Return AdvisoryData from given xml_issue
(xml_issue)
| 57 | |
| 58 | |
| 59 | def to_advisory_data(xml_issue) -> AdvisoryData: |
| 60 | """ |
| 61 | Return AdvisoryData from given xml_issue |
| 62 | """ |
| 63 | |
| 64 | purl = PackageURL(type="openssl", name="openssl") |
| 65 | cve = advisory_url = severity = summary = None |
| 66 | safe_pkg_versions = {} |
| 67 | vuln_pkg_versions_by_base_version = {} |
| 68 | aliases = [] |
| 69 | references = [] |
| 70 | affected_packages = [] |
| 71 | date_published = xml_issue.attrib["public"].strip() |
| 72 | |
| 73 | for info in xml_issue: |
| 74 | if info.tag == "impact": |
| 75 | severity = VulnerabilitySeverity( |
| 76 | system=SCORING_SYSTEMS["generic_textual"], value=info.attrib["severity"] |
| 77 | ) |
| 78 | |
| 79 | elif info.tag == "advisory": |
| 80 | advisory_url = info.attrib["url"] |
| 81 | if not advisory_url.startswith("https://web.archive.org"): |
| 82 | advisory_url = urljoin("https://www.openssl.org", advisory_url) |
| 83 | |
| 84 | elif info.tag == "cve": |
| 85 | cve = info.attrib.get("name") |
| 86 | # use made up alias to compensate for case when advisory doesn't have CVE-ID |
| 87 | madeup_alias = f"VC-OPENSSL-{date_published}" |
| 88 | if cve: |
| 89 | cve = f"CVE-{cve}" |
| 90 | madeup_alias = f"{madeup_alias}-{cve}" |
| 91 | aliases.append(cve) |
| 92 | references.append( |
| 93 | Reference(reference_id=cve, url=f"https://nvd.nist.gov/vuln/detail/{cve}") |
| 94 | ) |
| 95 | aliases.append(madeup_alias) |
| 96 | |
| 97 | elif info.tag == "affects": |
| 98 | affected_base = info.attrib["base"] |
| 99 | affected_version = info.attrib["version"] |
| 100 | if affected_base.startswith("fips"): |
| 101 | logger.error( |
| 102 | f"{affected_base!r} is a OpenSSL-FIPS Object Module and isn't supported by OpensslImporter. Use a different importer." |
| 103 | ) |
| 104 | return |
| 105 | if affected_base in vuln_pkg_versions_by_base_version: |
| 106 | vuln_pkg_versions_by_base_version[affected_base].append(affected_version) |
| 107 | else: |
| 108 | vuln_pkg_versions_by_base_version[affected_base] = [affected_version] |
| 109 | |
| 110 | elif info.tag == "fixed": |
| 111 | fixed_base = info.attrib["base"] |
| 112 | fixed_version = info.attrib["version"] |
| 113 | safe_pkg_versions[fixed_base] = fixed_version |
| 114 | for commit in info: |
| 115 | commit_hash = commit.attrib["hash"] |
| 116 | references.append( |
no test coverage detected