Skip to content

Commit 7a1e065

Browse files
sbs2001sbs2001
authored
Merge pull request #354 from sbs2001/collect-suse-scores
Collect suse scores
2 parents 111817c + 58fb067 commit 7a1e065

8 files changed

Lines changed: 265 additions & 2 deletions

File tree

‎SOURCES.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,5 @@
4545
+----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+
4646
|elixir_security | https://github.com/dependabot/elixir-security-advisories |hex packages |
4747
+----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+
48+
|suse_scores | https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml |vulnerability severity scores by SUSE |
49+
+----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+

‎vulnerabilities/helpers.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
import requests
2828
import toml
2929

30+
# TODO add logging here
31+
3032

3133
def load_yaml(path):
3234
with open(path) as f:
@@ -43,6 +45,11 @@ def load_toml(path):
4345
return toml.load(f)
4446

4547

48+
def fetch_yaml(url):
49+
response = requests.get(url)
50+
return yaml.safe_load(response.content)
51+
52+
4653
def create_etag(data_src, url, etag_key):
4754
"""
4855
Etags are like hashes of web responses. For a data source `data_src`,

‎vulnerabilities/importer_yielder.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,13 @@
115115
'etags': {},
116116
},
117117
},
118+
{
119+
'name': 'suse_scores',
120+
'license': '',
121+
'last_run': None,
122+
'data_source': 'SUSESeverityScoreDataSource',
123+
'data_source_cfg': {}
124+
},
118125
{
119126
'name': 'debian_oval',
120127
'license': '',

‎vulnerabilities/importers/__init__.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323

2424
from vulnerabilities.importers.alpine_linux import AlpineDataSource
2525
from vulnerabilities.importers.apache_httpd import ApacheHTTPDDataSource
26+
from vulnerabilities.importers.apache_kafka import ApacheKafkaDataSource
27+
from vulnerabilities.importers.apache_tomcat import ApacheTomcatDataSource
2628
from vulnerabilities.importers.archlinux import ArchlinuxDataSource
2729
from vulnerabilities.importers.debian import DebianDataSource
2830
from vulnerabilities.importers.debian_oval import DebianOvalDataSource
@@ -42,7 +44,6 @@
4244
from vulnerabilities.importers.rust import RustDataSource
4345
from vulnerabilities.importers.safety_db import SafetyDbDataSource
4446
from vulnerabilities.importers.suse_backports import SUSEBackportsDataSource
47+
from vulnerabilities.importers.suse_scores import SUSESeverityScoreDataSource
4548
from vulnerabilities.importers.ubuntu import UbuntuDataSource
4649
from vulnerabilities.importers.ubuntu_usn import UbuntuUSNDataSource
47-
from vulnerabilities.importers.apache_tomcat import ApacheTomcatDataSource
48-
from vulnerabilities.importers.apache_kafka import ApacheKafkaDataSource

‎vulnerabilities/importers/suse_scores.py‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# Copyright (c) nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software tool from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
from vulnerabilities.data_source import Advisory
24+
from vulnerabilities.data_source import DataSource
25+
from vulnerabilities.data_source import Reference
26+
from vulnerabilities.data_source import VulnerabilitySeverity
27+
from vulnerabilities.helpers import fetch_yaml
28+
from vulnerabilities.severity_systems import scoring_systems
29+
30+
URL = "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
31+
32+
33+
class SUSESeverityScoreDataSource(DataSource):
34+
35+
def updated_advisories(self):
36+
advisories = []
37+
score_data = fetch_yaml(URL)
38+
advisories.append(self.to_advisory(score_data))
39+
return advisories
40+
41+
@staticmethod
42+
def to_advisory(score_data):
43+
advisories = []
44+
for cve_id in score_data:
45+
severities = []
46+
for cvss_score in score_data[cve_id]["cvss"]:
47+
score = None
48+
vector = None
49+
if cvss_score["version"] == 2.0:
50+
score = VulnerabilitySeverity(
51+
system=scoring_systems["cvssv2"],
52+
value=str(cvss_score["score"])
53+
)
54+
vector = VulnerabilitySeverity(
55+
system=scoring_systems["cvssv2_vector"],
56+
value=str(cvss_score["vector"])
57+
)
58+
59+
elif cvss_score["version"] == 3:
60+
score = VulnerabilitySeverity(
61+
system=scoring_systems["cvssv3"],
62+
value=str(cvss_score["score"])
63+
)
64+
vector = VulnerabilitySeverity(
65+
system=scoring_systems["cvssv3_vector"],
66+
value=str(cvss_score["vector"])
67+
)
68+
69+
elif cvss_score["version"] == 3.1:
70+
score = VulnerabilitySeverity(
71+
system=scoring_systems["cvssv3.1"],
72+
value=str(cvss_score["score"])
73+
)
74+
vector = VulnerabilitySeverity(
75+
system=scoring_systems["cvssv3.1_vector"],
76+
value=str(cvss_score["vector"])
77+
)
78+
79+
severities.extend([score, vector])
80+
81+
advisories.append(
82+
Advisory(
83+
cve_id=cve_id,
84+
summary="",
85+
impacted_package_urls=[],
86+
vuln_references=[
87+
Reference(
88+
url=URL,
89+
severities=severities
90+
)
91+
]
92+
)
93+
)
94+
return advisories

