From 54f8d97c913e3c38073d6a31ed3ff02dd71cf9cb Mon Sep 17 00:00:00 2001 From: "Yann E. MORIN" Date: Sun, 25 Feb 2024 23:05:36 +0100 Subject: [PATCH] support/scripts/pkg-stats: adapt to NVD v2 json format Commit 22b69455526f (support/scripts/cve.py: switch from NVD to FKIE for the JSON files) missed the fact that the layout of the FKIE data files are different from the original NVD ones. They are formatted according to the NVD v2 API. Most differences are relatively trivial fields renaming, and those are easily spotted in this patch. There is however one key difference in the layout of the configurations. Where the NVD had "configurations" as an object with a "nodes" key, the FKIE has a "configurations" as a list of objects with a single "nodes" key; i.e. it is one-level deeper. Signed-off-by: Yann E. MORIN Cc: Arnout Vandecappelle (Essensium/Mind) Signed-off-by: Arnout Vandecappelle --- support/scripts/cve.py | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/support/scripts/cve.py b/support/scripts/cve.py index f12a8048cd..747ad881c9 100755 --- a/support/scripts/cve.py +++ b/support/scripts/cve.py @@ -128,7 +128,7 @@ class CVE: filename = CVE.download_nvd_year(nvd_dir, year) try: uncompressed = subprocess.check_output(["xz", "-d", "-c", filename]) - content = ijson.items(uncompressed, 'CVE_Items.item') + content = ijson.items(uncompressed, 'cve_items.item') except: # noqa: E722 print("ERROR: cannot read %s. Please remove the file then rerun this script" % filename) raise @@ -155,11 +155,11 @@ class CVE: for parsed_node in self.parse_node(child): yield parsed_node - for cpe in node.get('cpe_match', ()): + for cpe in node.get('cpeMatch', ()): if not cpe['vulnerable']: return - product = cpe_product(cpe['cpe23Uri']) - version = cpe_version(cpe['cpe23Uri']) + product = cpe_product(cpe['criteria']) + version = cpe_version(cpe['criteria']) # ignore when product is '-', which means N/A if product == '-': return @@ -191,7 +191,7 @@ class CVE: v_end = cpe['versionEndExcluding'] yield { - 'id': cpe['cpe23Uri'], + 'id': cpe['criteria'], 'v_start': v_start, 'op_start': op_start, 'v_end': v_end, @@ -199,14 +199,15 @@ class CVE: } def each_cpe(self): - for node in self.nvd_cve['configurations']['nodes']: - for cpe in self.parse_node(node): - yield cpe + for nodes in self.nvd_cve.get('configurations', []): + for node in nodes['nodes']: + for cpe in self.parse_node(node): + yield cpe @property def identifier(self): """The CVE unique identifier""" - return self.nvd_cve['cve']['CVE_data_meta']['ID'] + return self.nvd_cve['id'] @property def affected_products(self):