diff --git a/vulnerabilities/importers/__init__.py b/vulnerabilities/importers/__init__.py index d3316316d..718562492 100644 --- a/vulnerabilities/importers/__init__.py +++ b/vulnerabilities/importers/__init__.py @@ -21,7 +21,8 @@ # Visit https://github.com/nexB/vulnerablecode/ for support and download. from vulnerabilities.importers import alpine_linux from vulnerabilities.importers import nginx +from vulnerabilities.importers import pysec -IMPORTERS_REGISTRY = [nginx.NginxImporter, alpine_linux.AlpineImporter] +IMPORTERS_REGISTRY = [nginx.NginxImporter, alpine_linux.AlpineImporter, pysec.PyPlImporter] IMPORTERS_REGISTRY = {x.qualified_name: x for x in IMPORTERS_REGISTRY} diff --git a/vulnerabilities/importers/pysec.py b/vulnerabilities/importers/pysec.py new file mode 100644 index 000000000..6eb46b2ef --- /dev/null +++ b/vulnerabilities/importers/pysec.py @@ -0,0 +1,174 @@ +# Copyright (c) 2017 nexB Inc. and others. All rights reserved. +# http://nexb.com and https://github.com/nexB/vulnerablecode/ +# The VulnerableCode software is licensed under the Apache License version 2.0. +# Data generated with VulnerableCode require an acknowledgment. +# +# You may not use this software except in compliance with the License. +# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +# +# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode +# derivative work, you must accompany this data with the following acknowledgment: +# +# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES +# OR CONDITIONS OF ANY KIND, either express or implied. No content created from +# VulnerableCode should be considered or used as legal advice. Consult an Attorney +# for any legal advice. +# VulnerableCode is a free software code scanning tool from nexB Inc. and others. +# Visit https://github.com/nexB/vulnerablecode/ for support and download. +import json +import logging +from datetime import datetime +from datetime import timezone +from io import BytesIO +from typing import Iterable +from zipfile import ZipFile + +import requests +from packageurl import PackageURL +from univers.version_range import GitHubVersionRange +from univers.version_range import PypiVersionRange +from univers.versions import SemverVersion + +from vulnerabilities.importer import AdvisoryData +from vulnerabilities.importer import AffectedPackage +from vulnerabilities.importer import Importer +from vulnerabilities.importer import Reference +from vulnerabilities.importer import VulnerabilitySeverity +from vulnerabilities.severity_systems import SCORING_SYSTEMS + +logger = logging.getLogger(__name__) + + +class PyPlImporter(Importer): + spdx_license_expression = "Apache-2.0" + + def advisory_data(self) -> Iterable[AdvisoryData]: + url = "https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip" + response = requests.get(url).content + try: + with ZipFile(BytesIO(response)) as zip_file: + for file_name in zip_file.namelist(): + with zip_file.open(file_name) as f: + vul_info = json.loads(f.read()) + yield parse_advisory_data(vul_info) + except requests.exceptions.RequestException: + logger.error(f"Failed to fetch osv-vulnerabilities PyPI: HTTP ") + + +def parse_advisory_data(raw_data: dict) -> AdvisoryData: + + if "summary" in raw_data: + summary = raw_data["summary"] + elif "details" in raw_data: + summary = raw_data["details"][slice(50)] + else: + summary = "" + logger.error(f"summary not found- {raw_data['id'] !r}") + + aliases = raw_data["aliases"] if "aliases" in raw_data else raw_data["id"] + + if raw_data["published"] is not None: + date_published = datetime.strptime( + raw_data["published"][0:19], "%Y-%m-%dT%H:%M:%S" + ).replace(tzinfo=timezone.utc) + else: + date_published = None + logger.error("date_published not found " + raw_data["id"]) + + severity = [] + if "severity" in raw_data: + for sever_list in raw_data["severity"]: + if "type" in sever_list and sever_list["type"] == "CVSS_V3": + severity.append( + VulnerabilitySeverity( + system=SCORING_SYSTEMS["cvssv3_vector"], + value=sever_list["score"], + ) + ) + elif "ecosystem_specific" in raw_data and "severity" in raw_data["ecosystem_specific"]: + severity.append( + VulnerabilitySeverity( + system=SCORING_SYSTEMS["generic_textual"], + value=raw_data["ecosystem_specific"]["severity"], + ) + ) + else: + severity = [] + logger.error(f"severity not found- {raw_data['id'] !r}") + + references = [] + if "references" in raw_data: + for ref in raw_data["references"]: + if ref["url"] is None: + continue + else: + references.append(Reference(url=ref["url"], severities=severity)) + else: + logger.error(f"references not found - {raw_data['id'] !r}") + + affected_package = [] + if "affected" in raw_data: + for affected_pkg in raw_data["affected"]: + if (affected_pkg["package"]["ecosystem"] is not None) and ( + affected_pkg["package"]["name"] is not None + ): + purl = PackageURL( + type=affected_pkg["package"]["ecosystem"], name=affected_pkg["package"]["name"] + ) + else: + purl = "" + logger.error(f"purl affected_pkg not found - {raw_data['id'] !r}") + + affected_version_range = ( + PypiVersionRange(affected_pkg["versions"][slice(50)]) + if "versions" in affected_pkg + else None + ) + + if "ranges" in affected_pkg: + for fix_range in affected_pkg["ranges"]: + fixed_version = set() + if "type" in fix_range: + if fix_range["type"] == "ECOSYSTEM": + filter_fixed = list( + filter(lambda x: x.keys() == {"fixed"}, fix_range["events"]) + ) + list_fixed = [i["fixed"] for i in filter_fixed] + fixed_version.add(PypiVersionRange(list_fixed)) + + if fix_range["type"] == "SEMVER": + filter_fixed = list( + filter(lambda x: x.keys() == {"fixed"}, fix_range["events"]) + ) + list_fixed = [i["fixed"] for i in filter_fixed] + for i in list_fixed: + fixed_version.add(SemverVersion(i)) + + if fix_range["type"] == "GIT": + filter_fixed = list( + filter(lambda x: x.keys() == {"fixed"}, fix_range["events"]) + ) + list_fixed = [i["fixed"] for i in filter_fixed] + fixed_version.add(GitHubVersionRange(list_fixed)) + + affected_package.append( + AffectedPackage( + package=purl, + affected_version_range=affected_version_range, + fixed_version=fixed_version, + ) + ) + else: + logger.error(f"affected_package not found - {raw_data['id'] !r}") + + return AdvisoryData( + aliases=aliases, + summary=summary, + affected_packages=affected_package, + references=references, + date_published=date_published, + ) diff --git a/vulnerabilities/tests/test_data/pysec/pysec_test.json b/vulnerabilities/tests/test_data/pysec/pysec_test.json new file mode 100644 index 000000000..cfe51460e --- /dev/null +++ b/vulnerabilities/tests/test_data/pysec/pysec_test.json @@ -0,0 +1,219 @@ +[ + { + "id": "GHSA-j3f7-7rmc-6wqj", + "summary": "Improper certificate management in AWS IoT Device SDK v2", + "details": "The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been \u201coverridden\u201d. