vdb/lib/gha.py
def convert(self, cve_data):
        """Convert the GitHub advisory data into Vulnerability objects"""
        ret_data = []
        if cve_data.get("errors"):
            return ret_data, None
        if cve_data.get("message") and cve_data.get("message") == "Bad credentials":
            LOG.warning("GITHUB_TOKEN environment variable is invalid!")
            return ret_data, None
        page_info = cve_data["data"]["securityAdvisories"].get("pageInfo")
        for cve in cve_data["data"]["securityAdvisories"]["nodes"]:
            # If this CVE is withdrawn continue
            if cve.get("withdrawnAt"):
                continue
            cve_id = None
            assigner = "cve@mitre.org"
            references = []
            for r in cve["references"]:
                references.append({"url": r["url"], "name": r["url"]})
            for id in cve["identifiers"]:
                if id["type"] == "CVE":
                    cve_id = id["value"]
            if not cve_id:
                cve_id = cve["ghsaId"]
                assigner = "@github"
            references = json_lib.dumps(references)
            if isinstance(references, bytes):
                references = references.decode("utf-8", "ignore")
            for p in cve["vulnerabilities"]["nodes"]:
                if not p:
                    continue
                vendor = p["package"]["ecosystem"]
                product = p["package"]["name"]
                if ":" in product or "/" in product:
                    tmpA = re.split(r"[/|:]", product)
                    # This extract's the correct vendor based on the namespace
                    # Eg: org.springframework:spring-webflux would result in
                    # vendor: org.springframework
                    # product: spring-webflux
                    vendor = tmpA[0]
                    product = tmpA[len(tmpA) - 1]
                version = p["vulnerableVersionRange"]
                (
                    version_start_including,
                    version_end_including,
                    version_start_excluding,
                    version_end_excluding,
                ) = self.get_version_range(version)
                top_fix_version = p.get("firstPatchedVersion")
                if not top_fix_version or not top_fix_version.get("identifier"):
                    top_fix_version = {"identifier": ""}
                fix_version = top_fix_version.get("identifier", {})
                (
                    fix_version_start_including,
                    fix_version_end_including,
                    fix_version_start_excluding,
                    fix_version_end_excluding,
                ) = self.get_version_range(fix_version)

                severity = p["severity"]
                score, severity, vectorString, attackComplexity = get_default_cve_data(
                    severity
                )
                exploitabilityScore = score
                description = """# {}
{}
            """.format(
                    cve.get("summary"), cve.get("description")
                )

                tdata = config.CVE_TPL % dict(
                    cve_id=cve_id,
                    cwe_id="UNKNOWN",
                    assigner=assigner,
                    references=references,
                    description="",
                    vectorString=vectorString,
                    vendor=vendor.lower(),
                    product=product.lower(),
                    version="*",
                    version_start_including=version_start_including,
                    version_end_including=version_end_including,
                    version_start_excluding=version_start_excluding,
                    version_end_excluding=version_end_excluding,
                    fix_version_start_including=fix_version_start_including,
                    fix_version_end_including=fix_version_end_including,
                    fix_version_start_excluding=fix_version_start_excluding,
                    fix_version_end_excluding=fix_version_end_excluding,
                    severity=severity,
                    attackComplexity=attackComplexity,
                    score=score,
                    exploitabilityScore=exploitabilityScore,
                    publishedDate=cve["publishedAt"],
                    lastModifiedDate=cve["updatedAt"],
                )
                try:
                    tdata_json = json_lib.loads(tdata)
                    vuln = NvdSource.convert_vuln(tdata_json)
                    vuln.description = description
                    ret_data.append(vuln)
                except Exception as e:
                    LOG.debug(e)
        return ret_data, page_info
Convert the GitHub advisory data into Vulnerability objects
Convert the GitHub advisory data into Vulnerability objects
Convert the GitHub advisory data into Vulnerability objects
def convert(self, cve_data):
        ret_data = []
        if cve_data.get("errors"):
            return ret_data, None
        if cve_data.get("message") and cve_data.get("message") == "Bad credentials":
            LOG.warning("GITHUB_TOKEN environment variable is invalid!")
