.1a)', '4.2(1)SV2(2.1)',
27+
'4.2(1)SV2(2.1a)', '4.2(1)SV2(2.2)', '4.2(1)SV2(2.3)',
28+
# 5.2 versions
29+
'5.2(1)SM1(5.1)', '5.2(1)SM1(5.2)', '5.2(1)SM1(5.2a)', '5.2(1)SM1(5.2b)', '5.2(1)SM1(5.2c)',
30+
'5.2(1)SM3(1.1)', '5.2(1)SM3(1.1a)', '5.2(1)SM3(1.1b)', '5.2(1)SM3(1.1c)', '5.2(1)SM3(2.1)',
31+
'5.2(1)SV3(1.4)', '5.2(1)SV3(1.1)', '5.2(1)SV3(1.3)', '5.2(1)SV3(1.5a)', '5.2(1)SV3(1.5b)',
32+
'5.2(1)SV3(1.6)', '5.2(1)SV3(1.10)', '5.2(1)SV3(1.15)', '5.2(1)SV3(2.1)', '5.2(1)SV3(2.5)',
33+
'5.2(1)SV3(2.8)', '5.2(1)SV3(3.1)', '5.2(1)SV3(1.2)', '5.2(1)SV3(1.4b)', '5.2(1)SV3(3.15)',
34+
'5.2(1)SV3(4.1)', '5.2(1)SV3(4.1a)', '5.2(1)SV3(4.1b)', '5.2(1)SV3(4.1c)',
35+
# 6.0 versions
36+
'6.0(2)A3(1)', '6.0(2)A3(2)', '6.0(2)A3(4)', '6.0(2)A4(1)', '6.0(2)A4(2)', '6.0(2)A4(3)',
37+
'6.0(2)A4(4)', '6.0(2)A4(5)', '6.0(2)A4(6)', '6.0(2)A6(1)', '6.0(2)A6(1a)', '6.0(2)A6(2)',
38+
'6.0(2)A6(2a)', '6.0(2)A6(3)', '6.0(2)A6(3a)', '6.0(2)A6(4)', '6.0(2)A6(4a)', '6.0(2)A6(5)',
39+
'6.0(2)A6(5a)', '6.0(2)A6(5b)', '6.0(2)A6(6)', '6.0(2)A6(7)', '6.0(2)A6(8)', '6.0(2)A7(1)',
40+
'6.0(2)A7(1a)', '6.0(2)A7(2)', '6.0(2)A7(2a)', '6.0(2)A8(1)', '6.0(2)A8(2)', '6.0(2)A8(3)',
41+
'6.0(2)A8(4)', '6.0(2)A8(4a)', '6.0(2)A8(5)', '6.0(2)A8(6)', '6.0(2)A8(7)', '6.0(2)A8(7a)',
42+
'6.0(2)A8(7b)', '6.0(2)A8(8)', '6.0(2)A8(9)', '6.0(2)A8(10a)', '6.0(2)A8(10)', '6.0(2)A8(11)',
43+
'6.0(2)A8(11a)', '6.0(2)A8(11b)', '6.0(2)U2(1)', '6.0(2)U2(2)', '6.0(2)U2(3)', '6.0(2)U2(4)',
44+
'6.0(2)U2(5)', '6.0(2)U2(6)', '6.0(2)U3(1)', '6.0(2)U3(2)', '6.0(2)U3(3)', '6.0(2)U3(4)',
45+
'6.0(2)U3(5)', '6.0(2)U3(6)', '6.0(2)U3(7)', '6.0(2)U3(8)', '6.0(2)U3(9)', '6.0(2)U4(1)',
46+
'6.0(2)U4(2)', '6.0(2)U4(3)', '6.0(2)U4(4)', '6.0(2)U5(1)', '6.0(2)U5(2)', '6.0(2)U5(3)',
47+
'6.0(2)U5(4)', '6.0(2)U6(1)', '6.0(2)U6(2)', '6.0(2)U6(3)', '6.0(2)U6(4)', '6.0(2)U6(5)',
48+
'6.0(2)U6(6)', '6.0(2)U6(7)', '6.0(2)U6(8)', '6.0(2)U6(1a)', '6.0(2)U6(2a)', '6.0(2)U6(3a)',
49+
'6.0(2)U6(4a)', '6.0(2)U6(5a)', '6.0(2)U6(5b)', '6.0(2)U6(5c)', '6.0(2)U6(9)', '6.0(2)U6(10)',
50+
# 6.2 versions
51+
'6.2(2)', '6.2(2a)', '6.2(6)', '6.2(6b)', '6.2(8)', '6.2(8a)', '6.2(8b)', '6.2(10)',
52+
'6.2(12)', '6.2(18)', '6.2(16)', '6.2(14)', '6.2(6a)', '6.2(20)', '6.2(1)', '6.2(3)',
53+
'6.2(5)', '6.2(5a)', '6.2(5b)', '6.2(7)', '6.2(9)', '6.2(9a)', '6.2(9b)', '6.2(9c)',
54+
'6.2(11)', '6.2(11b)', '6.2(11c)', '6.2(11d)', '6.2(11e)', '6.2(13)', '6.2(13a)', '6.2(13b)',
55+
'6.2(15)', '6.2(17)', '6.2(19)', '6.2(21)', '6.2(23)', '6.2(20a)', '6.2(25)', '6.2(22)',
56+
'6.2(27)', '6.2(29)', '6.2(24)', '6.2(31)', '6.2(24a)', '6.2(33)',
57+
# 7.0 versions
58+
'7.0(3)F1(1)', '7.0(3)F2(1)', '7.0(3)F2(2)', '7.0(3)F3(1)', '7.0(3)F3(2)', '7.0(3)F3(3)',
59+
'7.0(3)F3(3a)', '7.0(3)F3(4)', '7.0(3)F3(3c)', '7.0(3)F3(5)', '7.0(3)I2(2a)', '7.0(3)I2(2b)',
