From 73762fc22d0fd45528749edbcefbe4e27b98e747 Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Tue, 16 Feb 2021 11:09:02 +0530 Subject: [PATCH 1/4] Add cvss3.1 score and vector systems in severity_system.py Signed-off-by: Shivam Sandbhor --- vulnerabilities/severity_systems.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/vulnerabilities/severity_systems.py b/vulnerabilities/severity_systems.py index cfa76740d..42a32b7b9 100644 --- a/vulnerabilities/severity_systems.py +++ b/vulnerabilities/severity_systems.py @@ -48,6 +48,18 @@ def as_score(self, value): url="https://www.first.org/cvss/v3-0/", notes="cvssv3 vector, used to get additional info about nature and severity of vulnerability", # nopep8 ), + "cvssv3.1": ScoringSystem( + identifier="cvssv3.1", + name="CVSSv3.1 Base Score", + url="https://www.first.org/cvss/v3-1/", + notes="cvssv3.1 base score", + ), + "cvssv3.1_vector": ScoringSystem( + identifier="cvssv3.1_vector", + name="CVSSv3.1 Vector", + url="https://www.first.org/cvss/v3-1/", + notes="cvssv3.1 vector, used to get additional info about nature and severity of vulnerability", # nopep8 + ), "rhbs": ScoringSystem( identifier="rhbs", name="RedHat Bugzilla severity", From 95f551193252c17a4a8f69c803ee1c69eef312ef Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Tue, 16 Feb 2021 11:31:14 +0530 Subject: [PATCH 2/4] Collect suse severity scores Signed-off-by: Shivam Sandbhor --- vulnerabilities/helpers.py | 7 ++ vulnerabilities/importer_yielder.py | 7 ++ vulnerabilities/importers/__init__.py | 5 +- vulnerabilities/importers/suse_scores.py | 94 ++++++++++++++++++++++++ 4 files changed, 111 insertions(+), 2 deletions(-) create mode 100644 vulnerabilities/importers/suse_scores.py diff --git a/vulnerabilities/helpers.py b/vulnerabilities/helpers.py index 54e0ba60b..a23dd99e8 100644 --- a/vulnerabilities/helpers.py +++ b/vulnerabilities/helpers.py @@ -27,6 +27,8 @@ import requests import toml +# TODO add logging here + def load_yaml(path): with open(path) as f: @@ -43,6 +45,11 @@ def load_toml(path): return toml.load(f) +def fetch_yaml(url): + response = requests.get(url) + return yaml.safe_load(response.content) + + def create_etag(data_src, url, etag_key): """ Etags are like hashes of web responses. For a data source `data_src`, diff --git a/vulnerabilities/importer_yielder.py b/vulnerabilities/importer_yielder.py index 12cd4ff04..d7f45d8d9 100644 --- a/vulnerabilities/importer_yielder.py +++ b/vulnerabilities/importer_yielder.py @@ -115,6 +115,13 @@ 'etags': {}, }, }, + { + 'name': 'suse_scores', + 'license': '', + 'last_run': None, + 'data_source': 'SUSESeverityScoreDataSource', + 'data_source_cfg': {} + }, { 'name': 'debian_oval', 'license': '', diff --git a/vulnerabilities/importers/__init__.py b/vulnerabilities/importers/__init__.py index 0dd87fa06..56d0d4d7e 100644 --- a/vulnerabilities/importers/__init__.py +++ b/vulnerabilities/importers/__init__.py @@ -23,6 +23,8 @@ from vulnerabilities.importers.alpine_linux import AlpineDataSource from vulnerabilities.importers.apache_httpd import ApacheHTTPDDataSource +from vulnerabilities.importers.apache_kafka import ApacheKafkaDataSource +from vulnerabilities.importers.apache_tomcat import ApacheTomcatDataSource from vulnerabilities.importers.archlinux import ArchlinuxDataSource from vulnerabilities.importers.debian import DebianDataSource from vulnerabilities.importers.debian_oval import DebianOvalDataSource @@ -42,7 +44,6 @@ from vulnerabilities.importers.rust import RustDataSource from vulnerabilities.importers.safety_db import SafetyDbDataSource from vulnerabilities.importers.suse_backports import SUSEBackportsDataSource +from vulnerabilities.importers.suse_scores import SUSESeverityScoreDataSource from vulnerabilities.importers.ubuntu import UbuntuDataSource from vulnerabilities.importers.ubuntu_usn import UbuntuUSNDataSource -from vulnerabilities.importers.apache_tomcat import ApacheTomcatDataSource -from vulnerabilities.importers.apache_kafka import ApacheKafkaDataSource diff --git a/vulnerabilities/importers/suse_scores.py b/vulnerabilities/importers/suse_scores.py new file mode 100644 index 000000000..0da973afc --- /dev/null +++ b/vulnerabilities/importers/suse_scores.py @@ -0,0 +1,94 @@ +# Copyright (c) nexB Inc. and others. All rights reserved. +# http://nexb.com and https://github.com/nexB/vulnerablecode/ +# The VulnerableCode software is licensed under the Apache License version 2.0. +# Data generated with VulnerableCode require an acknowledgment. +# +# You