Skip to content

Commit 9c05886

Browse files
sbs2001sbs2001
committed
Create and use ScoringSystem objects for handling severity
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
1 parent eae0fd2 commit 9c05886

7 files changed

Lines changed: 82 additions & 29 deletions

File tree

‎vulnerabilities/data_source.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,13 +42,14 @@
4242
from packageurl import PackageURL
4343

4444
from vulnerabilities.oval_parser import OvalParser
45+
from vulnerabilities.severity_systems import ScoringSystem
4546

4647
logger = logging.getLogger(__name__)
4748

4849

4950
@dataclasses.dataclass
5051
class VulnerabilitySeverity:
51-
system: str
52+
system: ScoringSystem
5253
value: str
5354

5455

‎vulnerabilities/import_runner.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ def process_advisories(data_source: DataSource) -> None:
131131
for score in vuln_ref.severities:
132132
models.VulnerabilitySeverity.objects.update_or_create(
133133
vulnerability=vuln,
134-
scoring_system_identifier=score.system,
134+
scoring_system_identifier=score.system.identifier,
135135
reference=ref,
136136
defaults={"value": score.value},
137137
)

‎vulnerabilities/importers/nvd.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,9 @@
3232
from vulnerabilities.data_source import DataSource
3333
from vulnerabilities.data_source import DataSourceConfiguration
3434
from vulnerabilities.data_source import Reference
35-
from vulnerabilities.helpers import create_etag
3635
from vulnerabilities.data_source import VulnerabilitySeverity
36+
from vulnerabilities.helpers import create_etag
37+
from vulnerabilities.severity_systems import scoring_systems
3738

3839

3940
@dataclasses.dataclass
@@ -106,15 +107,15 @@ def extract_severity_scores(cve_item):
106107
if cve_item["impact"].get("baseMetricV3"):
107108
severity_scores.append(
108109
VulnerabilitySeverity(
109-
system="cvssV3",
110+
system=scoring_systems["cvssv3"],
110111
value=str(cve_item["impact"]["baseMetricV3"]["cvssV3"]["baseScore"]),
111112
)
112113
)
113114

114115
if cve_item["impact"].get("baseMetricV2"):
115116
severity_scores.append(
116117
VulnerabilitySeverity(
117-
system="cvssV2",
118+
system=scoring_systems["cvssv2"],
118119
value=str(cve_item["impact"]["baseMetricV2"]["cvssV2"]["baseScore"]),
119120
)
120121
)

‎vulnerabilities/importers/redhat.py‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,13 @@
3131
from vulnerabilities.data_source import DataSourceConfiguration
3232
from vulnerabilities.data_source import Reference
3333
from vulnerabilities.data_source import VulnerabilitySeverity
34+
from vulnerabilities.severity_systems import scoring_systems
3435

3536

3637
class RedhatDataSource(DataSource):
3738
CONFIG_CLASS = DataSourceConfiguration
3839

3940
def __enter__(self):
40-
4141
self.redhat_response = fetch()
4242

4343
def updated_advisories(self):
@@ -82,7 +82,7 @@ def to_advisory(advisory_data):
8282
bugzilla_data = requests.get(f"https://bugzilla.redhat.com/rest/bug/{bugzilla}").json()
8383
bugzilla_severity_val = bugzilla_data["bugs"][0]["severity"]
8484
bugzilla_severity = VulnerabilitySeverity(
85-
system="REDHAT_BUGZILLA_SEVERITY",
85+
system=scoring_systems["rhbs"],
8686
value=bugzilla_severity_val,
8787
)
8888

@@ -95,26 +95,21 @@ def to_advisory(advisory_data):
9595
)
9696

9797
for rh_adv in advisory_data["advisories"]:
98-
99-
url = "https://access.redhat.com/errata/{}".format(rh_adv)
100-
10198
# RH provides 3 types of advisories RHSA, RHBA, RHEA. Only RHSA's contain severity score.
10299
# See https://access.redhat.com/articles/2130961 for more details.
103100