60+
'7.0(3)I2(2c)', '7.0(3)I2(2d)', '7.0(3)I2(2e)', '7.0(3)I2(3)', '7.0(3)I2(4)', '7.0(3)I2(5)',
61+
'7.0(3)I2(1)', '7.0(3)I2(1a)', '7.0(3)I2(2)', '7.0(3)I3(1)', '7.0(3)I4(1)', '7.0(3)I4(2)',
62+
'7.0(3)I4(3)', '7.0(3)I4(4)', '7.0(3)I4(5)', '7.0(3)I4(6)', '7.0(3)I4(7)', '7.0(3)I4(8)',
63+
'7.0(3)I4(8a)', '7.0(3)I4(8b)', '7.0(3)I4(8z)', '7.0(3)I4(9)', '7.0(3)I5(1)', '7.0(3)I5(2)',
64+
'7.0(3)I6(1)', '7.0(3)I6(2)', '7.0(3)I7(1)', '7.0(3)I7(2)', '7.0(3)I7(3)', '7.0(3)I7(4)',
65+
'7.0(3)I7(5)', '7.0(3)I7(5a)', '7.0(3)I7(6)', '7.0(3)I7(7)', '7.0(3)I7(8)', '7.0(3)I7(9)',
66+
'7.0(3)I7(10)',
67+
# 7.1 versions
68+
'7.1(0)N1(1a)', '7.1(0)N1(1b)', '7.1(0)N1(1)', '7.1(1)N1(1)', '7.1(2)N1(1)', '7.1(3)N1(1)',
69+
'7.1(3)N1(2)', '7.1(4)N1(1)', '7.1(5)N1(1)', '7.1(5)N1(1b)',
70+
# 7.2 versions
71+
'7.2(0)D1(1)', '7.2(1)D1(1)', '7.2(2)D1(2)', '7.2(2)D1(1)',
72+
# 7.3 versions
73+
'7.3(0)D1(1)', '7.3(0)DX(1)', '7.3(0)DY(1)', '7.3(0)N1(1)', '7.3(1)D1(1)', '7.3(1)DY(1)',
74+
'7.3(1)N1(1)', '7.3(2)D1(1)', '7.3(2)D1(2)', '7.3(2)D1(3)', '7.3(2)D1(3a)', '7.3(2)N1(1)',
75+
'7.3(3)N1(1)', '7.3(4)N1(1)', '7.3(3)D1(1)', '7.3(4)D1(1)', '7.3(5)N1(1)', '7.3(6)N1(1)',
76+
'7.3(5)D1(1)', '7.3(7)N1(1)', '7.3(7)N1(1a)', '7.3(7)N1(1b)', '7.3(6)D1(1)', '7.3(8)N1(1)',
77+
'7.3(7)D1(1)', '7.3(9)N1(1)', '7.3(10)N1(1)', '7.3(8)D1(1)', '7.3(9)D1(1)', '7.3(11)N1(1)',
78+
'7.3(12)N1(1)', '7.3(13)N1(1)',
79+
# 8.0 versions
80+
'8.0(1)',
81+
# 8.1 versions
82+
'8.1(1)', '8.1(2)', '8.1(2a)', '8.1(1a)', '8.1(1b)',
83+
# 8.2 versions
84+
'8.2(1)', '8.2(2)', '8.2(3)', '8.2(4)', '8.2(5)', '8.2(6)', '8.2(7)', '8.2(7a)', '8.2(8)',
85+
'8.2(9)',
86+
# 8.3 versions
87+
'8.3(1)', '8.3(2)',
88+
# 8.4 versions
89+
'8.4(1)', '8.4(1a)', '8.4(2)', '8.4(2a)', '8.4(3)', '8.4(2b)', '8.4(4)', '8.4(2c)',
90+
'8.4(4a)', '8.4(5)', '8.4(2d)', '8.4(6)', '8.4(2e)', '8.4(6a)', '8.4(7)', '8.4(2f)',
91+
# 8.5 versions
92+
'8.5(1)',
93+
# 9.2 versions
94+
'9.2(1)', '9.2(2)', '9.2(2t)', '9.2(3)', '9.2(4)', '9.2(2v)', '9.2(1a)',
95+
# 9.3 versions
96+
'9.3(1)', '9.3(2)', '9.3(3)', '9.3(4)', '9.3(5)', '9.3(6)', '9.3(7)', '9.3(7a)', '9.3(8)',
97+
'9.3(9)', '9.3(10)', '9.3(11)',
98+
# 10.1 versions
99+
'10.1(1)', '10.1(2)', '10.1(2t)',
100+
# 10.2 versions
101+
'10.2(1)', '10.2(1q)', '10.2(2)', '10.2(3)', '10.2(3t)', '10.2(4)', '10.2(5)',
102+
# 10.3 versions
103+
'10.3(1)', '10.3(2)',
104+
]
105+
106+
# Check if the current device's software version is in the list of vulnerable versions
107+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
108+
109+
# If version is not vulnerable, no need to check further
110+
if not version_vulnerable:
111+
return
112+
113+
# Extract the output of the command to check TACACS+ and RADIUS configuration
114+
