Add scoring system for vectors

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

Author: sbs2001

vulnerabilities/admin.py

@@ -29,6 +29,7 @@
     Package,
     Vulnerability,
     VulnerabilityReference,
+    VulnerabilitySeverity
 )
 
 
@@ -55,3 +56,7 @@ class PackageRelatedVulnerabilityAdmin(admin.ModelAdmin):
 @admin.register(Importer)
 class ImporterAdmin(admin.ModelAdmin):
     pass
+
+@admin.register(VulnerabilitySeverity)
+class VulnerabilitySeverityAdmin(admin.ModelAdmin):
+    pass

vulnerabilities/importers/nvd.py

@@ -111,6 +111,12 @@ def extract_severity_scores(cve_item):
                     value=str(cve_item["impact"]["baseMetricV3"]["cvssV3"]["baseScore"]),
                 )
             )
+            severity_scores.append(
+                VulnerabilitySeverity(
+                    system=scoring_systems["cvssv3_vector"],
+                    value=str(cve_item["impact"]["baseMetricV3"]["cvssV3"]["vectorString"]),
+                )
+            )
 
         if cve_item["impact"].get("baseMetricV2"):
             severity_scores.append(
@@ -119,6 +125,12 @@ def extract_severity_scores(cve_item):
                     value=str(cve_item["impact"]["baseMetricV2"]["cvssV2"]["baseScore"]),
                 )
             )
+            severity_scores.append(
+                VulnerabilitySeverity(
+                    system=scoring_systems["cvssv2_vector"],
+                    value=str(cve_item["impact"]["baseMetricV2"]["cvssV2"]["vectorString"]),
+                )
+            )
 
         return severity_scores
 

vulnerabilities/importers/redhat.py

@@ -43,7 +43,7 @@ def __enter__(self):
     def updated_advisories(self):
         processed_advisories = []
         for advisory_data in self.redhat_response:
-            processed_advisories.extend(to_advisory(advisory_data))
+            processed_advisories.append(to_advisory(advisory_data))
 
         return self.batch_advisories(processed_advisories)
 
@@ -55,7 +55,6 @@ def fetch():
     url = "https://access.redhat.com/hydra/rest/securitydata/cve.json?page={}"
 
     while True:
-
         resp_json = requests.get(url.format(page_no)).json()
         page_no += 1
         if not resp_json:
@@ -68,7 +67,6 @@ def fetch():
 
 
 def to_advisory(advisory_data):
-
     affected_purls = []
     if advisory_data.get("affected_packages"):
         for rpm in advisory_data["affected_packages"]:
@@ -117,14 +115,26 @@ def to_advisory(advisory_data):
         else:
             references.append(Reference(severities=[], url=url, reference_id=rh_adv))
 
-    redhat_cve_entry = requests.get(advisory_data["resource_url"]).json()
-    redhat_cvss = redhat_cve_entry["cvss3"]["cvss3_base_score"]
-    redhat_cvss3 = VulnerabilitySeverity(
-        system=scoring_systems["rh_cvssv3"],
-        value=redhat_cvss,
-    )
+    redhat_scores = []
+    cvssv3_score = advisory_data.get("cvss3_score")
+    if cvssv3_score:
+        redhat_scores.append(
+            VulnerabilitySeverity(
+                system=scoring_systems["cvssv3"],
+                value=cvssv3_score,
+            )
+        )
+
+    cvssv3_vector = advisory_data.get("cvss3_scoring_vector")
+    if cvssv3_vector:
+        redhat_scores.append(
+            VulnerabilitySeverity(
+                system=scoring_systems["cvssv3_vector"],
+                value=cvssv3_vector,
+            )
+        )
 
-    references.append(Reference(severities=[redhat_cvss3], url=advisory_data["resource_url"]))
+    references.append(Reference(severities=redhat_scores, url=advisory_data["resource_url"]))
 
     return Advisory(
         summary=advisory_data["bugzilla_description"],

vulnerabilities/migrations/0001_initial.py

@@ -1,4 +1,4 @@
-# Generated by Django 3.0.7 on 2021-01-21 16:32
+# Generated by Django 3.0.7 on 2021-02-03 07:30
 
 import django.contrib.postgres.fields.jsonb
 from django.db import migrations, models
@@ -49,12 +49,24 @@ class Migration(migrations.Migration):
                 ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                 ('cve_id', models.CharField(help_text='CVE ID', max_length=50, null=True, unique=True)),
                 ('summary', models.TextField(blank=True, help_text='Summary of the vulnerability')),
-                ('cvss', models.FloatField(help_text='CVSS Score', max_length=100, null=True)),
             ],
             options={
                 'verbose_name_plural': 'Vulnerabilities',
             },
         ),
+        migrations.CreateModel(
+            name='VulnerabilityReference',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('source', models.CharField(blank=True, help_text='Source(s) name eg:NVD', max_length=50)),
+                ('reference_id', models.CharField(blank=True, help_text='Reference ID, eg:DSA-4465-1', max_length=50)),
+                ('url', models.URLField(blank=True, help_text='URL of Vulnerability data', max_length=1024)),
+                ('vulnerability', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='vulnerabilities.Vulnerability')),
+            ],
+            options={
+                'unique_together': {('vulnerability', 'source', 'reference_id', 'url')},
+            },
+        ),
         migrations.CreateModel(
             name='PackageRelatedVulnerability',
             fields=[
@@ -74,16 +86,16 @@ class Migration(migrations.Migration):
             field=models.ManyToManyField(through='vulnerabilities.PackageRelatedVulnerability', to='vulnerabilities.Vulnerability'),
         ),
         migrations.CreateModel(
-            name='VulnerabilityReference',
+            name='VulnerabilitySeverity',
             fields=[
                 ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('source', models.CharField(blank=True, help_text='Source(s) name eg:NVD', max_length=50)),
-                ('reference_id', models.CharField(blank=True, help_text='Reference ID, eg:DSA-4465-1', max_length=50)),
-                ('url', models.URLField(blank=True, help_text='URL of Vulnerability data', max_length=1024)),
+                ('value', models.CharField(help_text='Example: 9.0, Important, High', max_length=50)),
+                ('scoring_system', models.CharField(choices=[('cvssv2', 'CVSSv2'), ('cvssv3', 'CVSSv3'), ('rhbs', 'RedHat Bugzilla severity'), ('rhas', 'RedHat Aggregate severity')], help_text='Identifier for the scoring system used. Avaiable choices are: cvssv2 is identifier for CVSSv2 system, cvssv3 is identifier for CVSSv3 system, rhbs is identifier for RedHat Bugzilla severity system, rhas is identifier for RedHat Aggregate severity system ', max_length=50)),
+                ('reference', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='vulnerabilities.VulnerabilityReference')),
                 ('vulnerability', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='vulnerabilities.Vulnerability')),
             ],
             options={
-                'unique_together': {('vulnerability', 'source', 'reference_id', 'url')},
+                'unique_together': {('vulnerability', 'reference', 'scoring_system')},
             },
         ),
         migrations.AlterUniqueTogether(

vulnerabilities/migrations/0002_vulnerabilityseverityscore.py

@@ -210,7 +210,7 @@ class VulnerabilitySeverity(models.Model):
     scoring_system = models.CharField(
         max_length=50,
         choices=scoring_system_choices,
-        help_text="Identifier for the scoring system used. Avaiable choices are: {} ".format(
+        help_text="Identifier for the scoring system used. Available choices are: {} ".format(
                   ", ".join(
                         [
                             f"{ss.identifier} is identifier for {ss.name} system"