Return a list of advisories from the merged groups of advisories.
(groups, include_ssvc_trees=False)
| 963 | |
| 964 | |
| 965 | def get_advisories_from_groups(groups, include_ssvc_trees=False): |
| 966 | """ |
| 967 | Return a list of advisories from the merged groups of advisories. |
| 968 | """ |
| 969 | from vulnerabilities.models import SSVC |
| 970 | from vulnerabilities.models import AdvisoryV2 |
| 971 | from vulnerabilities.models import Group |
| 972 | from vulnerabilities.models import GroupedAdvisory |
| 973 | |
| 974 | advisories = [] |
| 975 | |
| 976 | for group in groups: |
| 977 | |
| 978 | assert isinstance(group, Group) |
| 979 | weighted_severity = None |
| 980 | exploitability = None |
| 981 | risk_score = None |
| 982 | |
| 983 | severity_scores = [] |
| 984 | severity_scores.append(group.primary.weighted_severity or 0.0) |
| 985 | severity_scores.extend([adv.weighted_severity or 0.0 for adv in group.secondaries]) |
| 986 | |
| 987 | if severity_scores: |
| 988 | weighted_severity = round(max(severity_scores), 1) |
| 989 | |
| 990 | exploitability_scores = [] |
| 991 | exploitability_scores.append(group.primary.exploitability or 0.0) |
| 992 | exploitability_scores.extend([adv.exploitability or 0.0 for adv in group.secondaries]) |
| 993 | |
| 994 | if exploitability_scores: |
| 995 | exploitability = max(exploitability_scores) |
| 996 | |
| 997 | if exploitability and weighted_severity: |
| 998 | risk_score = min(float(exploitability * weighted_severity), 10.0) |
| 999 | risk_score = round(risk_score, 1) |
| 1000 | |
| 1001 | identifier = group.primary.advisory_id.split("/")[-1] |
| 1002 | filtered_aliases = [alias for alias in group.aliases if alias.alias != identifier] |
| 1003 | |
| 1004 | ssvc_trees = [] |
| 1005 | |
| 1006 | if include_ssvc_trees: |
| 1007 | |
| 1008 | all_advs = [group.primary] + list(group.secondaries) |
| 1009 | |
| 1010 | advisories_qs = AdvisoryV2.objects.filter( |
| 1011 | id__in=[adv.id for adv in all_advs] |
| 1012 | ).prefetch_related( |
| 1013 | Prefetch( |
| 1014 | "related_ssvcs", |
| 1015 | queryset=SSVC.objects.select_related("source_advisory") |
| 1016 | .only("id", "vector", "decision", "options", "source_advisory__url") |
| 1017 | .distinct(), |
| 1018 | to_attr="ssvc_trees", |
| 1019 | ) |
| 1020 | ) |
| 1021 | |
| 1022 | ssvc_trees = [ |