Merge branch 'main' into main

Author: TG1999

requirements.txt

@@ -11,7 +11,7 @@ beautifulsoup4==4.10.0
 binaryornot==0.4.4
 black==22.3.0
 boolean.py==3.8
-certifi==2023.7.22
+certifi==2024.7.4
 cffi==1.15.0
 chardet==4.0.0
 charset-normalizer==2.0.12
@@ -36,15 +36,15 @@ freezegun==1.2.1
 frozenlist==1.3.0
 gitdb==4.0.9
 GitPython==3.1.41
-gunicorn==20.1.0
+gunicorn==22.0.0
 idna==3.3
 imagesize==1.3.0
 importlib-metadata==4.11.3
 iniconfig==1.1.1
 ipython==8.10.0
 isort==5.10.1
 jedi==0.18.1
-Jinja2==3.1.3
+Jinja2==3.1.4
 jsonschema==3.2.0
 license-expression==21.6.14
 lxml==4.9.1
@@ -81,7 +81,7 @@ python-dateutil==2.8.2
 python-dotenv==0.20.0
 pytz==2022.1
 PyYAML==6.0.1
-requests==2.31.0
+requests==2.32.0
 restructuredtext-lint==1.4.0
 saneyaml==0.6.0
 semantic-version==2.9.0
@@ -98,7 +98,7 @@ sphinxcontrib-htmlhelp==2.0.0
 sphinxcontrib-jsmath==1.0.1
 sphinxcontrib-qthelp==1.0.3
 sphinxcontrib-serializinghtml==1.1.5
-sqlparse==0.4.4
+sqlparse==0.5.0
 stack-data==0.2.0
 stevedore==3.5.0
 texttable==1.6.4
@@ -111,7 +111,7 @@ urllib3==1.26.19
 wcwidth==0.2.5
 websocket-client==0.59.0
 yarl==1.7.2
-zipp==3.8.0
+zipp==3.19.1
 dateparser==1.1.1
 fetchcode==0.3.0
 cwe2==2.0.0

vulnerabilities/api.py

@@ -25,6 +25,7 @@
 from rest_framework.throttling import UserRateThrottle
 
 from vulnerabilities.models import Alias
+from vulnerabilities.models import Kev
 from vulnerabilities.models import Package
 from vulnerabilities.models import Vulnerability
 from vulnerabilities.models import VulnerabilityReference
@@ -167,6 +168,12 @@ def to_representation(self, instance):
         return representation
 
 
+class KEVSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Kev
+        fields = ["date_added", "description", "required_action", "due_date", "resources_and_notes"]
+
+
 class VulnerabilitySerializer(BaseResourceSerializer):
     fixed_packages = MinimalPackageSerializer(
         many=True, source="filtered_fixed_packages", read_only=True
@@ -175,6 +182,7 @@ class VulnerabilitySerializer(BaseResourceSerializer):
 
     references = VulnerabilityReferenceSerializer(many=True, source="vulnerabilityreference_set")
     aliases = AliasSerializer(many=True, source="alias")
+    kev = KEVSerializer(read_only=True)
     weaknesses = WeaknessSerializer(many=True)
 
     def to_representation(self, instance):
@@ -183,6 +191,10 @@ def to_representation(self, instance):
         weaknesses = data.get("weaknesses", [])
         data["weaknesses"] = [weakness for weakness in weaknesses if weakness is not None]
 
+        kev = data.get("kev", None)
+        if not kev:
+            data.pop("kev")
+
         return data
 
     class Meta:
@@ -196,6 +208,7 @@ class Meta:
             "affected_packages",
             "references",
             "weaknesses",
+            "kev",
         ]
 
 

vulnerabilities/improvers/__init__.py

@@ -8,6 +8,7 @@
 #
 
 from vulnerabilities.improvers import valid_versions
+from vulnerabilities.improvers import vulnerability_kev
 from vulnerabilities.improvers import vulnerability_status
 
 IMPROVERS_REGISTRY = [
@@ -27,6 +28,7 @@
     valid_versions.RubyImprover,
     valid_versions.GithubOSVImprover,
     vulnerability_status.VulnerabilityStatusImprover,
+    vulnerability_kev.VulnerabilityKevImprover,
 ]
 
