Include "version" attribute in debian.extract_vulnerabilities()

Before this change, only "fixed_version" was retained. This is
the lowest version of the package that includes a fix for the
given vulnerability. However in the meantime, newer versions
of the package might have become available in the Debian release
passed in as "base_release".

Signed-off-by: Haiko Schol <hs@haikoschol.com>

Author: haikoschol

vulnerabilities/scraper/debian.py

@@ -48,12 +48,16 @@ def extract_vulnerabilities(debian_data, base_release='jessie'):
             if not release:
                 continue
 
+            # the latest version of this package in base_release
+            version = release.get('repositories', {}).get(base_release, '')
+
             package_vulnerabilities.append({
                 'package_name': package_name,
                 'vulnerability_id': vulnerability,
                 'description': details.get('description', ''),
                 'status': release.get('status', ''),
                 'urgency': release.get('urgency', ''),
+                'version': version,
                 'fixed_version': release.get('fixed_version', '')
             })
 

vulnerabilities/tests/test_scrapers.py

@@ -72,6 +72,7 @@ def test_debian_extract_vulnerabilities():
             'description': 'librsync before 1.0.0 uses a truncated MD4 checksum to match blocks',
             'status': 'open',
             'urgency': 'low',
+            'version': '0.9.7-10',
             'fixed_version': ''
         },
         {
@@ -80,6 +81,7 @@ def test_debian_extract_vulnerabilities():
             'description': 'Multiple stack-based buffer overflows in mimetex.cgi in mimeTeX',
             'status': 'resolved',
             'urgency': 'medium',
+            'version': '1.74-1',
             'fixed_version': '1.50-1.1'
         },
         {
@@ -88,6 +90,7 @@ def test_debian_extract_vulnerabilities():
             'description': 'Multiple unspecified vulnerabilities in mimeTeX',
             'status': 'resolved',
             'urgency': 'medium',
+            'version': '1.74-1',
             'fixed_version': '1.50-1.1'
         }
     ]