Add importer for vmware/photon/wiki/Security-Advisories vulnerabilities advisories

[Samk1710]

Added an importer at vulnerabilities/pipelines/vmwarephoton_importer.py and registered in vulnerabilities/importers/init.py
Addressing issue: #36

Signed-off-by: Sampurna Pyne sampurnapyne1710@gmail.com

[keshav-space]

Thanks @Samk1710, see some suggestions.

• Should we instead use the Photon advisory republished in OSV by @captn3m0 ?#1586
• Add your DCO signoff in the commit itself, and also make sure to go through the contribution guidelines on how to write a good commit message https://aboutcode.readthedocs.io/en/latest/contributing/writing_good_commit_messages.html
• Run the code formatting command make valid before committing code, as mentioned in the tutorial https://vulnerablecode.readthedocs.io/en/latest/tutorial_add_importer_pipeline.html#implement-the-collect-advisories-method
• Also, don't forget to add unit tests.

[keshav-space]

Why commit the Qdrant init config?

[keshav-space]

Not the right approach, advisory should always be yielded. No need to compute all advisory at once. See the other importer pipelines like https://github.com/aboutcode-org/vulnerablecode/blob/main/vulnerabilities/pipelines/nginx_importer.py

[Samk1710]

Thankyou @keshav-space for the suggestions. I will look into them and make the changes. Thankyou.

[captn3m0]

Should we instead use the Photon advisory republished in OSV

Since this code already uses the CVE feed, the additional source I use in generating in the OSV feed are the Photon Security Advisories which are in markdown.

Just for context, the additional information you get from the PHSA feed is the following:

1. A PHSA identifier, issued by VMWare
2. A textual severity (Low, Critical, Important, Moderate)
3. Issue date for the advisory
4. List of packages that were updated, with the associated checksums and build timestamps.

As an example, PHSA-2024-5.0-0301 includes updates for libarchive - ['CVE-2024-26256'] and openssl - ['CVE-2024-4741'].

The CVE JSON feed includes the following information:

{"cve_id": "CVE-2024-26256", "pkg": "libarchive", "cve_score": 7.8, "aff_ver": "all versions before 3.7.1-2.ph5 are vulnerable", "res_ver": "3.7.1-2.ph5"}

while the PHSA page calls it a "Important" update with an issue date of 2024-06-21 and the following 2 packages:

libarchive-3.7.1-2.ph5.x86_64.rpm | size : 384K , sha256 : 632f9fb09bb56c3b5c38ed668eb29184a9b294be56c510a7a022fe85c5eb9c9c , build time : Fri, 21 Jun 2024 12:40:33 UTC

libarchive-devel-3.7.1-2.ph5.x86_64.rpm | size : 172K , sha256 : 2423a6ddcb83676ba7ab675ad3c2cc19575a42b123cdfe1fd55a51474e1e3664 , build time : Fri, 21 Jun 2024 12:40:33 UTC

The only additional information I consume for the OSV feed is the PHSA ID (I'm planning to add the checksums), so the gains are quite minor - except for interoperability perhaps by relying on OSV imports directly.

[keshav-space]

@captn3m0 Thanks for all the work on the PhotonOS OSV Advisory. We will be using it in this pipeline.

[Samk1710]

Continued this importer in a fresh PR.