Skip to content

Commit 053c8fb

Browse files
ziadhanyziadhany
authored
Merge pull request #2101 from ziadhany/suse-migrate
Migrate Suse Scores importer to advisory V2
2 parents 09f6fc4 + 620de51 commit 053c8fb

File tree

5 files changed

+193
-0
lines changed

5 files changed

+193
-0
lines changed

‎vulnerabilities/importers/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@
7777
from vulnerabilities.pipelines.v2_importers import redhat_importer as redhat_importer_v2
7878
from vulnerabilities.pipelines.v2_importers import retiredotnet_importer as retiredotnet_importer_v2
7979
from vulnerabilities.pipelines.v2_importers import ruby_importer as ruby_importer_v2
80+
from vulnerabilities.pipelines.v2_importers import suse_score_importer as suse_score_importer_v2
8081
from vulnerabilities.pipelines.v2_importers import ubuntu_osv_importer as ubuntu_osv_importer_v2
8182
from vulnerabilities.pipelines.v2_importers import vulnrichment_importer as vulnrichment_importer_v2
8283
from vulnerabilities.pipelines.v2_importers import xen_importer as xen_importer_v2
@@ -111,6 +112,7 @@
111112
debian_importer_v2.DebianImporterPipeline,
112113
mattermost_importer_v2.MattermostImporterPipeline,
113114
apache_tomcat_v2.ApacheTomcatImporterPipeline,
115+
suse_score_importer_v2.SUSESeverityScoreImporterPipeline,
114116
retiredotnet_importer_v2.RetireDotnetImporterPipeline,
115117
ubuntu_osv_importer_v2.UbuntuOSVImporterPipeline,
116118
alpine_linux_importer_v2.AlpineLinuxImporterPipeline,

‎vulnerabilities/pipelines/v2_importers/suse_score_importer.py‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from typing import Iterable
11+
12+
from vulnerabilities import severity_systems
13+
from vulnerabilities.importer import AdvisoryDataV2
14+
from vulnerabilities.importer import VulnerabilitySeverity
15+
from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
16+
from vulnerabilities.utils import fetch_yaml
17+
18+
19+
class SUSESeverityScoreImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
20+
spdx_license_expression = "CC-BY-4.0"
21+
license_url = "https://ftp.suse.com/pub/projects/security/yaml/LICENSE"
22+
pipeline_id = "suse_importer_v2"
23+
url = "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
24+
25+
@classmethod
26+
def steps(cls):
27+
return (
28+
cls.fetch_advisories,
29+
cls.collect_and_store_advisories,
30+
)
31+
32+
def fetch_advisories(self):
33+
self.score_data = fetch_yaml(self.url)
34+
35+
def advisories_count(self):
36+
return sum(1 for _ in self.score_data)
37+
38+
def collect_advisories(self) -> Iterable[AdvisoryDataV2]:
39+
systems_by_version = {
40+
"2.0": severity_systems.CVSSV2,
41+
"3": severity_systems.CVSSV3,
42+
"3.1": severity_systems.CVSSV31,
43+
"4": severity_systems.CVSSV4,
44+
}
45+
46+
for cve_id in self.score_data or []:
47+
severities = []
48+
for cvss_score in self.score_data[cve_id].get("cvss") or []:
49+
cvss_version = cvss_score.get("version") or ""
50+
scoring_system = systems_by_version.get(cvss_version)
51+
if not scoring_system:
52+
self.log(f"Unsupported CVSS version: {cvss_version}")
53+
continue
54+
base_score = cvss_score.get("score")
55+
vector = cvss_score.get("vector")
56+
if base_score and vector:
57+
score = VulnerabilitySeverity(
58+
system=scoring_system,
59+
value=base_score,
60+
scoring_elements=vector,
61+
)
62+
severities.append(score)
63+
64+
yield AdvisoryDataV2(
65+
advisory_id=cve_id,
66+
aliases=[],
67+
severities=severities,
68+
references=[],
69+
url=self.url,
70+
)

‎vulnerabilities/tests/pipelines/v2_importers/test_suse_score_importer_v2.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from pathlib import Path
11+
12+
import saneyaml
13+
14+
from vulnerabilities.pipelines.v2_importers.suse_score_importer import (
15+
SUSESeverityScoreImporterPipeline,
16+
)
17+
from vulnerabilities.tests import util_tests
18+
19+
TEST_DATA = Path(__file__).parent.parent.parent / "test_data" / "suse_scores_v2"
20+
21+
TEST_YAML_DB = TEST_DATA / "suse-cvss-scores.yaml"
22+
23+
24+
def test_suse_score_advisories():
25+
pipeline = SUSESeverityScoreImporterPipeline()
26+
27+
with open(TEST_YAML_DB) as f:
28+
pipeline.score_data = saneyaml.load(f)
29+
30+
result = [adv.to_dict() for adv in pipeline.collect_advisories()]
31+
32+
expected_file = TEST_DATA / "suse-cvss-scores-expected.json"
33+
util_tests.check_results_against_json(result, expected_file)

‎vulnerabilities/tests/test_data/suse_scores_v2/suse-cvss-scores-expected.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
[
2+
{
3+
"advisory_id": "CVE-2004-0230",
4+
"aliases": [],
5+
"summary": "",
6+
"affected_packages": [],
7+
"references": [],
8+
"patches": [],
9+
"severities": [
10+
{
11+
"system": "cvssv2",
12+
"value": "4.3",
13+
"scoring_elements": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
14+
},
15+
{
16+
"system": "cvssv3.1",
17+
"value": "3.7",
18+
"scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
19+
}
20+
],
21+
"date_published": null,
22+
"weaknesses": [],
23+
"url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
24+
},
25+
{
26+
"advisory_id": "CVE-2003-1605",
27+
"aliases": [],
28+
"summary": "",
29+
"affected_packages": [],
30+
"references": [],
31+
"patches": [],
32+
"severities": [
33+
{
34+
"system": "cvssv3",
35+
"value": "8.6",
36+
"scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
37+
}
38+
],
39+
"date_published": null,
40+
"weaknesses": [],
41+
"url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
42+
},
43+
{
44+
"advisory_id": "CVE-2010-20103",
45+
"aliases": [],
46+
"summary": "",
47+
"affected_packages": [],
48+
"references": [],
49+
"patches": [],
50+
"severities": [
51+
{
52+
"system": "cvssv3.1",
53+
"value": "9.8",
54+
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
55+
},
56+
{
57+
"system": "cvssv4",
58+
"value": "9.3",
59+
"scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
60+
}
61+
],
62+
"date_published": null,
63+
"weaknesses": [],
64+
"url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
65+
}
66+
]

‎vulnerabilities/tests/test_data/suse_scores_v2/suse-cvss-scores.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
CVE-2004-0230:
3+
cvss:
4+
- version: 2.0
5+
score: 4.3
6+
vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
7+
- version: 3.1
8+
score: 3.7
9+
vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
10+
CVE-2003-1605:
11+
cvss:
12+
- version: 3
13+
score: 8.6
14+
vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
15+
CVE-2010-20103:
16+
cvss:
17+
- version: 3.1
18+
score: 9.8
19+
vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
20+
- version: 4
21+
score: 9.3
22+
vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

0 commit comments

Comments
 (0)