diff --git a/CHANGELOG.rst b/CHANGELOG.rst index b6179dffb..f7a6b2beb 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -2,11 +2,13 @@ Release notes ============= + Version v31.1.0 ---------------- - We re-enabled support for the NPM vulnerabilities advisories importer. - We re-enabled support for the Retiredotnet vulnerabilities advisories importer. +- We re-enabled support for the Kaybee security advisories importer. Version v31.0.0 diff --git a/vulnerabilities/importers/__init__.py b/vulnerabilities/importers/__init__.py index 3594cbd4d..c1248a2d0 100644 --- a/vulnerabilities/importers/__init__.py +++ b/vulnerabilities/importers/__init__.py @@ -13,6 +13,7 @@ from vulnerabilities.importers import debian_oval from vulnerabilities.importers import github from vulnerabilities.importers import gitlab +from vulnerabilities.importers import kaybee from vulnerabilities.importers import nginx from vulnerabilities.importers import npm from vulnerabilities.importers import nvd @@ -41,6 +42,7 @@ debian_oval.DebianOvalImporter, npm.NpmImporter, retiredotnet.RetireDotnetImporter, + kaybee.KaybeeImporter, ] IMPORTERS_REGISTRY = {x.qualified_name: x for x in IMPORTERS_REGISTRY} diff --git a/vulnerabilities/importers/kaybee.py b/vulnerabilities/importers/kaybee.py index 7464a999f..4122783f8 100644 --- a/vulnerabilities/importers/kaybee.py +++ b/vulnerabilities/importers/kaybee.py @@ -7,56 +7,98 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import logging +from pathlib import Path +from typing import Iterable + from packageurl import PackageURL +from univers import version_range from vulnerabilities.importer import AdvisoryData -from vulnerabilities.importer import GitImporter +from vulnerabilities.importer import AffectedPackage +from vulnerabilities.importer import Importer from vulnerabilities.importer import Reference from vulnerabilities.utils import load_yaml -from vulnerabilities.utils import nearest_patched_package +logger = logging.getLogger(__name__) -class KaybeeImporter(GitImporter): - def __enter__(self): - super(KaybeeImporter, self).__enter__() - self._added_files, self._updated_files = self.file_changes( - recursive=True, - file_ext="yaml", - ) - def updated_advisories(self): - advisories = [] - for yaml_file in self._added_files.union(self._updated_files): - advisories.append(yaml_file_to_advisory(yaml_file)) +class KaybeeImporter(Importer): + spdx_license_expression = "Apache-2.0" + license_url = "https://github.com/SAP/project-kb/blob/main/LICENSE.txt" + repo_url = "git+https://github.com/SAP/project-kb.git@vulnerability-data" + + def advisory_data(self) -> Iterable[AdvisoryData]: + try: + self.clone(self.repo_url) + base_path = Path(self.vcs_response.dest_dir) + statements = base_path.glob("statements/**/*.yaml") + for statement_file in statements: + yield yaml_file_to_advisory(statement_file) - return self.batch_advisories(advisories) + finally: + if self.vcs_response: + self.vcs_response.delete() def yaml_file_to_advisory(yaml_path): - impacted_packages = [] - resolved_packages = [] references = [] data = load_yaml(yaml_path) - vuln_id = data["vulnerability_id"] + aliases = [] + vuln_id = data.get("vulnerability_id") + if vuln_id: + aliases.append(vuln_id) summary = "" - if data.get("text"): - summary = "\n".join([note["text"] for note in data["notes"]]) + notes = data.get("notes") + if notes: + note_texts = [] + for note in notes: + note_text = note.get("text") + if note_text: + note_texts.append(note_text) + summary = "\n".join(note_texts) + + affected_packages = [] for entry in data.get("artifacts", []): - package = PackageURL.from_string(entry["id"]) - if entry["affected"]: - impacted_packages.append(package) + purl = entry.get("id") + if not purl: + continue + package = PackageURL.from_string(purl) + version = package.version + affected_version_range = None + fixed_version = None + vrc = version_range.RANGE_CLASS_BY_SCHEMES.get(package.type) + if not vrc: + logger.warning(f"Unknown package type {package.type} for {purl} in {vuln_id}") + continue + if entry.get("affected"): + affected_version_range = vrc.from_versions([version]) else: - resolved_packages.append(package) + fixed_version = vrc.version_class(version) + versionless_purl = PackageURL( + type=package.type, + namespace=package.namespace, + name=package.name, + qualifiers=package.qualifiers, + subpath=package.subpath, + ) + affected_packages.append( + AffectedPackage( + package=versionless_purl, + affected_version_range=affected_version_range, + fixed_version=fixed_version, + ) + ) - for fix in data.get("fixes", []): - for commit in fix["commits"]: + for fix in data.get("fixes") or []: + for commit in fix.get("commits") or []: references.append(Reference(url=f"{commit['repository']}/{commit['id']}")) return AdvisoryData( - vulnerability_id=vuln_id, + aliases=aliases, summary=summary, - affected_packages=nearest_patched_package(impacted_packages, resolved_packages), + affected_packages=affected_packages, references=references, ) diff --git a/vulnerabilities/tests/test_data/kaybee/statement-expected.json b/vulnerabilities/tests/test_data/kaybee/statement-expected.json new file mode 100644 index 000000000..2ec0e42fb --- /dev/null +++ b/vulnerabilities/tests/test_data/kaybee/statement-expected.json @@ -0,0 +1,1126 @@ +{ + "aliases": [ + "CVE-2020-9546" + ], + "summary": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.1.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.3.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.3.0", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.1.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.3.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.5.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.3.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.5.0", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.1.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.5.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.0", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.3.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.5.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.0", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.5", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.7", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.5", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.9", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.7", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.9.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.8", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "org.apache.htrace", + "name": "htrace-core4", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "4.1.0-incubating" + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.9.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.6", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.0.pr3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.0.pr4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "net.sf.ehcache", + "name": "ehcache", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "2.10.6" + }, + { + "package": { + "type": "maven", + "namespace": "com.signalfx.public", + "name": "signalfx-java", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "0.2.0" + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.7.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.11.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.11.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.9", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.11.5", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.11.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.11.