Import EPSS data from Anchore Grype scans

[bwt-sloanj]

Description

Grype added EPSS metrics in v0.92.0, see:
https://github.com/anchore/grype/releases/tag/v0.92.0

Adds EPSS support with a test based on the same busybox image used in anchore_grype/no_vuln.json.

Also removes the hardcoded CWE value as Grype does not support CWE data.

Test results

Adds unittests.tools.test_anchore_grype_parser.TestAnchoreGrypeParser.test_grype_epss_values.

Modifies unittests.tools.test_anchore_grype_parser.TestAnchoreGrypeParser.test_check_all_fields to reflect CWE change.

Fixes typo in unittests.tools.test_anchore_grype_parser.TestAnchoreGrypeParser.test_grype_parser_with_one_critical_vuln_has_one_findings.

Documentation

Updates documentation with information on scanning SBOMs and newer style of getting Grype JSON output written to file.

Checklist

This checklist is for your information.

• Make sure to rebase your PR against the very latest dev.
• Features/Changes should be submitted against the dev.
• Bugfixes should be submitted against the bugfix branch.
• Give a meaningful name to your PR, as it may end up being used in the release notes.
• Your code is ruff compliant.
• Your code is python 3.11 compliant.
• If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
• Model changes must include the necessary migrations in the dojo/db_migrations folder.
• Add applicable tests to the unit tests.
• Add the proper label to categorize your PR.

[dryrunsecurity]

This pull request contains a minor input validation weakness in the get_epss_values method of the Anchore Grype parser, where comprehensive input validation for EPSS scores is not fully implemented, though the current implementation is considered non-blocking and passes the risk threshold.

Input Validation Weakness in dojo/tools/anchore_grype/parser.py

Vulnerability	Input Validation Weakness
Description	The get_epss_values method lacks comprehensive input validation when parsing EPSS scores from external JSON data. While the method uses a try-except block to handle type conversion, it does not perform explicit validation of the EPSS score and percentile values' format, range, or content. This could potentially allow malformed input to be processed without sufficient checks.

django-DefectDojo/dojo/tools/anchore_grype/parser.py

Lines 210 to 229 in 27779e4

	return vector
	return None
	def get_epss_values(self, vuln_id, epss_list):
	if isinstance(epss_list, list):
	for epss_data in epss_list:
	if epss_data.get("cve") != vuln_id:
	continue
	try:
	epss_score = float(epss_data.get("epss"))
	epss_percentile = float(epss_data.get("percentile"))
	except (TypeError, ValueError):
	pass
	else:
	return epss_score, epss_percentile
	return None, None
	def get_vulnerability_ids(self, vuln_id, related_vulnerabilities):
	vulnerability_ids = []
	if vuln_id:

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved