Skip to content

Commit 283415b

Browse files
wagoodmanwagoodman
authored
Add fix date processing to NVD transformer (#651)
* add fix date processing to NVD transformer Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
1 parent 2bbf851 commit 283415b

7 files changed

Lines changed: 620 additions & 15 deletions

File tree

‎pkg/process/v6/transformers/nvd/affected_range.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ type affectedCPERange struct {
1818
VersionStartExcluding string
1919
VersionEndIncluding string
2020
VersionEndExcluding string
21+
FixInfo *nvd.FixInfo
2122
}
2223

2324
func newAffectedRanges(rs ...affectedCPERange) affectedRangeSet {
@@ -32,6 +33,7 @@ func newAffectedRange(match nvd.CpeMatch) affectedCPERange {
3233
VersionStartExcluding: nonEmptyValue(match.VersionStartExcluding),
3334
VersionEndIncluding: nonEmptyValue(match.VersionEndIncluding),
3435
VersionEndExcluding: nonEmptyValue(match.VersionEndExcluding),
36+
FixInfo: match.Fix,
3537
}
3638
}
3739

‎pkg/process/v6/transformers/nvd/affected_range_test.go‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ import (
44
"testing"
55

66
"github.com/google/go-cmp/cmp"
7+
8+
"github.com/anchore/grype-db/pkg/provider/unmarshal/nvd"
79
)
810

911
func Test_AffectedCPERange_String(t *testing.T) {
@@ -124,3 +126,58 @@ func Test_AffectedCPERange_String(t *testing.T) {
124126
})
125127
}
126128
}
129+
130+
func Test_newAffectedRange(t *testing.T) {
131+
tests := []struct {
132+
name string
133+
match nvd.CpeMatch
134+
expected affectedCPERange
135+
}{
136+
{
137+
name: "basic range without fix info",
138+
match: nvd.CpeMatch{
139+
VersionStartIncluding: stringPtr("1.0"),
140+
VersionEndExcluding: stringPtr("2.0"),
141+
},
142+
expected: affectedCPERange{
143+
VersionStartIncluding: "1.0",
144+
VersionEndExcluding: "2.0",
145+
FixInfo: nil,
146+
},
147+
},
148+
{
149+
name: "range with fix info",
150+
match: nvd.CpeMatch{
151+
VersionStartIncluding: stringPtr("1.0"),
152+
VersionEndExcluding: stringPtr("2.0"),
153+
Fix: &nvd.FixInfo{
154+
Version: "2.0",
155+
Date: "2023-06-15",
156+
Kind: "advisory",
157+
},
158+
},
159+
expected: affectedCPERange{
160+
VersionStartIncluding: "1.0",
161+
VersionEndExcluding: "2.0",
162+
FixInfo: &nvd.FixInfo{
163+
Version: "2.0",
164+
Date: "2023-06-15",
165+
Kind: "advisory",
166+
},
167+
},
168+
},
169+
}
170+
171+
for _, tt := range tests {
172+
t.Run(tt.name, func(t *testing.T) {
173+
actual := newAffectedRange(tt.match)
174+
if diff := cmp.Diff(tt.expected, actual); diff != "" {
175+
t.Errorf("newAffectedRange() mismatch (-want +got):\n%s", diff)
176+
}
177+
})
178+
}
179+
}
180+
181+
func stringPtr(s string) *string {
182+
return &s
183+
}