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system\u2019s default trust-store. Attackers with access to a host\u2019s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.", + "aliases": [ + "CVE-2021-40831" + ], + "modified": "2022-02-15T05:31:22.788787Z", + "published": "2021-11-24T20:35:03Z", + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40831" + }, + { + "type": "WEB", + "url": "https://github.com/aws/aws-iot-device-sdk-cpp-v2" + } + ], + "affected": [ + { + "package": { + "name": "awsiotsdk", + "ecosystem": "PyPI", + "purl": "pkg:pypi/awsiotsdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.7.0" + } + ] + } + ], + "versions": [ + "0.2.4", + "0.2.9", + "0.3.0", + "1.0.2", + "1.0.3", + "1.0.5", + "1.0.6", + "1.1.0", + "1.2.0", + "1.2.1", + "1.3.0", + "1.3.1", + "1.3.2", + "1.4.0", + "1.5.0", + "1.5.1", + "1.5.10", + "1.5.11", + "1.5.12", + "1.5.13", + "1.5.14", + "1.5.15", + "1.5.16", + "1.5.17", + "1.5.18", + "1.5.2", + "1.5.3", + "1.5.4", + "1.5.5", + "1.5.6", + "1.5.7", + "1.5.8", + "1.6.0", + "1.6.1", + "1.6.2" + ], + "database_specific": { + "ghsa": "https://github.com/advisories/GHSA-j3f7-7rmc-6wqj", + "cvss": { + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", + "score": 6.3 + }, + "cwes": [ + { + "description": "The software does not validate, or incorrectly validates, a certificate.", + "cweId": "CWE-295", + "name": "Improper Certificate Validation" + } + ], + "source": "https://storage.googleapis.com/ghsa-osv/GHSA-j3f7-7rmc-6wqj.json" + } + }, + { + "package": { + "name": "aws-iot-device-sdk-v2", + "ecosystem": "npm", + "purl": "pkg:npm/aws-iot-device-sdk-v2" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.0" + } + ] + } + ], + "database_specific": { + "source": "https://storage.googleapis.com/ghsa-osv/GHSA-j3f7-7rmc-6wqj.json", + "ghsa": "https://github.com/advisories/GHSA-j3f7-7rmc-6wqj", + "cvss": { + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", + "score": 6.3 + }, + "cwes": [ + { + "description": "The software does not validate, or incorrectly validates, a certificate.", + "cweId": "CWE-295", + "name": "Improper Certificate Validation" + } + ] + } + }, + { + "package": { + "name": "software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk", + "ecosystem": "Maven", + "purl": "pkg:maven/software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.0" + } + ] + } + ], + "versions": [ + "0.2.3", + "0.2.4", + "0.2.5", + "0.2.6", + "0.2.7", + "0.2.8", + "0.3.0", + "0.3.1", + "0.3.2", + "0.3.3", + "1.0.0", + "1.0.1", + "1.0.2", + "1.0.3", + "1.0.4", + "1.0.5", + "1.0.6", + "1.0.7", + "1.0.8", + "1.0.9", + "1.1.0", + "1.1.1", + "1.2.0", + "1.2.1", + "1.2.10", + "1.2.11", + "1.2.12", + "1.2.13", + "1.2.14", + "1.2.15", + "1.2.16", + "1.2.17", + "1.2.18", + "1.2.2", + "1.2.3", + "1.2.4", + "1.2.5", + "1.2.6", + "1.2.7", + "1.2.8", + "1.2.9", + "1.3.0", + "1.3.1", + "1.3.2", + "1.3.3", + "1.4.0", + "1.4.1", + "1.4.2", + "1.4.3" + ], + "database_specific": { + "source": "https://storage.googleapis.com/ghsa-osv/GHSA-j3f7-7rmc-6wqj.json", + "cvss": { + "score": 6.3, + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" + }, + "ghsa": "https://github.com/advisories/GHSA-j3f7-7rmc-6wqj", + "cwes": [ + { + "name": "Improper Certificate Validation", + "cweId": "CWE-295", + "description": "The software does not validate, or incorrectly validates, a certificate." + } + ] + } + } + ], + "schema_version": "1.2.0" +} + +] \ No newline at end of file diff --git a/vulnerabilities/tests/test_pysec.py b/vulnerabilities/tests/test_pysec.py new file mode 100644 index 000000000..d4e28f997 --- /dev/null +++ b/vulnerabilities/tests/test_pysec.py @@ -0,0 +1,176 @@ +# Copyright (c) nexB Inc. and others. All rights reserved. +# http://nexb.com and https://github.com/nexB/vulnerablecode/ +# The VulnerableCode software is licensed under the Apache License version 2.0. +# Data generated with VulnerableCode require an