Stage/vuls
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use CVSS seveirty of distro advisory when no entiry in NVD and OVAL

Browse Source
This commit is contained in:
kota kanbe
2017-07-30 15:21:26 +09:00
parent 8b6a283114
commit 27724a2faf
9 changed files with 740 additions and 692 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
report/report.go
View File

@@ -158,10 +158,13 @@ func fillWithOval(r *models.ScanResult) (err error) {
ovalClient = oval.NewCentOS()
//use RedHat's OVAL
ovalFamily = c.RedHat
//TODO implement OracleLinux
//TODO
// case c.Oracle:
// ovalClient = oval.New()
// ovalFamily = c.Oracle
// case c.Suse:
// ovalClient = oval.New()
// ovalFamily = c.Oracle
case c.Amazon, c.Oracle, c.Raspbian, c.FreeBSD:
return nil
default:

6
report/slack.go
View File

@@ -216,7 +216,7 @@ func toSlackAttachments(r models.ScanResult) (attaches []*attachment) {
Short: true,
},
},
Color: color(vinfo.CveContents.MaxCvssScore().Value.Score),
Color: color(vinfo.MaxCvssScore().Value.Score),
}
attaches = append(attaches, &a)
}
@@ -238,9 +238,9 @@ func color(cvssScore float64) string {
}
func attachmentText(vinfo models.VulnInfo, osFamily string) string {
maxCvss := vinfo.CveContents.MaxCvssScore()
maxCvss := vinfo.MaxCvssScore()
vectors := []string{}
for _, cvss := range vinfo.CveContents.Cvss2Scores() {
for _, cvss := range vinfo.Cvss2Scores() {
calcURL := ""
switch cvss.Value.Type {
case models.CVSS2:

6
report/tui.go
View File

@@ -641,7 +641,7 @@ func summaryLines() string {
summary := vinfo.CveContents.Summaries(
config.Conf.Lang, currentScanResult.Family)[0].Value
cvssScore := fmt.Sprintf("| %4.1f",
vinfo.CveContents.MaxCvssScore().Value.Score)
vinfo.MaxCvssScore().Value.Score)
var cols []string
cols = []string{
@@ -794,7 +794,7 @@ func detailLines() (string, error) {
data := dataForTmpl{
CveID: vinfo.CveID,
Cvsses: append(vinfo.CveContents.Cvss3Scores(), vinfo.CveContents.Cvss2Scores()...),
Cvsses: append(vinfo.Cvss3Scores(), vinfo.Cvss2Scores()...),
Summary: fmt.Sprintf("%s (%s)", summary.Value, summary.Type),
Confidence: vinfo.Confidence,
Cwes: vinfo.CveContents.CweIDs(r.Family),
@@ -818,7 +818,7 @@ const mdTemplate = `
CVSS Scores
--------------
{{range .Cvsses -}}
* {{.Value.Format}} ({{.Type}})
* {{.Value.Severity}} {{.Value.Format}} ({{.Type}})
{{end}}
Summary

18
report/util.go
View File

@@ -120,18 +120,18 @@ func formatShortPlainText(r models.ScanResult) string {
}
cvsses := ""
for _, cvss := range vuln.CveContents.Cvss2Scores() {
for _, cvss := range vuln.Cvss2Scores() {
cvsses += fmt.Sprintf("%s (%s)\n", cvss.Value.Format(), cvss.Type)
}
cvsses += vuln.Cvss2CalcURL() + "\n"
for _, cvss := range vuln.CveContents.Cvss3Scores() {
for _, cvss := range vuln.Cvss3Scores() {
cvsses += fmt.Sprintf("%s (%s)\n", cvss.Value.Format(), cvss.Type)
}
if 0 < len(vuln.CveContents.Cvss3Scores()) {
if 0 < len(vuln.Cvss3Scores()) {
cvsses += vuln.Cvss3CalcURL() + "\n"
}
maxCvss := vuln.CveContents.FormatMaxCvssScore()
maxCvss := vuln.FormatMaxCvssScore()
rightCol := fmt.Sprintf(`%s
%s
---
@@ -186,17 +186,17 @@ func formatFullPlainText(r models.ScanResult) string {
for _, vuln := range vulns.ToSortedSlice() {
table.AddRow(vuln.CveID)
table.AddRow("----------------")
table.AddRow("Max Score", vuln.CveContents.FormatMaxCvssScore())
for _, cvss := range vuln.CveContents.Cvss2Scores() {
table.AddRow("Max Score", vuln.FormatMaxCvssScore())
for _, cvss := range vuln.Cvss2Scores() {
table.AddRow(cvss.Type, cvss.Value.Format())
}
for _, cvss := range vuln.CveContents.Cvss3Scores() {
for _, cvss := range vuln.Cvss3Scores() {
table.AddRow(cvss.Type, cvss.Value.Format())
}
if 0 < len(vuln.CveContents.Cvss2Scores()) {
if 0 < len(vuln.Cvss2Scores()) {
table.AddRow("CVSSv2 Calc", vuln.Cvss2CalcURL())
}
if 0 < len(vuln.CveContents.Cvss3Scores()) {
if 0 < len(vuln.Cvss3Scores()) {
table.AddRow("CVSSv3 Calc", vuln.Cvss3CalcURL())
}
table.AddRow("Summary", vuln.CveContents.Summaries(