tacacs_radius_output = commands.check_tacacs_radius
115+
116+
# Check if TACACS+ or RADIUS is configured
117+
tacacs_radius_configured = 'tacacs' in tacacs_radius_output or 'radius' in tacacs_radius_output
118+
119+
# Assert that the device is not vulnerable
120+
assert not tacacs_radius_configured, (
121+
f"Device {device.name} is vulnerable to CVE-2023-20168. "
122+
"The device is running a vulnerable version AND has TACACS+ or RADIUS configured, "
123+
"which could allow an attacker to cause a denial of service. "
124+
"For more information, see"
125+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-"
126+
"sa-nxos-remoteauth-dos-XB6pv74m"
127+
)

‎CVEasy/Cisco/2023/cisco_nxos/cve202320169.py‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320169',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_isis='show running-config | include router isis'
10+
),
11+
)
12+
def rule_cve202320169(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20169 vulnerability in Cisco NX-OS Software.
15+
The vulnerability is due to insufficient input validation when parsing an ingress IS-IS packet,
16+
which could allow an unauthenticated, adjacent attacker to cause the IS-IS process to unexpectedly restart,
17+
resulting in a denial of service (DoS) condition.
18+
"""
19+
# Extract the version information from the command output
20+
version_output = commands.show_version
21+
22+
# List of vulnerable software versions
23+
vulnerable_versions = [
24+
# 10.3 versions
25+
'10.3(2)',
26+
]
27+
28+
# Check if the current device's software version is in the list of vulnerable versions
29+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
30+
31+
# If version is not vulnerable, no need to check further
32+
if not version_vulnerable:
33+
return
34+
35+
# Extract the output of the command to check IS-IS configuration
36+
isis_output = commands.check_isis
37+
38+
# Check if IS-IS is configured
39+
isis_configured = 'router isis' in isis_output
40+
41+
# Assert that the device is not vulnerable
42+
assert not isis_configured, (
43+
f"Device {device.name} is vulnerable to CVE-2023-20169. "
44+
"The device is running a vulnerable version AND has IS-IS configured, "
45+
"which could allow an attacker to cause a denial of service. "
46+
"For more information, see"
47+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-"
48+
"sa-nxos-n3_9k-isis-dos-FTCXB4Vb"
49+
)

‎CVEasy/Cisco/2023/cisco_nxos/cve202320185.py‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320185',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_cloudsec='show running-config | include cloudsec'
10+
),
11+
)
12+
def rule_cve202320185(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20185 vulnerability in Cisco NX-OS System Software in ACI Mode.
