Skip to content

Commit 8ba56bb

Browse files
TG1999TG1999
authored
Merge pull request #1050 from TG1999/suse_scores
Migrate suse scoring importer #1052
2 parents b5934a0 + 8d1f961 commit 8ba56bb

File tree

6 files changed

+85
-76
lines changed

6 files changed

+85
-76
lines changed

‎CHANGELOG.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ Next release
99
- We re-enabled support for the gentoo vulnerabilities advisories importer.
1010
- We re-enabled support for the istio vulnerabilities advisories importer.
1111
- We re-enabled support for the kbmsr2019 vulnerabilities advisories importer.
12+
- We re-enabled support for the suse score advisories importer.
1213

1314

1415
Version v31.1.1

‎vulnerabilities/importers/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
from vulnerabilities.importers import pysec
2828
from vulnerabilities.importers import redhat
2929
from vulnerabilities.importers import retiredotnet
30+
from vulnerabilities.importers import suse_scores
3031
from vulnerabilities.importers import ubuntu
3132

3233
IMPORTERS_REGISTRY = [
@@ -51,6 +52,7 @@
5152
gentoo.GentooImporter,
5253
istio.IstioImporter,
5354
project_kb_msr2019.ProjectKBMSRImporter,
55+
suse_scores.SUSESeverityScoreImporter,
5456
]
5557

5658
IMPORTERS_REGISTRY = {x.qualified_name: x for x in IMPORTERS_REGISTRY}

‎vulnerabilities/importers/suse_scores.py‎

Lines changed: 25 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,51 +7,56 @@
77
# See https://aboutcode.org for more information about nexB OSS projects.
88
#
99

10+
from typing import Iterable
11+
1012
from vulnerabilities import severity_systems
1113
from vulnerabilities.importer import AdvisoryData
1214
from vulnerabilities.importer import Importer
1315
from vulnerabilities.importer import Reference
1416
from vulnerabilities.importer import VulnerabilitySeverity
1517
from vulnerabilities.utils import fetch_yaml
18+
from vulnerabilities.utils import is_cve
1619

1720
URL = "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
1821

1922

2023
class SUSESeverityScoreImporter(Importer):
21-
def updated_advisories(self):
22-
advisories = []
24+
25+
spdx_license_expression = "CC-BY-4.0"
26+
license_url = "https://ftp.suse.com/pub/projects/security/yaml/LICENSE"
27+
28+
def advisory_data(self) -> Iterable[AdvisoryData]:
2329
score_data = fetch_yaml(URL)
24-
advisories.append(self.to_advisory(score_data))
25-
return advisories
30+
yield from self.to_advisory(score_data)
2631

27-
@staticmethod
28-
def to_advisory(score_data):
32+
def to_advisory(self, score_data):
2933
systems_by_version = {
3034
"2.0": severity_systems.CVSSV2,
3135
"3": severity_systems.CVSSV3,
3236
"3.1": severity_systems.CVSSV31,
3337
}
34-
advisories = []
3538

36-
for cve_id in score_data:
39+
for cve_id in score_data or []:
3740
severities = []
38-
for cvss_score in score_data[cve_id]["cvss"]:
39-
cvss_version = cvss_score["version"]
40-
scoring_system = systems_by_version[cvss_version]
41-
base_score = str(cvss_score["score"])
42-
vector = str(cvss_score.get("vector", ""))
41+
for cvss_score in score_data[cve_id].get("cvss") or []:
42+
cvss_version = cvss_score.get("version") or ""
43+
scoring_system = systems_by_version.get(cvss_version)
44+
if not scoring_system:
45+
continue
46+
base_score = str(cvss_score.get("score") or "")
47+
vector = str(cvss_score.get("vector") or "")
4348
score = VulnerabilitySeverity(
4449
system=scoring_system,
4550
value=base_score,
4651
scoring_elements=vector,
4752
)
4853
severities.append(score)
4954

50-
advisories.append(
51-
AdvisoryData(
52-
vulnerability_id=cve_id,
53-
summary="",
54-
references=[Reference(url=URL, severities=severities)],
55-
)
55+
if not is_cve(cve_id):
56+
continue
57+
58+
yield AdvisoryData(
59+
aliases=[cve_id],
60+
summary="",
61+
references=[Reference(url=URL, severities=severities)],
5662
)
57-
return advisories