may not use this software except in compliance with the License. +# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +# +# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode +# derivative work, you must accompany this data with the following acknowledgment: +# +# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES +# OR CONDITIONS OF ANY KIND, either express or implied. No content created from +# VulnerableCode should be considered or used as legal advice. Consult an Attorney +# for any legal advice. +# VulnerableCode is a free software tool from nexB Inc. and others. +# Visit https://github.com/nexB/vulnerablecode/ for support and download. + +from vulnerabilities.data_source import Advisory +from vulnerabilities.data_source import DataSource +from vulnerabilities.data_source import Reference +from vulnerabilities.data_source import VulnerabilitySeverity +from vulnerabilities.helpers import fetch_yaml +from vulnerabilities.severity_systems import scoring_systems + +URL = f"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" + + +class SUSESeverityScoreDataSource(DataSource): + + def updated_advisories(self): + advisories = [] + score_data = fetch_yaml(URL) + advisories.append(self.to_advisory(score_data)) + return advisories + + @staticmethod + def to_advisory(score_data): + advisories = [] + for cve_id in score_data: + severities = [] + for cvss_score in score_data[cve_id]["cvss"]: + score = None + vector = None + if cvss_score["version"] == 2.0: + score = VulnerabilitySeverity( + system=scoring_systems["cvssv2"], + value=str(cvss_score["score"]) + ) + vector = VulnerabilitySeverity( + system=scoring_systems["cvssv2_vector"], + value=str(cvss_score["vector"]) + ) + + elif cvss_score["version"] == 3: + score = VulnerabilitySeverity( + system=scoring_systems["cvssv3"], + value=str(cvss_score["score"]) + ) + vector = VulnerabilitySeverity( + system=scoring_systems["cvssv3_vector"], + value=str(cvss_score["vector"]) + ) + + elif cvss_score["version"] == 3.1: + score = VulnerabilitySeverity( + system=scoring_systems["cvssv3.1"], + value=str(cvss_score["score"]) + ) + vector = VulnerabilitySeverity( + system=scoring_systems["cvssv3.1_vector"], + value=str(cvss_score["vector"]) + ) + + severities.extend([score, vector]) + + advisories.append( + Advisory( + cve_id=cve_id, + summary="", + impacted_package_urls=[], + vuln_references=[ + Reference( + url=URL, + severities=severities + ) + ] + ) + ) + return advisories From 1363d96a3d2f50113ca4c7757c6f2d75d0841536 Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Tue, 16 Feb 2021 11:31:36 +0530 Subject: [PATCH 3/4] Add tests for suse severity score importer Signed-off-by: Shivam Sandbhor --- .../suse_scores/suse-cvss-scores.yaml | 14 ++ vulnerabilities/tests/test_suse_scores.py | 126 ++++++++++++++++++ 2 files changed, 140 insertions(+) create mode 100644 vulnerabilities/tests/test_data/suse_scores/suse-cvss-scores.yaml create mode 100644 vulnerabilities/tests/test_suse_scores.py diff --git a/vulnerabilities/tests/test_data/suse_scores/suse-cvss-scores.yaml b/vulnerabilities/tests/test_data/suse_scores/suse-cvss-scores.yaml new file mode 100644 index 000000000..647b0d9d5 --- /dev/null +++ b/vulnerabilities/tests/test_data/suse_scores/suse-cvss-scores.yaml @@ -0,0 +1,14 @@ +--- +CVE-2004-0230: + cvss: + - version: 2.0 + score: 4.3 + vector: AV:N/AC:M/Au:N/C:N/I:N/A:P + - version: 3.1 + score: 3.7 + vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L +CVE-2003-1605: + cvss: + - version: 3 + score: 8.6 + vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N diff --git a/vulnerabilities/tests/test_suse_scores.py b/vulnerabilities/tests/test_suse_scores.py new file mode 100644 index 000000000..d7b79c1e6 --- /dev/null +++ b/vulnerabilities/tests/test_suse_scores.py @@ -0,0 +1,126 @@ +# Copyright (c) nexB Inc. and others. All rights reserved. +# http://nexb.com and https://github.com/nexB/vulnerablecode/ +# The VulnerableCode software is licensed under the Apache License version 2.0. +# Data generated with VulnerableCode require an acknowledgment. +# +# You may not use this software except in compliance with the License. +# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +# +# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode +# derivative work, you must accompany this data with the following acknowledgment: +# +# Generated with VulnerableCode and provided on an 'AS IS' BASIS, WITHOUT WARRANTIES +# OR CONDITIONS OF ANY KIND, either express or implied. No content created