Sofa tables #42
Sofa tables #42
Conversation
LCOV of commit
|
|
For the 14.4.1 example, that CVE says it was patched on 14.4.1. Shouldn't that query come up empty since it is running on the version of macOS for which it was patched? I'd definitely expect that to show up on a 14.4.0 machine since it wasn't patched until 14.4.1. |
|
You mean on the info table? That table is supposed to be information about the current running OS, but it could be a look back. Open to suggestions here - please elaborate on the logic you are thinking of. Edit: I now realize I missed off the query I ran when I pasted the output. That run is for the separate info table. |
Oh right. So for In the other table, it would show info about what the current OS has patched. That makes sense. I was thinking the second query was also |
|
Now I think about it more, perhaps the tables should operate the same (showing unpatched vulnerabilities for the same major os version) and accept an input for other versions. Thoughts? |
|
I think that would make sense 👍 |
I left the sofa_security_release_info table displaying the current running os by default, as it is representing information about the release, not unpatched vulnerabilities as in the other table. Both tables will use the |
When running on macOS 14.0
When running requesting info on os versions since 14.4.0
osquery> select * from sofa_security_release_info where os_version="14.4.0";
+---------------------+-----------------+----------------------+---------------------------------------+-------------------+-----------------------------+------------+
| update_name | product_version | release_date | security_info | unique_cves_count | days_since_previous_release | os_version |
+---------------------+-----------------+----------------------+---------------------------------------+-------------------+-----------------------------+------------+
| macOS Sonoma 14.4.1 | 14.4.1 | 2024-03-25T00:00:00Z | https://support.apple.com/kb/HT214096 | 1 | 18 | 14.4.0 |
| macOS Sonoma 14.4 | 14.4 | 2024-03-07T00:00:00Z | https://support.apple.com/kb/HT214084 | 67 | 28 | 14.4.0 |
+---------------------+-----------------+----------------------+---------------------------------------+-------------------+-----------------------------+------------+