‎pkg/process/v6/transformers/nvd/test-fixtures/fix-version.json‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
{
2+
"cve": {
3+
"id": "CVE-2018-5487",
4+
"sourceIdentifier": "security-alert@netapp.com",
5+
"published": "2018-05-24T14:29:00.390",
6+
"lastModified": "2018-07-05T13:52:30.627",
7+
"vulnStatus": "Analyzed",
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution."
12+
},
13+
{
14+
"lang": "es",
15+
"value": "NetApp OnCommand Unified Manager for Linux, de la versión 7.2 hasta la 7.3, se distribuye con el servicio Java Management Extension Remote Method Invocation (JMX RMI) enlazado a la red y es susceptible a la ejecución remota de código sin autenticación."
16+
}
17+
],
18+
"metrics": {
19+
"cvssMetricV40": [
20+
{
21+
"source": "security@zabbix.com",
22+
"type": "Secondary",
23+
"cvssData": {
24+
"version": "4.0",
25+
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
26+
"baseScore": 7.5,
27+
"baseSeverity": "HIGH",
28+
"attackVector": "NETWORK",
29+
"attackComplexity": "HIGH",
30+
"attackRequirements": "NONE",
31+
"privilegesRequired": "NONE",
32+
"userInteraction": "ACTIVE",
33+
"vulnConfidentialityImpact": "HIGH",
34+
"vulnIntegrityImpact": "HIGH",
35+
"vulnAvailabilityImpact": "HIGH",
36+
"subConfidentialityImpact": "NONE",
37+
"subIntegrityImpact": "NONE",
38+
"subAvailabilityImpact": "NONE",
39+
"exploitMaturity": "NOT_DEFINED",
40+
"confidentialityRequirement": "NOT_DEFINED",
41+
"integrityRequirement": "NOT_DEFINED",
42+
"availabilityRequirement": "NOT_DEFINED",
43+
"modifiedAttackVector": "NOT_DEFINED",
44+
"modifiedAttackComplexity": "NOT_DEFINED",
45+
"modifiedAttackRequirements": "NOT_DEFINED",
46+
"modifiedPrivilegesRequired": "NOT_DEFINED",
47+
"modifiedUserInteraction": "NOT_DEFINED",
48+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
49+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
50+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
51+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
52+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
53+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
54+
"Safety": "NOT_DEFINED",
55+
"Automatable": "NOT_DEFINED",
56+
"Recovery": "NOT_DEFINED",
57+
"valueDensity": "NOT_DEFINED",
58+
"vulnerabilityResponseEffort": "NOT_DEFINED",
59+
"providerUrgency": "NOT_DEFINED"
60+
}
61+
}
62+
],
63+
"cvssMetricV30": [
64+
{
65+
"source": "nvd@nist.gov",
66+
"type": "Primary",
67+
"cvssData": {
68+
"version": "3.0",
69+
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
70+
"attackVector": "NETWORK",
71+
"attackComplexity": "LOW",
72+
"privilegesRequired": "NONE",
73+
"userInteraction": "NONE",
74+
"scope": "UNCHANGED",
75+
"confidentialityImpact": "HIGH",
76+
"integrityImpact": "HIGH",
77+
"availabilityImpact": "HIGH",
78+
"baseScore": 9.8,
79+
"baseSeverity": "CRITICAL"
80+
},
81+
"exploitabilityScore": 3.9,
82+
"impactScore": 5.9
83+
}
84+
],
85+
"cvssMetricV2": [
86+
{
87+
"source": "nvd@nist.gov",
88+
"type": "Primary",
89+
"cvssData": {
90+
"version": "2.0",
91+
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
92+
"accessVector": "NETWORK",
93+
"accessComplexity": "LOW",
94+
"authentication": "NONE",
95+
"confidentialityImpact": "PARTIAL",
96+
"integrityImpact": "PARTIAL",
97+
"availabilityImpact": "PARTIAL",
98+
"baseScore": 7.5
99+
},
100+
"baseSeverity": "HIGH",
101+
"exploitabilityScore": 10.0,
102+
"impactScore": 6.4,
103+
"acInsufInfo": true,
104+
"obtainAllPrivilege": false,
105+
"obtainUserPrivilege": false,
106+
"obtainOtherPrivilege": false,
107+
"userInteractionRequired": false
108+
}
109+
]
110+
},
111+
"weaknesses": [
112+
{
113+
"source": "nvd@nist.gov",
114+
"type": "Primary",
115+
"description": [
116+
{
117+
"lang": "en",
118+
"value": "CWE-20"
119+
}
120+
]
121+
}
122+
],
123+
"configurations": [
124+
{
125+
"operator": "AND",
126+
"nodes": [
127+
{
128+
"operator": "OR",
129+
"negate": false,
130+
"cpeMatch": [
131+
{
132+
"vulnerable": true,
133+
"criteria": "cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:*",
134+
"versionStartIncluding": "7.2",
135+
"versionEndExcluding": "7.3",
136+
"matchCriteriaId": "A5949307-3E9B-441F-B008-81A0E0228DC0",
137+
"fix": {
138+
"version": "7.3",
139+
"date": "2018-05-23",
140+
"kind": "advisory"
141+
}
142+
}
143+
]
144+
},
145+
{
146+
"operator": "OR",
147+
"negate": false,
148+
"cpeMatch": [
149+
{
150+
"vulnerable": false,
151+
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
152+
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
153+
}
154+
]
155+
}
156+
]
157+
}
158+
],
159+
"references": [
160+
{
161+
"url": "https://security.netapp.com/advisory/ntap-20180523-0001/",
162+
"source": "security-alert@netapp.com",
163+
"tags": [
164+
"Patch",
165+
"Vendor Advisory"
166+
]
167+
}
168+
]
169+
}
170+
}

0 commit comments

Comments
 (0)