summary.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "3e364068-76a2-4e33-93a3-04b3eecf5263",
   "metadata": {},
   "source": [
    "# Summarize Vulnerabilities"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9a64a3cf-17cc-4dee-8650-9211e84ca85d",
   "metadata": {},
   "source": [
    "Import the Python dependencies needed for this analysis:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "7bc1755f-6cf7-40f5-a836-d13887183822",
   "metadata": {},
   "outputs": [],
   "source": [
    "import json\n",
    "import pathlib\n",
    "import typing\n",
    "\n",
    "from icecream import ic\n",
    "from pydantic import BaseModel\n",
    "import pandas as pd"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "af81db7c-8669-4a91-8d56-d3722929b176",
   "metadata": {},
   "source": [
    "Define a `pydantic` data class to represent the key, actionable information for each reported vulnerability:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "0ae410ab-d1a8-40ce-ad72-f19b770a143d",
   "metadata": {},
   "outputs": [],
   "source": [
    "class Vulnerabilty (BaseModel):\n",
    "    id: str\n",
    "    severity: str\n",
    "    description: str\n",
    "    url: str\n",
    "    kind: str\n",
    "    artifact: str\n",
    "    version: str\n",
    "    fix: str\n",
    "    location: typing.List[str]"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4024f0c2-77fb-4633-b236-ffdd592af42d",
   "metadata": {},
   "source": [
    "Load the JSON output from the `grype` vulnerability scan:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "e0b6051c-60a9-46c3-addf-ab30865af02f",
   "metadata": {},
   "outputs": [],
   "source": [
    "data:data = {}\n",
    "vuln_set: dict = {}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "5cf7744a-b620-452e-a2ed-7d77e3e57881",
   "metadata": {},
   "outputs": [],
   "source": [
    "cve_path = pathlib.Path(\"cve.json\")\n",
    "\n",
    "with open(cve_path, \"r\") as fp:\n",
    "    data = json.load(fp)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e07f6aa1-f423-42ad-80a4-0b047a72e122",
   "metadata": {},
   "source": [
    "Group the vulnerabilities by their unique `id` values:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "41667f27-3dd1-4dd6-813e-b6da2c241e92",
   "metadata": {},
   "outputs": [],
   "source": [
    "for item in data[\"matches\"]:\n",
    "    #ic(item)\n",
    "    id = item[\"vulnerability\"][\"id\"]\n",
    "    \n",
    "    if id not in vuln_set:\n",
    "        descrip = \"\"\n",
    "\n",
    "        if \"description\" in item[\"vulnerability\"]:\n",
    "            descrip = item[\"vulnerability\"][\"description\"]\n",
    "\n",
    "        vuln_set[id] = Vulnerabilty(\n",
    "            id = item[\"vulnerability\"][\"id\"],\n",
    "            description = descrip,\n",
    "            severity = item[\"vulnerability\"][\"severity\"],\n",
    "            fix = item[\"vulnerability\"][\"fix\"][\"versions\"][0],\n",
    "            url = item[\"vulnerability\"][\"urls\"][0],\n",
    "            kind = item[\"artifact\"][\"type\"],\n",
    "            artifact = item[\"artifact\"][\"name\"],\n",
    "            version = item[\"artifact\"][\"version\"],\n",
    "            location = [ item[\"artifact\"][\"locations\"][0][\"path\"] ],\n",
    "        )\n",
    "    else:\n",
    "        vuln_set[id].location.append(item[\"artifact\"][\"locations\"][0][\"path\"])"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "16be083d-3739-4a76-8714-4a3e46d083c5",
   "metadata": {},
   "source": [
    "Construct a `pandas` dataframe to sort these by severity:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "7c193686-d13f-4ceb-bf3f-dcb11601e6e3",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>severity</th>\n",
       "      <th>kind</th>\n",
       "      <th>artifact</th>\n",
       "      <th>version</th>\n",
       "      <th>fix</th>\n",
       "      <th>description</th>\n",
       "      <th>location</th>\n",
       "      <th>id</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>High</td>\n",
       "      <td>java-archive</td>\n",
       "      <td>gson</td>\n",
       "      <td>2.8.6</td>\n",
       "      <td>2.8.9</td>\n",
       "      <td>Deserialization of Untrusted Data in Gson</td>\n",
       "      <td>[/home/ray/anaconda3/lib/python3.8/site-packag...</td>\n",
       "      <td>GHSA-4jrv-ppp4-jm57</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>Medium</td>\n",
       "      <td>deb</td>\n",
       "      <td>e2fsprogs</td>\n",
       "      <td>1.45.5-2ubuntu1</td>\n",
       "      <td>1.45.5-2ubuntu1.1</td>\n",
       "      <td></td>\n",
       "      <td>[/usr/share/doc/e2fsprogs/copyright, /usr/shar...</td>\n",
       "      <td>CVE-2022-1304</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>Medium</td>\n",
       "      <td>deb</td>\n",
       "      <td>libssl1.1</td>\n",
       "      <td>1.1.1f-1ubuntu2.13</td>\n",