104101
if "RHSA" in rh_adv:
105-
rhsa_data = requests.get(
106-
f"https://access.redhat.com/hydra/rest/securitydata/cvrf/{rh_adv}.json"
107-
).json() # nopep8
102+
rhsa_data = requests.get(f"https://access.redhat.com/hydra/rest/securitydata/cvrf/{rh_adv}.json").json() # nopep8
108103
value = rhsa_data["cvrfdoc"]["aggregate_severity"]
109104
rhsa_aggregate_severity = VulnerabilitySeverity(
110-
system="RHSA_AGGREGATE_SEVERITY",
105+
system=scoring_systems["rhas"],
111106
value=value,
112107
)
113108

114109
references.append(
115110
Reference(
116111
severities=[rhsa_aggregate_severity],
117-
url=url,
112+
url="https://access.redhat.com/errata/{}".format(rh_adv),
118113
reference_id=rh_adv,
119114
)
120115
)
@@ -125,7 +120,7 @@ def to_advisory(advisory_data):
125120
redhat_cve_entry = requests.get(advisory_data["resource_url"]).json()
126121
redhat_cvss = redhat_cve_entry["cvss3"]["cvss3_base_score"]
127122
redhat_cvss3 = VulnerabilitySeverity(
128-
system="REDHAT_CVSS3",
123+
system=scoring_systems["rh_cvssv3"],
129124
value=redhat_cvss,
130125
)
131126

‎vulnerabilities/severity_systems.py‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
import dataclasses
2+
3+
4+
@dataclasses.dataclass
5+
class ScoringSystem:
6+
7+
# a short identifier for the scoring system.
8+
identifier: str
9+
# a name which represents the scoring system such as `RedHat bug severity`.
10+
# This is for human understanding
11+
name: str
12+
# a url to documentation about that sscoring system
13+
url: str
14+
# notes about that scoring system
15+
notes: str = ""
16+
17+
def as_score(self, value):
18+
"""
19+
Return a normalized numeric score for this scoring system given a raw
20+
value. For instance htis can be used to convert a CVSS vector to a base
21+
score.
22+
"""
23+
raise NotImplementedError
24+
25+
26+
scoring_systems = {
27+
"cvssv2": ScoringSystem(
28+
identifier="cvssv2",
29+
name="CVSSv2",
30+
url="https://www.first.org/cvss/v2/",
31+
notes="We store the vector as value and compute scores from that.",
32+
),
33+
"cvssv3": ScoringSystem(
34+
identifier="cvssv3",
35+
name="CVSSv3",
36+
url="https://www.first.org/cvss/v3-0/",
37+
notes="We store the vector as value and compute scores from that.",
38+
),
39+
"rhbs": ScoringSystem(
40+
identifier="rhbs",
41+
name="RedHat Bugzilla severity",
42+
url="https://bugzilla.redhat.com/page.cgi?id=fields.html#bug_severity",
43+
),
44+
"rhas": ScoringSystem(
45+
identifier="rhas",
46+
name="RedHat Aggregate severity",
47+
url="https://access.redhat.com/security/updates/classification/",
48+
),
49+
"rh_cvssv3": ScoringSystem(
50+
identifier="rh_cvssv3",
51+
name="RedHat CVSSv3",
52+
url="https://access.redhat.com/security/updates/classification/",
53+
),
54+
}

‎vulnerabilities/tests/test_nvd.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
from vulnerabilities.data_source import Reference
3030
from vulnerabilities.data_source import Advisory
3131
from vulnerabilities.data_source import VulnerabilitySeverity
32+
from vulnerabilities.severity_systems import scoring_systems
3233

3334
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
3435
TEST_DATA = os.path.join(BASE_DIR, "test_data/nvd/nvd_test.json")
@@ -147,7 +148,7 @@ def test_to_advisories(self):
147148
Reference(
148149
url="https://nvd.nist.gov/vuln/detail/CVE-2005-4895", # nopep8
149150
severities=[
150-
VulnerabilitySeverity(system="cvssV2", value="5.0")
151+
VulnerabilitySeverity(system=scoring_systems["cvssv2"], value="5.0")
151152
],
152153
reference_id="CVE-2005-4895",
153154
),

‎vulnerabilities/tests/test_redhat_importer.py‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
from vulnerabilities.data_source import Advisory
3232
from vulnerabilities.data_source import Reference
3333
from vulnerabilities.data_source import VulnerabilitySeverity
34+
from vulnerabilities.severity_systems import scoring_systems
3435

