Merge branch 'main' into dependabot/pip/certifi-2022.12.7

Author: TG1999

CHANGELOG.rst

@@ -2,12 +2,24 @@ Release notes
 =============
 
 
-Next release
-----------------
+Version v32.0.0rc2
+--------------------
+
+- We added migration for adding apache tomcat option in severity scoring.
+
+
+Version v32.0.0rc1
+--------------------
 
 - We re-enabled support for the mozilla vulnerabilities advisories importer.
 - We re-enabled support for the gentoo vulnerabilities advisories importer.
 - We re-enabled support for the istio vulnerabilities advisories importer.
+- We re-enabled support for the kbmsr2019 vulnerabilities advisories importer.
+- We re-enabled support for the suse score advisories importer.
+- We re-enabled support for the elixir security advisories importer.
+- We re-enabled support for the apache tomcat security advisories importer.
+- We added support for CWE.
+- We added migrations to remove corrupted advisories https://github.com/nexB/vulnerablecode/issues/1086.
 
 
 Version v31.1.1

requirements.txt

@@ -115,7 +115,7 @@ yarl==1.7.2
 zipp==3.8.0
 dateparser==1.1.1
 fetchcode==0.2.0
-
+cwe2==2.0.0
 drf-spectacular-sidecar==2022.10.1
 drf-spectacular==0.24.2
 coreapi==2.3.3

setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = vulnerablecode
-version = 31.1.1
+version = 32.0.0rc2
 license = Apache-2.0 AND CC-BY-SA-4.0
 
 # description must be on ONE line https://github.com/pypa/setuptools/issues/1390
@@ -84,6 +84,7 @@ install_requires =
     Markdown>=3.3.0
     dateparser>=1.1.1
     cvss>=2.4
+    cwe2>=2.0.0
 
     # networking
     GitPython>=3.1.17

vulnerabilities/import_runner.py

@@ -61,6 +61,7 @@ def process_advisories(advisory_datas: Iterable[AdvisoryData], importer_name: st
             affected_packages=[pkg.to_dict() for pkg in data.affected_packages],
             references=[ref.to_dict() for ref in data.references],
             date_published=data.date_published,
+            weaknesses=data.weaknesses,
             defaults={
                 "created_by": importer_name,
                 "date_collected": datetime.datetime.now(tz=datetime.timezone.utc),

vulnerabilities/importer.py

@@ -246,6 +246,7 @@ class AdvisoryData:
     affected_packages: List[AffectedPackage] = dataclasses.field(default_factory=list)
     references: List[Reference] = dataclasses.field(default_factory=list)
     date_published: Optional[datetime.datetime] = None
+    weaknesses: List[int] = dataclasses.field(default_factory=list)
 
     def __post_init__(self):
         if self.date_published and not self.date_published.tzinfo:
@@ -258,6 +259,7 @@ def to_dict(self):
             "affected_packages": [pkg.to_dict() for pkg in self.affected_packages],
             "references": [ref.to_dict() for ref in self.references],
             "date_published": self.date_published.isoformat() if self.date_published else None,
+            "weaknesses": self.weaknesses,
         }
 
     @classmethod
@@ -273,6 +275,7 @@ def from_dict(cls, advisory_data):
             "date_published": datetime.datetime.fromisoformat(date_published)
             if date_published
             else None,
+            "weaknesses": advisory_data["weaknesses"],
         }
         return cls(**transformed)
 

vulnerabilities/importers/__init__.py

@@ -9,9 +9,11 @@
 
 from vulnerabilities.importers import alpine_linux
 from vulnerabilities.importers import apache_httpd
+from vulnerabilities.importers import apache_tomcat
 from vulnerabilities.importers import archlinux
 from vulnerabilities.importers import debian
 from vulnerabilities.importers import debian_oval
+from vulnerabilities.importers import elixir_security
 from vulnerabilities.importers import gentoo
 from vulnerabilities.importers import github
 from vulnerabilities.importers import gitlab
@@ -22,11 +24,15 @@
 from vulnerabilities.importers import nvd
 from vulnerabilities.importers import openssl
 from vulnerabilities.importers import postgresql
+from vulnerabilities.importers import project_kb_msr2019
 from vulnerabilities.importers import pypa
 from vulnerabilities.importers import pysec
 from vulnerabilities.importers import redhat
 from vulnerabilities.importers import retiredotnet
+from vulnerabilities.importers import suse_scores
 from vulnerabilities.importers import ubuntu
+from vulnerabilities.importers import ubuntu_usn
+from vulnerabilities.importers import xen
 
 IMPORTERS_REGISTRY = [
     nginx.NginxImporter,
@@ -49,6 +55,12 @@
     mozilla.MozillaImporter,
     gentoo.GentooImporter,
     istio.IstioImporter,
+    project_kb_msr2019.ProjectKBMSRImporter,
+    suse_scores.SUSESeverityScoreImporter,
+    elixir_security.ElixirSecurityImporter,
+    apache_tomcat.ApacheTomcatImporter,
+    xen.XenImporter,
+    ubuntu_usn.UbuntuUSNImporter,
 ]
 
 IMPORTERS_REGISTRY = {x.qualified_name: x for x in IMPORTERS_REGISTRY}