       "      <td>1.1.1f-1ubuntu2.15</td>\n",
       "      <td></td>\n",
       "      <td>[/usr/share/doc/libssl1.1/copyright, /usr/shar...</td>\n",
       "      <td>CVE-2022-2068</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "  severity          kind   artifact             version                 fix  \\\n",
       "2     High  java-archive       gson               2.8.6               2.8.9   \n",
       "0   Medium           deb  e2fsprogs     1.45.5-2ubuntu1   1.45.5-2ubuntu1.1   \n",
       "1   Medium           deb  libssl1.1  1.1.1f-1ubuntu2.13  1.1.1f-1ubuntu2.15   \n",
       "\n",
       "                                 description  \\\n",
       "2  Deserialization of Untrusted Data in Gson   \n",
       "0                                              \n",
       "1                                              \n",
       "\n",
       "                                            location                   id  \n",
       "2  [/home/ray/anaconda3/lib/python3.8/site-packag...  GHSA-4jrv-ppp4-jm57  \n",
       "0  [/usr/share/doc/e2fsprogs/copyright, /usr/shar...        CVE-2022-1304  \n",
       "1  [/usr/share/doc/libssl1.1/copyright, /usr/shar...        CVE-2022-2068  "
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df = pd.DataFrame([\n",
    "        item.__dict__\n",
    "        for item in vuln_set.values()\n",
    "    ])\n",
    "\n",
    "columns = [ \"severity\", \"kind\", \"artifact\", \"version\", \"fix\", \"description\", \"location\", \"id\", \"url\" ]\n",
    "df = df.reindex(columns=columns)\n",
    "df = df.sort_values(by=[ \"severity\", \"kind\", \"artifact\", \"version\" ])\n",
    "\n",
    "df_report = df.drop(\"url\", axis=1)\n",
    "df_report.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f44a8c7c-184f-418f-b25c-a7a8309ef5d3",
   "metadata": {},
   "source": [
    "Report the actionable vulnerabilities and their suggested fixes:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "0ddc8382-d5db-466a-82c4-17f02ab86547",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>severity</th>\n",
       "      <th>kind</th>\n",
       "      <th>artifact</th>\n",
       "      <th>version</th>\n",
       "      <th>fix</th>\n",
       "      <th>description</th>\n",
       "      <th>location</th>\n",
       "      <th>id</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>High</td>\n",
       "      <td>java-archive</td>\n",
       "      <td>gson</td>\n",
       "      <td>2.8.6</td>\n",
       "      <td>2.8.9</td>\n",
       "      <td>Deserialization of Untrusted Data in Gson</td>\n",
       "      <td>[/home/ray/anaconda3/lib/python3.8/site-packag...</td>\n",
       "      <td>GHSA-4jrv-ppp4-jm57</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>Medium</td>\n",
       "      <td>deb</td>\n",
       "      <td>e2fsprogs</td>\n",
       "      <td>1.45.5-2ubuntu1</td>\n",
       "      <td>1.45.5-2ubuntu1.1</td>\n",
       "      <td></td>\n",
       "      <td>[/usr/share/doc/e2fsprogs/copyright, /usr/shar...</td>\n",
       "      <td>CVE-2022-1304</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>Medium</td>\n",
       "      <td>deb</td>\n",
       "      <td>libssl1.1</td>\n",
       "      <td>1.1.1f-1ubuntu2.13</td>\n",
       "      <td>1.1.1f-1ubuntu2.15</td>\n",
       "      <td></td>\n",
       "      <td>[/usr/share/doc/libssl1.1/copyright, /usr/shar...</td>\n",
       "      <td>CVE-2022-2068</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "  severity          kind   artifact             version                 fix  \\\n",
       "2     High  java-archive       gson               2.8.6               2.8.9   \n",
       "0   Medium           deb  e2fsprogs     1.45.5-2ubuntu1   1.45.5-2ubuntu1.1   \n",
       "1   Medium           deb  libssl1.1  1.1.1f-1ubuntu2.13  1.1.1f-1ubuntu2.15   \n",
       "\n",
       "                                 description  \\\n",
       "2  Deserialization of Untrusted Data in Gson   \n",
       "0                                              \n",
       "1                                              \n",
       "\n",
       "                                            location                   id  \n",
       "2  [/home/ray/anaconda3/lib/python3.8/site-packag...  GHSA-4jrv-ppp4-jm57  \n",
       "0  [/usr/share/doc/e2fsprogs/copyright, /usr/shar...        CVE-2022-1304  \n",
       "1  [/usr/share/doc/libssl1.1/copyright, /usr/shar...        CVE-2022-2068  "
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_report"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "36bd9071-1bb3-42ec-ad71-51cd7e493bbc",
   "metadata": {},
   "outputs": [],
   "source": [
    "with open(pathlib.Path(\"todo.json\"), \"w\") as fp:\n",
    "    data = json.loads(df.to_json(orient=\"records\"))\n",
    "    fp.write(json.dumps(data, indent=4, sort_keys=True))"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}