Stage/vuls
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(oval/suse): use def.Advisory.Cves[0].CveID instead of def.Title (#1397)

Browse Source
This commit is contained in:
MaineK00n
2022-02-17 19:16:14 +09:00
committed by GitHub
parent 9bcffcd721
commit 7750347010
1 changed files with 27 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
oval/suse.go
View File

@@ -65,27 +65,30 @@ func (o SUSE) FillWithOval(r *models.ScanResult) (nCVEs int, err error) {
}
func (o SUSE) update(r *models.ScanResult, defpacks defPacks) {
ovalContent := *o.convertToModel(&defpacks.def)
ovalContent := o.convertToModel(&defpacks.def)
if ovalContent == nil {
return
}
ovalContent.Type = models.NewCveContentType(o.family)
vinfo, ok := r.ScannedCves[defpacks.def.Title]
vinfo, ok := r.ScannedCves[ovalContent.CveID]
if !ok {
logging.Log.Debugf("%s is newly detected by OVAL", defpacks.def.Title)
logging.Log.Debugf("%s is newly detected by OVAL", ovalContent.CveID)
vinfo = models.VulnInfo{
CveID: defpacks.def.Title,
CveID: ovalContent.CveID,
Confidences: models.Confidences{models.OvalMatch},
CveContents: models.NewCveContents(ovalContent),
CveContents: models.NewCveContents(*ovalContent),
}
} else {
cveContents := vinfo.CveContents
ctype := models.NewCveContentType(o.family)
if _, ok := vinfo.CveContents[ctype]; ok {
logging.Log.Debugf("%s OVAL will be overwritten", defpacks.def.Title)
logging.Log.Debugf("%s OVAL will be overwritten", ovalContent.CveID)
} else {
logging.Log.Debugf("%s is also detected by OVAL", defpacks.def.Title)
logging.Log.Debugf("%s is also detected by OVAL", ovalContent.CveID)
cveContents = models.CveContents{}
}
vinfo.Confidences.AppendIfMissing(models.OvalMatch)
cveContents[ctype] = []models.CveContent{ovalContent}
cveContents[ctype] = []models.CveContent{*ovalContent}
vinfo.CveContents = cveContents
}
@@ -105,10 +108,15 @@ func (o SUSE) update(r *models.ScanResult, defpacks defPacks) {
}
vinfo.AffectedPackages = collectBinpkgFixstat.toPackStatuses()
vinfo.AffectedPackages.Sort()
r.ScannedCves[defpacks.def.Title] = vinfo
r.ScannedCves[ovalContent.CveID] = vinfo
}
func (o SUSE) convertToModel(def *ovalmodels.Definition) *models.CveContent {
if len(def.Advisory.Cves) != 1 {
logging.Log.Warnf("Unknown Oval format. Please register the issue as it needs to be investigated. https://github.com/vulsio/goval-dictionary/issues family: %s, defID: %s", o.family, def.DefinitionID)
return nil
}
refs := []models.Reference{}
for _, r := range def.References {
refs = append(refs, models.Reference{
@@ -117,23 +125,15 @@ func (o SUSE) convertToModel(def *ovalmodels.Definition) *models.CveContent {
RefID: r.RefID,
})
}
cveCont := models.CveContent{
CveID: def.Title,
Title: def.Title,
Summary: def.Description,
References: refs,
cve := def.Advisory.Cves[0]
score3, vec3 := parseCvss3(cve.Cvss3)
return &models.CveContent{
Title: def.Title,
Summary: def.Description,
CveID: cve.CveID,
Cvss3Score: score3,
Cvss3Vector: vec3,
Cvss3Severity: cve.Impact,
References: refs,
}
if 0 < len(def.Advisory.Cves) {
if len(def.Advisory.Cves) == 1 {
cve := def.Advisory.Cves[0]
score3, vec3 := parseCvss3(cve.Cvss3)
cveCont.Cvss3Score = score3
cveCont.Cvss3Vector = vec3
cveCont.Cvss3Severity = cve.Impact
} else {
logging.Log.Warnf("Unknown Oval format. Please register the issue as it needs to be investigated. https://github.com/future-architect/vuls/issues family: %s, defID: %s", o.family, def.DefinitionID)
}
}
return &cveCont
}