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "org.apache.htrace", + "name": "htrace-core", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "3.1.0-incubating" + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "2.9.10.4" + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.10", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.10.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.10.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.10.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.8.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.0.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.4.0", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.4.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.0.6", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.0", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.11", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.2.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.10", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.4.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.0", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.4.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.4.6", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.4.5", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.6", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.5", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.6", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.7", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.5", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.8", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.7", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "2.10.2" + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "2.10.3" + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "2.10.0" + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "2.10.1" + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.0.0", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.7.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.6.7.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.9.5", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.9.3", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.9.4", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.9.1", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.7.9.2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.8.0.rc2", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.9", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-databind", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": "vers:maven/2.9.8", + "fixed_version": null + }, + { + "package": { + "type": "maven", + "namespace": "com.signalfx.public", + "name": "signalfx-java", + "version": null, + "qualifiers": null, + "subpath": null + }, + "affected_version_range": null, + "fixed_version": "0.0.48" + } + ], + "references": [], + "date_published": null +} \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/kaybee/statement.yaml b/vulnerabilities/tests/test_data/kaybee/statement.yaml new file mode 100644 index 000000000..6569922fd --- /dev/null +++ b/vulnerabilities/tests/test_data/kaybee/statement.yaml @@ -0,0 +1,283 @@ +vulnerability_id: CVE-2020-9546 +notes: +- text: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config). +artifacts: +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.0 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.5.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.5.0 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.5.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.0 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.5.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.0 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.5 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.7 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.5 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.8 + reason: Reviewed manually + affected: true +- id: pkg:maven/org.apache.htrace/htrace-core4@4.1.0-incubating + reason: Reviewed manually + affected: false +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.0.pr3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.0.pr4 + reason: Reviewed manually + affected: true +- id: pkg:maven/net.sf.ehcache/ehcache@2.10.6 + reason: Reviewed manually + affected: false +- id: pkg:maven/com.signalfx.public/signalfx-java@0.2.0 + reason: Reviewed manually + affected: false +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.9 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.5 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/org.apache.htrace/htrace-core@3.1.0-incubating + reason: Reviewed manually + affected: false +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4 + reason: Reviewed manually + affected: false +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.0.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.4.0 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.4.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.0.6 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.0 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.10 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.4.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.0 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.4.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.4.6 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.4.5 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.6 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.5 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.6 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.5 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.7 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.2 + reason: Reviewed manually + affected: false +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.3 + reason: Reviewed manually + affected: false +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0 + reason: Reviewed manually + affected: false +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.1 + reason: Reviewed manually + affected: false +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.0.0 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.5 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.3 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.4 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.1 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.0.rc2 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8 + reason: Reviewed manually + affected: true +- id: pkg:maven/com.signalfx.public/signalfx-java@0.0.48 + reason: Reviewed manually + affected: false \ No newline at end of file diff --git a/vulnerabilities/tests/test_kaybee.py b/vulnerabilities/tests/test_kaybee.py new file mode 100644 index 000000000..8ec225307 --- /dev/null +++ b/vulnerabilities/tests/test_kaybee.py @@ -0,0 +1,23 @@ +# +# Copyright (c) nexB Inc. and others. All rights reserved. +# VulnerableCode is a trademark of nexB Inc. +# SPDX-License-Identifier: Apache-2.0 +# See http://www.apache.org/licenses/LICENSE-2.0 for the license text. +# See https://github.com/nexB/vulnerablecode for support or download. +# See https://aboutcode.org for more information about nexB OSS projects. +# + +import os + +from vulnerabilities.importers.kaybee import yaml_file_to_advisory +from vulnerabilities.tests import util_tests + +BASE_DIR = os.path.dirname(os.path.abspath(__file__)) +TEST_DATA = os.path.join(BASE_DIR, "test_data", "kaybee") + + +def test_parse_yaml_file(): + response_file = os.path.join(TEST_DATA, "statement.yaml") + expected_file = os.path.join(TEST_DATA, "statement-expected.json") + advisory = yaml_file_to_advisory(response_file) + util_tests.check_results_against_json(advisory.to_dict(), expected_file)