acknowledgment. +# +# You may not use this software except in compliance with the License. +# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +# +# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode +# derivative work, you must accompany this data with the following acknowledgment: +# +# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES +# OR CONDITIONS OF ANY KIND, either express or implied. No content created from +# VulnerableCode should be considered or used as legal advice. Consult an Attorney +# for any legal advice. +# VulnerableCode is a free software tool from nexB Inc. and others. +# Visit https://github.com/nexB/vulnerablecode/ for support and download. +import datetime +import json +import os +from unittest import TestCase + +from packageurl import PackageURL +from univers.version_range import PypiVersionRange +from univers.versions import SemverVersion + +from vulnerabilities.importer import AdvisoryData +from vulnerabilities.importer import AffectedPackage +from vulnerabilities.importer import Reference +from vulnerabilities.importers.pysec import parse_advisory_data + +BASE_DIR = os.path.dirname(os.path.abspath(__file__)) +TEST_DATA = os.path.join(BASE_DIR, "test_data/pysec", "pysec_test.json") + + +class TestPyPLImporter(TestCase): + @classmethod + def setUpClass(cls): + with open(TEST_DATA) as f: + cls.mock_response = json.load(f) + + def test_to_advisories(self): + expected_advisories = [ + AdvisoryData( + aliases=["CVE-2021-40831"], + summary="Improper certificate management in AWS IoT Device SDK v2", + affected_packages=[ + AffectedPackage( + package=PackageURL(type="PyPI", name="awsiotsdk"), + affected_version_range=PypiVersionRange( + [ + "0.2.4", + "0.2.9", + "0.3.0", + "1.0.2", + "1.0.3", + "1.0.5", + "1.0.6", + "1.1.0", + "1.2.0", + "1.2.1", + "1.3.0", + "1.3.1", + "1.3.2", + "1.4.0", + "1.5.0", + "1.5.1", + "1.5.10", + "1.5.11", + "1.5.12", + "1.5.13", + "1.5.14", + "1.5.15", + "1.5.16", + "1.5.17", + "1.5.18", + "1.5.2", + "1.5.3", + "1.5.4", + "1.5.5", + "1.5.6", + "1.5.7", + "1.5.8", + "1.6.0", + "1.6.1", + "1.6.2", + ] + ), + fixed_version={PypiVersionRange(["1.7.0"])}, + ), + AffectedPackage( + package=PackageURL(type="npm", name="aws-iot-device-sdk-v2"), + affected_version_range=None, + fixed_version={SemverVersion("1.6.0")}, + ), + AffectedPackage( + package=PackageURL( + type="Maven", + name="software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk", + ), + affected_version_range=PypiVersionRange( + [ + "0.2.3", + "0.2.4", + "0.2.5", + "0.2.6", + "0.2.7", + "0.2.8", + "0.3.0", + "0.3.1", + "0.3.2", + "0.3.3", + "1.0.0", + "1.0.1", + "1.0.2", + "1.0.3", + "1.0.4", + "1.0.5", + "1.0.6", + "1.0.7", + "1.0.8", + "1.0.9", + "1.1.0", + "1.1.1", + "1.2.0", + "1.2.1", + "1.2.10", + "1.2.11", + "1.2.12", + "1.2.13", + "1.2.14", + "1.2.15", + "1.2.16", + "1.2.17", + "1.2.18", + "1.2.2", + "1.2.3", + "1.2.4", + "1.2.5", + "1.2.6", + "1.2.7", + "1.2.8", + "1.2.9", + "1.3.0", + "1.3.1", + "1.3.2", + "1.3.3", + "1.4.0", + "1.4.1", + "1.4.2", + "1.4.3", + ] + ), + fixed_version={PypiVersionRange(["1.5.0"])}, + ), + ], + references=[ + Reference(url="https://nvd.nist.gov/vuln/detail/CVE-2021-40831", severities=[]), + Reference( + url="https://github.com/aws/aws-iot-device-sdk-cpp-v2", severities=[] + ), + ], + date_published=datetime.datetime(2021, 11, 24, 20, 35, 3, 0).replace( + tzinfo=datetime.timezone.utc + ), + ) + ] + found_data = [] + for i in range(len(self.mock_response)): + found_data.append(parse_advisory_data(self.mock_response[i])) + + assert found_data == expected_advisories