3536
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
3637
TEST_DATA = os.path.join(BASE_DIR, "test_data/", "redhat.json")
@@ -86,7 +87,7 @@ def test_to_advisory(self):
8687
reference_id="1396383",
8788
severities=[
8889
VulnerabilitySeverity(
89-
system="REDHAT_BUGZILLA_SEVERITY", value=2.0
90+
system=scoring_systems["rhbs"], value=2.0
9091
)
9192
],
9293
),
@@ -95,7 +96,7 @@ def test_to_advisory(self):
9596
reference_id="RHSA-2017:1931",
9697
severities=[
9798
VulnerabilitySeverity(
98-
system="RHSA_AGGREGATE_SEVERITY", value=2.2
99+
system=scoring_systems["rhas"], value=2.2
99100
)
100101
],
101102
),
@@ -104,7 +105,7 @@ def test_to_advisory(self):
104105
reference_id="RHSA-2017:0725",
105106
severities=[
106107
VulnerabilitySeverity(
107-
system="RHSA_AGGREGATE_SEVERITY", value=2.2
108+
system=scoring_systems["rhas"], value=2.2
108109
)
109110
],
110111
),
@@ -113,7 +114,7 @@ def test_to_advisory(self):
113114
reference_id="",
114115
severities=[
115116
VulnerabilitySeverity(
116-
system="REDHAT_CVSS3", value=6.0
117+
system=scoring_systems["rh_cvssv3"], value=6.0
117118
)
118119
],
119120
),
@@ -161,7 +162,7 @@ def test_to_advisory(self):
161162
reference_id="1430347",
162163
severities=[
163164
VulnerabilitySeverity(
164-
system="REDHAT_BUGZILLA_SEVERITY", value=2.0
165+
system=scoring_systems["rhbs"], value=2.0
165166
)
166167
],
167168
),
@@ -170,7 +171,7 @@ def test_to_advisory(self):
170171
reference_id="RHSA-2017:1842",
171172
severities=[
172173
VulnerabilitySeverity(
173-
system="RHSA_AGGREGATE_SEVERITY", value=2.2
174+
system=scoring_systems["rhas"], value=2.2
174175
)
175176
],
176177
),
@@ -179,7 +180,7 @@ def test_to_advisory(self):
179180
reference_id="RHSA-2017:2437",
180181
severities=[
181182
VulnerabilitySeverity(
182-
system="RHSA_AGGREGATE_SEVERITY", value=2.2
183+
system=scoring_systems["rhas"], value=2.2
183184
)
184185
],
185186
),
@@ -188,7 +189,7 @@ def test_to_advisory(self):
188189
reference_id="RHSA-2017:2077",
189190
severities=[
190191
VulnerabilitySeverity(
191-
system="RHSA_AGGREGATE_SEVERITY", value=2.2
192+
system=scoring_systems["rhas"], value=2.2
192193
)
193194
],
194195
),
@@ -197,7 +198,7 @@ def test_to_advisory(self):
197198
reference_id="RHSA-2017:2444",
198199
severities=[
199200
VulnerabilitySeverity(
200-
system="RHSA_AGGREGATE_SEVERITY", value=2.2
201+
system=scoring_systems["rhas"], value=2.2
201202
)
202203
],
203204
),
@@ -206,7 +207,7 @@ def test_to_advisory(self):
206207
reference_id="",
207208
severities=[
208209
VulnerabilitySeverity(
209-
system="REDHAT_CVSS3", value=6.0
210+
system=scoring_systems["rh_cvssv3"], value=6.0
210211
)
211212
],
212213
),
@@ -229,7 +230,7 @@ def test_to_advisory(self):
229230
reference_id="1492984",
230231
severities=[
231232
VulnerabilitySeverity(
232-
system="REDHAT_BUGZILLA_SEVERITY", value=2.0
233+
system=scoring_systems["rhbs"], value=2.0
233234
)
234235
],
235236
),
@@ -238,7 +239,7 @@ def test_to_advisory(self):
238239
reference_id="",
239240
severities=[
240241
VulnerabilitySeverity(
241-
system="REDHAT_CVSS3", value=6.0
242+
system=scoring_systems["rh_cvssv3"], value=6.0
242243
)
243244
],
244245
),

0 commit comments

Comments
 (0)