Class UbuntuUSNImporter

vulnerabilities/importers/ubuntu_usn.py:21–90

class UbuntuUSNImporter(Importer):
    db_url = "https://usn.ubuntu.com/usn-db/database-all.json.bz2"
    spdx_license_expression = "LicenseRef-scancode-other-permissive"
    notice = """
    From: Seth Arnold <seth.arnold@canonical.com>
    Date: Wed, Jan 25, 2023 at 2:02 AM
    Subject: Re: [ubuntu-hardened] Usage of Ubuntu Security Data in VulnerableCode
    To: Tushar Goel <tushar.goel.dav@gmail.com>
    Cc: <ubuntu-hardened@lists.ubuntu.com>, Philippe Ombredanne <pombredanne@nexb.com>, jmhoran@nexb.com <jmhoran@nexb.com>
    
    
    On Wed, Jan 11, 2023 at 06:27:38PM +0530, Tushar Goel wrote:
    > We would like to integrate the Ubuntu usn data[1][2] and
    > Ubuntu security data (OVAL format)[3] in vulnerablecode[4]
    > which is a FOSS db of FOSS vulnerability data. We were not
    > able to know under which license this security data comes.
    > We would be grateful to have your acknowledgement over usage of
    > the ubuntu security data in vulnerablecode and have
    > some kind of licensing declaration from your side.
    
    Hello Tushar, we do not have an explicit license on this data.
    
    We share our data with the intention that others will use it. Please
    feel free to use it for the general furtherance of security.
    
    Much of the data that&#x27;s contained within our databases is sourced from
    third parties, who also shared their data with the intention that others
    will use it. I&#x27;m not sure what it would look like to try to put a license
    on data that is crowd-sourced from thousands of contributors. (If you were
    to start such a project today, it&#x27;d probably be one of the first things to
    formalize. But when CVE was started two decades ago, the primary goal was
    sharing knowledge and simplifying the vulnerability remediation process,
    and licensing the data was, as far as I can remember, not considered.
    Sharing was the goal.)
    
    I will ask that vulnerablecode 'be nice' to our infrastructure that
    hosts the databases -- some automated uses of our infrastructure by
    vulnerability scanner tools has lead to significant load and engineering
    effort. In general, please prefer a small handful of systems updating
    mirrors roughly twice a day rather than thousands of hosts pulling
    data hourly.
    
    Thanks
    """
    importer_name = "Ubuntu USN Importer"

    def advisory_data(self):
        usn_db = fetch(self.db_url)
        yield from self.to_advisories(usn_db=usn_db)

    def to_advisories(self, usn_db):
        for usn in usn_db:
            usn_data = usn_db[usn]
            usn_reference = get_usn_reference(usn_data.get("id"))
            usn_references = []
            if usn_reference:
                usn_references = [usn_reference]
            for cve in usn_data.get("cves", []):