            return ret_data, None
        page_info = cve_data["data"]["securityAdvisories"].get("pageInfo")
        for cve in cve_data["data"]["securityAdvisories"]["nodes"]:
            if cve.get("withdrawnAt"):
                continue
            cve_id = None
            assigner = "cve@mitre.org"
            references = []
            for r in cve["references"]:
                references.append({"url": r["url"], "name": r["url"]})
            for id in cve["identifiers"]:
                if id["type"] == "CVE":
                    cve_id = id["value"]
            if not cve_id:
                cve_id = cve["ghsaId"]
                assigner = "@github"
            references = json_lib.dumps(references)
            if isinstance(references, bytes):
                references = references.decode("utf-8", "ignore")
            for p in cve["vulnerabilities"]["nodes"]:
                if not p:
                    continue
                vendor = p["package"]["ecosystem"]
                product = p["package"]["name"]
                if ":" in product or "/" in product:
                    tmpA = re.split(r"[/|:]", product)
                    vendor = tmpA[0]
                    product = tmpA[len(tmpA) - 1]
                version = p["vulnerableVersionRange"]
                (
                    version_start_including,
                    version_end_including,
                    version_start_excluding,
                    version_end_excluding,
                ) = self.get_version_range(version)
                top_fix_version = p.get("firstPatchedVersion")
                if not top_fix_version or not top_fix_version.get("identifier"):
                    top_fix_version = {"identifier": ""}
                fix_version = top_fix_version.get("identifier", {})
                (
                    fix_version_start_including,
                    fix_version_end_including,
                    fix_version_start_excluding,
                    fix_version_end_excluding,
                ) = self.get_version_range(fix_version)
                severity = p["severity"]
                score, severity, vectorString, attackComplexity = get_default_cve_data(
                    severity
                )
                exploitabilityScore = score
                description = """# {}
{}
            """.format(
                    cve.get("summary"), cve.get("description")
                )
                tdata = config.CVE_TPL % dict(
                    cve_id=cve_id,
                    cwe_id="UNKNOWN",
                    assigner=assigner,
                    references=references,
                    description="",
                    vectorString=vectorString,
                    vendor=vendor.lower(),
                    product=product.lower(),
                    version="*",
                    version_start_including=version_start_including,
                    version_end_including=version_end_including,
                    version_start_excluding=version_start_excluding,
                    version_end_excluding=version_end_excluding,
                    fix_version_start_including=fix_version_start_including,
                    fix_version_end_including=fix_version_end_including,
                    fix_version_start_excluding=fix_version_start_excluding,
                    fix_version_end_excluding=fix_version_end_excluding,
                    severity=severity,
                    attackComplexity=attackComplexity,
                    score=score,
                    exploitabilityScore=exploitabilityScore,
                    publishedDate=cve["publishedAt"],
                    lastModifiedDate=cve["updatedAt"],
                )
                try:
                    tdata_json = json_lib.loads(tdata)
                    vuln = NvdSource.convert_vuln(tdata_json)
                    vuln.description = description
                    ret_data.append(vuln)
                except Exception as e:
                    LOG.debug(e)
        return ret_data, page_info
def convert ( self , cve_data ) : ret_data = [ ] if cve_data . get ( "errors" ) : return ret_data , None if cve_data . get ( "message" ) and cve_data . get ( "message" ) == "Bad credentials" : LOG . warning ( "GITHUB_TOKEN environment variable is invalid!" ) return ret_data , None page_info = cve_data [ "data" ] [ "securityAdvisories" ] . get ( "pageInfo" ) for cve in cve_data [ "data" ] [ "securityAdvisories" ] [ "nodes" ] : if cve . get ( "withdrawnAt" ) : continue cve_id = None assigner = "cve@mitre.org" references = [ ] for r in cve [ "references" ] : references . append ( { "url" : r [ "url" ] , "name" : r [ "url" ] } ) for id in cve [ "identifiers" ] : if id [ "type" ] == "CVE" : cve_id = id [ "value" ] if not cve_id : cve_id = cve [ "ghsaId" ] assigner = "@github" references = json_lib . dumps ( references ) if isinstance ( references , bytes ) : references = references . decode ( "utf-8" , "ignore" ) for p in cve [ "vulnerabilities" ] [ "nodes" ] : if not p : continue vendor = p [ "package" ] [ "ecosystem" ] product = p [ "package" ] [ "name" ] if ":" in product or "/" in product : tmpA = re . split ( r"[/|:]" , product ) vendor = tmpA [ 0 ] product = tmpA [ len ( tmpA ) - 1 ] version = p [ "vulnerableVersionRange" ] ( version_start_including , version_end_including , version_start_excluding , version_end_excluding , ) = self . get_version_range ( version ) top_fix_version = p . get ( "firstPatchedVersion" ) if not top_fix_version or not top_fix_version . get ( "identifier" ) : top_fix_version = { "identifier" : "" } fix_version = top_fix_version . get ( "identifier" , { } ) ( fix_version_start_including , fix_version_end_including , fix_version_start_excluding , fix_version_end_excluding , ) = self . get_version_range ( fix_version ) severity = p [ "severity" ] score , severity , vectorString , attackComplexity = get_default_cve_data ( severity ) exploitabilityScore = score description = """# {}
{}
            """ . format ( cve . get ( "summary" ) , cve . get ( "description" ) ) tdata = config . CVE_TPL % dict ( cve_id = cve_id , cwe_id = "UNKNOWN" , assigner = assigner , references = references , description = "" , vectorString = vectorString , vendor = vendor . lower ( ) , product = product . lower ( ) , version = "*" , version_start_including = version_start_including , version_end_including = version_end_including , version_start_excluding = version_start_excluding , version_end_excluding = version_end_excluding , fix_version_start_including = fix_version_start_including , fix_version_end_including = fix_version_end_including , fix_version_start_excluding = fix_version_start_excluding , fix_version_end_excluding = fix_version_end_excluding , severity = severity , attackComplexity = attackComplexity , score = score , exploitabilityScore = exploitabilityScore , publishedDate = cve [ "publishedAt" ] , lastModifiedDate = cve [ "updatedAt" ] , ) try : tdata_json = json_lib . loads ( tdata ) vuln = NvdSource . convert_vuln ( tdata_json ) vuln . description = description ret_data . append ( vuln ) except Exception as e : LOG . debug ( e ) return ret_data , page_info
Convert the GitHub advisory data into Vulnerability objects
Convert the GitHub advisory data into Vulnerability objects
"""Convert the GitHub advisory data into Vulnerability objects""" # If this CVE is withdrawn continue # This extract's the correct vendor based on the namespace # Eg: org.springframework:spring-webflux would result in # vendor: org.springframework # product: spring-webflux
self
cve_data