‎vulnerabilities/tests/conftest.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@ def no_rmtree(monkeypatch):
3636
"test_safety_db.py",
3737
"test_suse_backports.py",
3838
"test_suse.py",
39-
"test_suse_scores.py",
4039
"test_ubuntu_usn.py",
4140
"test_upstream.py",
4241
]

‎vulnerabilities/tests/test_data/suse_scores/suse-cvss-scores-expected.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
[
2+
{
3+
"aliases": [
4+
"CVE-2004-0230"
5+
],
6+
"summary": "",
7+
"affected_packages": [],
8+
"references": [
9+
{
10+
"reference_id": "",
11+
"url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml",
12+
"severities": [
13+
{
14+
"system": "cvssv2",
15+
"value": "4.3",
16+
"scoring_elements": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
17+
},
18+
{
19+
"system": "cvssv3.1",
20+
"value": "3.7",
21+
"scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
22+
}
23+
]
24+
}
25+
],
26+
"date_published": null
27+
},
28+
{
29+
"aliases": [
30+
"CVE-2003-1605"
31+
],
32+
"summary": "",
33+
"affected_packages": [],
34+
"references": [
35+
{
36+
"reference_id": "",
37+
"url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml",
38+
"severities": [
39+
{
40+
"system": "cvssv3",
41+
"value": "8.6",
42+
"scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
43+
}
44+
]
45+
}
46+
],
47+
"date_published": null
48+
}
49+
]

‎vulnerabilities/tests/test_suse_scores.py‎

Lines changed: 8 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -8,65 +8,18 @@
88
#
99

1010
import os
11-
from unittest import TestCase
1211

13-
from vulnerabilities import severity_systems
14-
from vulnerabilities.importer import AdvisoryData
15-
from vulnerabilities.importer import Reference
16-
from vulnerabilities.importer import VulnerabilitySeverity
1712
from vulnerabilities.importers.suse_scores import SUSESeverityScoreImporter
13+
from vulnerabilities.tests import util_tests
1814
from vulnerabilities.utils import load_yaml
1915

2016
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
21-
TEST_DATA = os.path.join(BASE_DIR, "test_data/suse_scores", "suse-cvss-scores.yaml")
17+
TEST_DIR = os.path.join(BASE_DIR, "test_data/suse_scores")
2218

2319

24-
class TestSUSESeverityScoreImporter(TestCase):
25-
def test_to_advisory(self):
26-
raw_data = load_yaml(TEST_DATA)
27-
expected_data = [
28-
AdvisoryData(
29-
summary="",
30-
references=[
31-
Reference(
32-
reference_id="",
33-
url="https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml",
34-
severities=[
35-
VulnerabilitySeverity(
36-
system=severity_systems.CVSSV2,
37-
value="4.3",
38-
scoring_elements="AV:N/AC:M/Au:N/C:N/I:N/A:P",
39-
),
40-
VulnerabilitySeverity(
41-
system=severity_systems.CVSSV31,
42-
value="3.7",
43-
scoring_elements="CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
44-
),
45-
],
46-
)
47-
],
48-
vulnerability_id="CVE-2004-0230",
49-
),
50-
AdvisoryData(
51-
summary="",
52-
references=[
53-
Reference(
54-
reference_id="",
55-
url="https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml",
56-
severities=[
57-
VulnerabilitySeverity(
58-
system=severity_systems.CVSSV3,
59-
value="8.6",
60-
scoring_elements="CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
61-
),
62-
],
63-
)
64-
],
65-
vulnerability_id="CVE-2003-1605",
66-
),
67-
]
68-
69-
found_data = SUSESeverityScoreImporter.to_advisory(raw_data)
70-
found_advisories = list(map(AdvisoryData.normalized, found_data))
71-
expected_advisories = list(map(AdvisoryData.normalized, expected_data))
72-
assert sorted(found_advisories) == sorted(expected_advisories)
20+
def test_suse_score_import():
21+
raw_data = load_yaml(os.path.join(TEST_DIR, "suse-cvss-scores.yaml"))
22+
expected_file = os.path.join(TEST_DIR, "suse-cvss-scores-expected.json")
23+
advisories = list(SUSESeverityScoreImporter().to_advisory(raw_data))
24+
expected_advisories = [adv.to_dict() for adv in advisories]
25+
util_tests.check_results_against_json(expected_advisories, expected_file)

0 commit comments

Comments
 (0)