Extract severity from oval advisories

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/importer.py

@@ -31,6 +31,7 @@
 from univers.version_range import VersionRange
 from univers.versions import Version
 
+from vulnerabilities import severity_systems
 from vulnerabilities.oval_parser import OvalParser
 from vulnerabilities.severity_systems import SCORING_SYSTEMS
 from vulnerabilities.severity_systems import ScoringSystem
@@ -425,7 +426,19 @@ def get_data_from_xml_doc(
             # connected/linked to an OvalDefinition
             vuln_id = definition_data["vuln_id"]
             description = definition_data["description"]
-            references = [Reference(url=url) for url in definition_data["reference_urls"]]
+            severities = (
+                [
+                    VulnerabilitySeverity(
+                        system=severity_systems.GENERIC, value=definition_data.get("severity")
+                    )
+                ]
+                if definition_data.get("severity")
+                else []
+            )
+            references = [
+                Reference(url=url, severities=severities)
+                for url in definition_data["reference_urls"]
+            ]
             affected_packages = []
             for test_data in definition_data["test_data"]:
                 for package_name in test_data["package_list"]:

vulnerabilities/oval_parser.py

@@ -48,6 +48,8 @@ def get_data(self) -> List[Dict]:
             definition_data["vuln_id"] = self.get_vuln_id_from_definition(definition)
             definition_data["reference_urls"] = self.get_urls_from_definition(definition)
 
+            definition_data["severity"] = self.get_severity_from_definition(definition)
+
             for test in matching_tests:
                 test_obj, test_state = self.get_object_state_of_test(test)
                 if not test_obj or not test_state:
@@ -165,6 +167,15 @@ def get_urls_from_definition(definition: OvalDefinition) -> Set[str]:
 
         return all_urls
 
+    @staticmethod
+    def get_severity_from_definition(definition: OvalDefinition) -> Set[str]:
+        definition_metadata = definition.getMetadata().element
+        for child in definition_metadata:
+            if child.tag.endswith("advisory"):
+                for grandchild in child:
+                    if grandchild.tag.endswith("severity"):
+                        return grandchild.text
+
     @staticmethod
     def get_vuln_id_from_definition(definition):
         # SUSE and Ubuntu OVAL files will get cves via this loop

vulnerabilities/tests/test_data/ubuntu-oval-expected.json

@@ -22,17 +22,32 @@
       {
         "reference_id": "",
         "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8703.html",
-        "severities": []
+        "severities": [
+          {
+            "system": "generic_textual",
+            "value": "Medium"
+          }
+        ]
       },
       {
         "reference_id": "",
         "url": "https://blogs.gentoo.org/ago/2016/08/08/potrace-multiplesix-heap-based-buffer-overflow-in-bm_readbody_bmp-bitmap_io-c/",
-        "severities": []
+        "severities": [
+          {
+            "system": "generic_textual",
+            "value": "Medium"
+          }
+        ]
       },
       {
         "reference_id": "",
         "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8703",
-        "severities": []
+        "severities": [
+          {
+            "system": "generic_textual",
+            "value": "Medium"
+          }
+        ]
       }
     ],
     "date_published": "2020-05-11T04:53:34+00:00"
@@ -60,32 +75,62 @@
       {
         "reference_id": "",
         "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8860.html",
-        "severities": []
+        "severities": [
+          {
+            "system": "generic_textual",
+            "value": "Medium"
+          }
+        ]
       },
       {
         "reference_id": "",
         "url": "http://www.openwall.com/lists/oss-security/2016/10/18/11",
-        "severities": []
+        "severities": [
+          {
+            "system": "generic_textual",
+            "value": "Medium"
+          }
+        ]
       },
       {
         "reference_id": "",
         "url": "https://blog.torproject.org/blog/tor-0289-released-important-fixes",
-        "severities": []
+        "severities": [
+          {
+            "system": "generic_textual",
+            "value": "Medium"
+          }
+        ]
       },
       {
         "reference_id": "",
         "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8860",
-        "severities": []
+        "severities": [
+          {
+            "system": "generic_textual",
+            "value": "Medium"
+          }
+        ]
       },
       {
         "reference_id": "",
         "url": "https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce",
-        "severities": []
+        "severities": [
+          {
+            "system": "generic_textual",
+            "value": "Medium"
+          }
+        ]
       },
       {
         "reference_id": "",
         "url": "https://trac.torproject.org/projects/tor/ticket/20384",
-        "severities": []
+        "severities": [
+          {
+            "system": "generic_textual",
+            "value": "Medium"
+          }
+        ]
       }
     ],
     "date_published": "2020-05-11T04:53:34+00:00"