 IMPROVERS_REGISTRY = {x.qualified_name: x for x in IMPROVERS_REGISTRY}

vulnerabilities/improvers/vulnerability_kev.py

@@ -0,0 +1,66 @@
+import logging
+from typing import Iterable
+
+from django.db.models import QuerySet
+from sphinx.util import requests
+
+from vulnerabilities.improver import Improver
+from vulnerabilities.improver import Inference
+from vulnerabilities.models import Advisory
+from vulnerabilities.models import Alias
+from vulnerabilities.models import Kev
+
+logger = logging.getLogger(__name__)
+
+
+class VulnerabilityKevImprover(Improver):
+    """
+    Known Exploited Vulnerabilities Improver
+    """
+
+    @property
+    def interesting_advisories(self) -> QuerySet:
+        # TODO Modify KEV improver to iterate over the vulnerabilities alias, not the advisory
+        return [Advisory.objects.first()]
+
+    def get_inferences(self, advisory_data) -> Iterable[Inference]:
+        """
+        Fetch Kev data, iterate over it to find the vulnerability with the specified alias, and create or update
+        the Kev instance accordingly.
+        """
+
+        kev_url = (
+            "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
+        )
+        response = requests.get(kev_url)
+        kev_data = response.json()
+        if response.status_code != 200:
+            logger.error(
+                f"Failed to fetch the CISA Catalog of Known Exploited Vulnerabilities: {kev_url}"
+            )
+            return []
+
+        for kev_vul in kev_data.get("vulnerabilities", []):
+            alias = Alias.objects.get_or_none(alias=kev_vul["cveID"])
+            if not alias:
+                continue
+
+            vul = alias.vulnerability
+
+            if not vul:
+                continue
+
+            Kev.objects.update_or_create(
+                vulnerability=vul,
+                defaults={
+                    "description": kev_vul["shortDescription"],
+                    "date_added": kev_vul["dateAdded"],
+                    "required_action": kev_vul["requiredAction"],
+                    "due_date": kev_vul["dueDate"],
+                    "resources_and_notes": kev_vul["notes"],
+                    "known_ransomware_campaign_use": True
+                    if kev_vul["knownRansomwareCampaignUse"] == "Known"
+                    else False,
+                },
+            )
+        return []

vulnerabilities/migrations/0057_kev.py

@@ -0,0 +1,72 @@
+# Generated by Django 4.1.13 on 2024-05-29 19:14
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("vulnerabilities", "0056_alter_packagechangelog_software_version_and_more"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="Kev",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
+                    ),
+                ),
+                (
+                    "date_added",
+                    models.DateField(
+                        blank=True,
+                        help_text="The date the vulnerability was added to the Known Exploited Vulnerabilities (KEV) catalog in the format YYYY-MM-DD.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "description",
+                    models.TextField(
+                        help_text="Description of the vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, usually a refinement of the original CVE description"
+                    ),
+                ),
+                (
+                    "required_action",
+                    models.TextField(
+                        help_text="The required action to address the vulnerability, typically to apply vendor updates or apply vendor mitigations or to discontinue use."
+                    ),
+                ),
+                (
+                    "due_date",
+                    models.DateField(
+                        help_text="The date the required action is due in the format YYYY-MM-DD,which applies to all USA federal civilian executive branch (FCEB) agencies,but all organizations are strongly encouraged to execute the required action."
+                    ),
+                ),
+                (
+                    "resources_and_notes",
+                    models.TextField(
+                        help_text="Additional notes and resources about the vulnerability, often a URL to vendor instructions."
+                    ),
+                ),
+                (
+                    "known_ransomware_campaign_use",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Known if this vulnerability is known to have been leveraged as part of a ransomware campaign; \n        or 'Unknown' if CISA lacks confirmation that the vulnerability has been utilized for ransomware.",
+                    ),
+                ),
+                (
+                    "vulnerability",
+                    models.OneToOneField(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="kev",
+                        to="vulnerabilities.vulnerability",
+                    ),
+                ),
+            ],
+        ),
+    ]

vulnerabilities/models.py

@@ -1121,7 +1121,6 @@ class Meta:
 
 
 class ChangeLog(models.Model):
-
     action_time = models.DateTimeField(
         # check if dates are actually UTC
         default=timezone.now,
@@ -1261,7 +1260,6 @@ def log_action(self, package, action_type, actor_name, source_url, related_vulne
 
 
 class PackageChangeLog(ChangeLog):
-
     AFFECTED_BY = 1
     FIXING = 2
 
@@ -1309,3 +1307,53 @@ def log_fixing(cls, package, importer, source_url, related_vulnerability):
             source_url=source_url,
             related_vulnerability=related_vulnerability,
         )
+
+
+class Kev(models.Model):
+    """
+    Known Exploited Vulnerabilities
+    """
+
+    vulnerability = models.OneToOneField(
+        Vulnerability,
+        on_delete=models.CASCADE,
+        related_name="kev",
+    )
+
+    date_added = models.DateField(
+        help_text="The date the vulnerability was added to the Known Exploited Vulnerabilities"
+        " (KEV) catalog in the format YYYY-MM-DD.",
+        null=True,
+        blank=True,
+    )
+
+    description = models.TextField(
+        help_text="Description of the vulnerability in the Known Exploited Vulnerabilities"
+        " (KEV) catalog, usually a refinement of the original CVE description"
+    )
+
+    required_action = models.TextField(
+        help_text="The required action to address the vulnerability, typically to "
+        "apply vendor updates or apply vendor mitigations or to discontinue use."
+    )
+
+    due_date = models.DateField(
+        help_text="The date the required action is due in the format YYYY-MM-DD,"
+        "which applies to all USA federal civilian executive branch (FCEB) agencies,"
+        "but all organizations are strongly encouraged to execute the required action."
+    )
+
+    resources_and_notes = models.TextField(
+        help_text="Additional notes and resources about the vulnerability,"
+        " often a URL to vendor instructions."
+    )
+
+    known_ransomware_campaign_use = models.BooleanField(
+        default=False,
+        help_text="""Known if this vulnerability is known to have been leveraged as part of a ransomware campaign; 
+        or 'Unknown' if CISA lacks confirmation that the vulnerability has been utilized for ransomware.""",
+    )
+
+    @property
+    def get_known_ransomware_campaign_use_type(self):
+        return "Known" if self.known_ransomware_campaign_use else "Unknown"