from +# VulnerableCode should be considered or used as legal advice. Consult an Attorney +# for any legal advice. +# VulnerableCode is a free software from nexB Inc. and others. +# Visit https://github.com/nexB/vulnerablecode/ for support and download. + +import os +from unittest import TestCase + +from vulnerabilities.data_source import Advisory +from vulnerabilities.data_source import Reference +from vulnerabilities.data_source import VulnerabilitySeverity +from vulnerabilities.importers.suse_scores import SUSESeverityScoreDataSource +from vulnerabilities.helpers import load_yaml +from vulnerabilities.severity_systems import ScoringSystem + +BASE_DIR = os.path.dirname(os.path.abspath(__file__)) +TEST_DATA = os.path.join(BASE_DIR, "test_data/suse_scores", "suse-cvss-scores.yaml") + + +class TestSUSESeverityScoreDataSource(TestCase): + def test_to_advisory(self): + raw_data = load_yaml(TEST_DATA) + expected_data = [ + Advisory( + summary="", + impacted_package_urls=[], + resolved_package_urls=[], + vuln_references=[ + Reference( + reference_id="", + url="https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", + severities=[ + VulnerabilitySeverity( + system=ScoringSystem( + identifier="cvssv2", + name="CVSSv2 Base Score", + url="https://www.first.org/cvss/v2/", + notes="cvssv2 base score", + ), + value="4.3", + ), + VulnerabilitySeverity( + system=ScoringSystem( + identifier="cvssv2_vector", + name="CVSSv2 Vector", + url="https://www.first.org/cvss/v2/", + notes="cvssv2 vector, used to get additional info about nature and severity of vulnerability", # nopep8 + ), + value="AV:N/AC:M/Au:N/C:N/I:N/A:P", + ), + VulnerabilitySeverity( + system=ScoringSystem( + identifier="cvssv3.1", + name="CVSSv3.1 Base Score", + url="https://www.first.org/cvss/v3-1/", + notes="cvssv3.1 base score", + ), + value="3.7", + ), + VulnerabilitySeverity( + system=ScoringSystem( + identifier="cvssv3.1_vector", + name="CVSSv3.1 Vector", + url="https://www.first.org/cvss/v3-1/", + notes="cvssv3.1 vector, used to get additional info about nature and severity of vulnerability", # nopep8 + ), + value="CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", + ), + ], + ) + ], + cve_id="CVE-2004-0230", + ), + Advisory( + summary="", + impacted_package_urls=[], + resolved_package_urls=[], + vuln_references=[ + Reference( + reference_id="", + url="https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", + severities=[ + VulnerabilitySeverity( + system=ScoringSystem( + identifier="cvssv3", + name="CVSSv3 Base Score", + url="https://www.first.org/cvss/v3-0/", + notes="cvssv3 base score", + ), + value="8.6", + ), + VulnerabilitySeverity( + system=ScoringSystem( + identifier="cvssv3_vector", + name="CVSSv3 Vector", + url="https://www.first.org/cvss/v3-0/", + notes="cvssv3 vector, used to get additional info about nature and severity of vulnerability", # nopep8 + ), + value="CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", + ), + ], + ) + ], + cve_id="CVE-2003-1605", + ), + ] + + found_data = SUSESeverityScoreDataSource.to_advisory(raw_data) + assert expected_data == found_data From 58fb0678748b5e9a045a832a863a6546d335b0c0 Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Tue, 16 Feb 2021 11:42:04 +0530 Subject: [PATCH 4/4] Update SOURCES.rst and get rid of redundant f string in suse_scores.py Signed-off-by: Shivam Sandbhor --- SOURCES.rst | 2 ++ vulnerabilities/importers/suse_scores.py | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/SOURCES.rst b/SOURCES.rst index ab024f532..281f77182 100644 --- a/SOURCES.rst +++ b/SOURCES.rst @@ -45,3 +45,5 @@ +----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+ |elixir_security | https://github.com/dependabot/elixir-security-advisories |hex packages | +----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+ +|suse_scores | https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml |vulnerability severity scores by SUSE | ++----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+ diff --git a/vulnerabilities/importers/suse_scores.py b/vulnerabilities/importers/suse_scores.py index 0da973afc..c8c50eb9e 100644 --- a/vulnerabilities/importers/suse_scores.py +++ b/vulnerabilities/importers/suse_scores.py @@ -27,7 +27,7 @@ from vulnerabilities.helpers import fetch_yaml from vulnerabilities.severity_systems import scoring_systems -URL = f"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" +URL = "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" class SUSESeverityScoreDataSource(DataSource):