Skip to content

Commit fe96377

Browse files
ziadhanyziadhany
committed
Migrate Suse Score importer v2
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent a8aa6da commit fe96377

File tree

5 files changed

+197
-0
lines changed

5 files changed

+197
-0
lines changed

‎vulnerabilities/importers/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@
6262
from vulnerabilities.pipelines.v2_importers import pysec_importer as pysec_importer_v2
6363
from vulnerabilities.pipelines.v2_importers import redhat_importer as redhat_importer_v2
6464
from vulnerabilities.pipelines.v2_importers import ruby_importer as ruby_importer_v2
65+
from vulnerabilities.pipelines.v2_importers import suse_score_importer as suse_score_importer_v2
6566
from vulnerabilities.pipelines.v2_importers import vulnrichment_importer as vulnrichment_importer_v2
6667
from vulnerabilities.pipelines.v2_importers import xen_importer as xen_importer_v2
6768
from vulnerabilities.utils import create_registry
@@ -89,6 +90,7 @@
8990
ruby_importer_v2.RubyImporterPipeline,
9091
epss_importer_v2.EPSSImporterPipeline,
9192
mattermost_importer_v2.MattermostImporterPipeline,
93+
suse_score_importer_v2.SUSESeverityScoreImporterPipeline,
9294
nvd_importer.NVDImporterPipeline,
9395
github_importer.GitHubAPIImporterPipeline,
9496
gitlab_importer.GitLabImporterPipeline,

‎vulnerabilities/pipelines/v2_importers/suse_score_importer.py‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from typing import Iterable
11+
12+
from vulnerabilities import severity_systems
13+
from vulnerabilities.importer import AdvisoryData
14+
from vulnerabilities.importer import VulnerabilitySeverity
15+
from vulnerabilities.management.commands.commit_export import logger
16+
from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
17+
from vulnerabilities.utils import fetch_yaml
18+
from vulnerabilities.utils import is_cve
19+
20+
21+
class SUSESeverityScoreImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
22+
spdx_license_expression = "CC-BY-4.0"
23+
license_url = "https://ftp.suse.com/pub/projects/security/yaml/LICENSE"
24+
pipeline_id = "suse_importer_v2"
25+
url = "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
26+
27+
@classmethod
28+
def steps(cls):
29+
return (
30+
cls.fetch_advisories,
31+
cls.collect_and_store_advisories,
32+
)
33+
34+
def fetch_advisories(self):
35+
self.score_data = fetch_yaml(self.url)
36+
37+
def advisories_count(self):
38+
return sum(1 for _ in self.score_data)
39+
40+
def collect_advisories(self) -> Iterable[AdvisoryData]:
41+
systems_by_version = {
42+
"2.0": severity_systems.CVSSV2,
43+
"3": severity_systems.CVSSV3,
44+
"3.1": severity_systems.CVSSV31,
45+
"4": severity_systems.CVSSV4,
46+
}
47+
48+
for cve_id in self.score_data or []:
49+
severities = []
50+
for cvss_score in self.score_data[cve_id].get("cvss") or []:
51+
cvss_version = cvss_score.get("version") or ""
52+
scoring_system = systems_by_version.get(cvss_version)
53+
if not scoring_system:
54+
logger.error(f"Unsupported CVSS version: {cvss_version}")
55+
continue
56+
base_score = str(cvss_score.get("score") or "")
57+
vector = str(cvss_score.get("vector") or "")
58+
score = VulnerabilitySeverity(
59+
system=scoring_system,
60+
value=base_score,
61+
scoring_elements=vector,
62+
)
63+
severities.append(score)
64+
65+
if not is_cve(cve_id):
66+
continue
67+
68+
yield AdvisoryData(
69+
advisory_id=cve_id,
70+
aliases=[],
71+
summary="",
72+
severities=severities,
73+
url=self.url,
74+
)

‎vulnerabilities/tests/pipelines/v2_importers/test_suse_score_importer_v2.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from pathlib import Path
11+
12+
import saneyaml
13+
14+
from vulnerabilities.pipelines.v2_importers.suse_score_importer import (
15+
SUSESeverityScoreImporterPipeline,
16+
)
17+
from vulnerabilities.tests import util_tests
18+
19+
TEST_DATA = Path(__file__).parent.parent.parent / "test_data" / "suse_scores_v2"
20+
21+
TEST_YAML_DB = TEST_DATA / "suse-cvss-scores.yaml"
22+
23+
24+
def test_suse_score_advisories():
25+
pipeline = SUSESeverityScoreImporterPipeline()
26+
27+
with open(TEST_YAML_DB) as f:
28+
pipeline.score_data = saneyaml.load(f)
29+
30+
result = [adv.to_dict() for adv in pipeline.collect_advisories()]
31+
32+
expected_file = TEST_DATA / "suse-cvss-scores-expected.json"
33+
util_tests.check_results_against_json(result, expected_file)

‎vulnerabilities/tests/test_data/suse_scores_v2/suse-cvss-scores-expected.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
[
2+
{
3+
"advisory_id": "CVE-2004-0230",
4+
"aliases": [],
5+
"summary": "",
6+
"affected_packages": [],
7+
"references_v2": [],
8+
"patches": [],
9+
"severities": [
10+
{
11+
"system": "cvssv2",
12+
"value": "4.3",
13+
"scoring_elements": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
14+
},
15+
{
16+
"system": "cvssv3.1",
17+
"value": "3.7",
18+
"scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
19+
}
20+
],
21+
"date_published": null,
22+
"weaknesses": [],
23+
"url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
24+
},
25+
{
26+
"advisory_id": "CVE-2003-1605",
27+
"aliases": [],
28+
"summary": "",
29+
"affected_packages": [],
30+
"references_v2": [],
31+
"patches": [],
32+
"severities": [
33+
{
34+
"system": "cvssv3",
35+
"value": "8.6",
36+
"scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
37+
}
38+
],
39+
"date_published": null,
40+
"weaknesses": [],
41+
"url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
42+
},
43+
{
44+
"advisory_id": "CVE-2010-20103",
45+
"aliases": [],
46+
"summary": "",
47+
"affected_packages": [],
48+
"references_v2": [],
49+
"patches": [],
50+
"severities": [
51+
{
52+
"system": "cvssv3.1",
53+
"value": "9.8",
54+
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
55+
},
56+
{
57+
"system": "cvssv4",
58+
"value": "9.3",
59+
"scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
60+
}
61+
],
62+
"date_published": null,
63+
"weaknesses": [],
64+
"url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
65+
}
66+
]

‎vulnerabilities/tests/test_data/suse_scores_v2/suse-cvss-scores.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
CVE-2004-0230:
3+
cvss:
4+
- version: 2.0
5+
score: 4.3
6+
vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
7+
- version: 3.1
8+
score: 3.7
9+
vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
10+
CVE-2003-1605:
11+
cvss:
12+
- version: 3
13+
score: 8.6
14+
vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
15+
CVE-2010-20103:
16+
cvss:
17+
- version: 3.1
18+
score: 9.8
19+
vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
20+
- version: 4
21+
score: 9.3
22+
vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

0 commit comments

Comments
 (0)