15+
The vulnerability is due to an issue with the implementation of the ciphers used by the
16+
CloudSec encryption feature, which could allow an unauthenticated, remote attacker to read or modify
17+
intersite encrypted traffic.
18+
"""
19+
# Extract the version information from the command output
20+
version_output = commands.show_version
21+
22+
# List of vulnerable software versions
23+
vulnerable_versions = [
24+
# 14.0 versions
25+
'14.0(1h)', '14.0(2c)', '14.0(3d)', '14.0(3c)',
26+
# 14.1 versions
27+
'14.1(1i)', '14.1(1j)', '14.1(1k)', '14.1(1l)',
28+
'14.1(2g)', '14.1(2m)', '14.1(2o)', '14.1(2s)',
29+
'14.1(2u)', '14.1(2w)', '14.1(2x)',
30+
# 14.2 versions
31+
'14.2(1i)', '14.2(1j)', '14.2(1l)', '14.2(2e)',
32+
'14.2(2f)', '14.2(2g)', '14.2(3j)', '14.2(3l)',
33+
'14.2(3n)', '14.2(3q)', '14.2(4i)', '14.2(4k)',
34+
'14.2(4o)', '14.2(4p)', '14.2(5k)', '14.2(5l)',
35+
'14.2(5n)', '14.2(6d)', '14.2(6g)', '14.2(6h)',
36+
'14.2(6l)', '14.2(7f)', '14.2(7l)', '14.2(6o)',
37+
'14.2(7q)', '14.2(7r)', '14.2(7s)', '14.2(7t)',
38+
'14.2(7u)', '14.2(7v)', '14.2(7w)',
39+
# 15.0 versions
40+
'15.0(1k)', '15.0(1l)', '15.0(2e)', '15.0(2h)',
41+
# 15.1 versions
42+
'15.1(1h)', '15.1(2e)', '15.1(3e)', '15.1(4c)',
43+
# 15.2 versions
44+
'15.2(1g)', '15.2(2e)', '15.2(2f)', '15.2(2g)',
45+
'15.2(2h)', '15.2(3e)', '15.2(3f)', '15.2(3g)',
46+
'15.2(4d)', '15.2(4e)', '15.2(5c)', '15.2(5d)',
47+
'15.2(5e)', '15.2(4f)', '15.2(6e)', '15.2(6g)',
48+
'15.2(7f)', '15.2(7g)', '15.2(8d)', '15.2(8e)',
49+
'15.2(8f)', '15.2(8g)', '15.2(8h)',
50+
# 16.0 versions
51+
'16.0(1g)', '16.0(1j)', '16.0(2h)', '16.0(2j)',
52+
'16.0(3d)', '16.0(3e)',
53+
# 15.3 versions
54+
'15.3(1d)',
55+
]
56+
57+
# Check if the current device's software version is in the list of vulnerable versions
58+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
59+
60+
# If version is not vulnerable, no need to check further
61+
if not version_vulnerable:
62+
return
63+
64+
# Extract the output of the command to check CloudSec configuration
65+
cloudsec_output = commands.check_cloudsec
66+
67+
# Check if CloudSec is configured
68+
cloudsec_configured = 'cloudsec' in cloudsec_output
69+
70+
# Assert that the device is not vulnerable
71+
assert not cloudsec_configured, (
72+
f"Device {device.name} is vulnerable to CVE-2023-20185. "
73+
"The device is running a vulnerable version AND has CloudSec configured, "
74+
"which could allow an attacker to read or modify intersite encrypted traffic. "
75+
"For more information, see"
76+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-"
77+
"sa-aci-cloudsec-enc-Vs5Wn2sX"
78+
)

0 commit comments

Comments
 (0)