‎vulnerabilities/severity_systems.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,18 @@ def as_score(self, value):
4848
url="https://www.first.org/cvss/v3-0/",
4949
notes="cvssv3 vector, used to get additional info about nature and severity of vulnerability", # nopep8
5050
),
51+
"cvssv3.1": ScoringSystem(
52+
identifier="cvssv3.1",
53+
name="CVSSv3.1 Base Score",
54+
url="https://www.first.org/cvss/v3-1/",
55+
notes="cvssv3.1 base score",
56+
),
57+
"cvssv3.1_vector": ScoringSystem(
58+
identifier="cvssv3.1_vector",
59+
name="CVSSv3.1 Vector",
60+
url="https://www.first.org/cvss/v3-1/",
61+
notes="cvssv3.1 vector, used to get additional info about nature and severity of vulnerability", # nopep8
62+
),
5163
"rhbs": ScoringSystem(
5264
identifier="rhbs",
5365
name="RedHat Bugzilla severity",

‎vulnerabilities/tests/test_data/suse_scores/suse-cvss-scores.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
CVE-2004-0230:
3+
cvss:
4+
- version: 2.0
5+
score: 4.3
6+
vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
7+
- version: 3.1
8+
score: 3.7
9+
vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
10+
CVE-2003-1605:
11+
cvss:
12+
- version: 3
13+
score: 8.6
14+
vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

‎vulnerabilities/tests/test_suse_scores.py‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
# Copyright (c) nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an 'AS IS' BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
import os
24+
from unittest import TestCase
25+
26+
from vulnerabilities.data_source import Advisory
27+
from vulnerabilities.data_source import Reference
28+
from vulnerabilities.data_source import VulnerabilitySeverity
29+
from vulnerabilities.importers.suse_scores import SUSESeverityScoreDataSource
30+
from vulnerabilities.helpers import load_yaml
31+
from vulnerabilities.severity_systems import ScoringSystem
32+
33+
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
34+
TEST_DATA = os.path.join(BASE_DIR, "test_data/suse_scores", "suse-cvss-scores.yaml")
35+
36+
37+
class TestSUSESeverityScoreDataSource(TestCase):
38+
def test_to_advisory(self):
39+
raw_data = load_yaml(TEST_DATA)
40+
expected_data = [
41+
Advisory(
42+
summary="",
43+
impacted_package_urls=[],
44+
resolved_package_urls=[],
45+
vuln_references=[
46+
Reference(
47+
reference_id="",
48+
url="https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml",
49+
severities=[
50+
VulnerabilitySeverity(
51+
system=ScoringSystem(
52+
identifier="cvssv2",
53+
name="CVSSv2 Base Score",
54+
url="https://www.first.org/cvss/v2/",
55+
notes="cvssv2 base score",
56+
),
57+
value="4.3",
58+
),
59+
VulnerabilitySeverity(
60+
system=ScoringSystem(
61+
identifier="cvssv2_vector",
62+
name="CVSSv2 Vector",
63+
url="https://www.first.org/cvss/v2/",
64+
notes="cvssv2 vector, used to get additional info about nature and severity of vulnerability", # nopep8
65+
),
66+
value="AV:N/AC:M/Au:N/C:N/I:N/A:P",
67+
),
68+
VulnerabilitySeverity(
69+
system=ScoringSystem(
70+
identifier="cvssv3.1",
71+
name="CVSSv3.1 Base Score",
72+
url="https://www.first.org/cvss/v3-1/",
73+
notes="cvssv3.1 base score",
74+
),
75+
value="3.7",
76+
),
77+
VulnerabilitySeverity(
78+
system=ScoringSystem(
79+
identifier="cvssv3.1_vector",
80+
name="CVSSv3.1 Vector",
81+
url="https://www.first.org/cvss/v3-1/",
82+
notes="cvssv3.1 vector, used to get additional info about nature and severity of vulnerability", # nopep8
83+
),
84+
value="CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
85+
),
86+
],
87+
)
88+
],
89+
cve_id="CVE-2004-0230",
90+
),
91+
Advisory(
92+
summary="",
93+
impacted_package_urls=[],
94+
resolved_package_urls=[],
95+
vuln_references=[
96+
Reference(
97+
reference_id="",
98+
url="https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml",
99+
severities=[
100+
VulnerabilitySeverity(
101+
system=ScoringSystem(
102+
identifier="cvssv3",
103+
name="CVSSv3 Base Score",
104+
url="https://www.first.org/cvss/v3-0/",
105+
notes="cvssv3 base score",
106+
),
107+
value="8.6",
108+
),
109+
VulnerabilitySeverity(
110+
system=ScoringSystem(
111+
identifier="cvssv3_vector",
112+
name="CVSSv3 Vector",
113+
url="https://www.first.org/cvss/v3-0/",
114+
notes="cvssv3 vector, used to get additional info about nature and severity of vulnerability", # nopep8
115+
),
116+
value="CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
117+
),
118+
],
119+
)
120+
],
121+
cve_id="CVE-2003-1605",
122+
),
123+
]
124+
125+
found_data = SUSESeverityScoreDataSource.to_advisory(raw_data)
126+
assert expected_data == found_data

0 commit comments

Comments
 (0)