| 96 | yield from self.parse(pkg_name, records) |
| 97 | |
| 98 | def parse(self, pkg_name: str, records: Mapping[str, Any]) -> Iterable[AdvisoryData]: |
| 99 | |
| 100 | for cve_id, record in records.items(): |
| 101 | affected_versions = [] |
| 102 | fixed_versions = [] |
| 103 | if not cve_id.startswith("CVE"): |
| 104 | logger.error(f"Invalid CVE ID: {cve_id} in {record} in package {pkg_name}") |
| 105 | continue |
| 106 | |
| 107 | # vulnerabilities starting with something else may not be public yet |
| 108 | # see for instance https://web.archive.org/web/20201215213725/https://security-tracker.debian.org/tracker/TEMP-0000000-A2EB44 |
| 109 | # TODO: this would need to be revisited though to ensure we are not missing out on anything |
| 110 | # https://github.com/nexB/vulnerablecode/issues/730 |
| 111 | |
| 112 | releases = record["releases"].items() |
| 113 | for release_name, release_record in releases: |
| 114 | version = get_item(release_record, "repositories", release_name) |
| 115 | |
| 116 | if not version: |
| 117 | logger.error( |
| 118 | f"Version not found for {release_name} in {record} in package {pkg_name}" |
| 119 | ) |
| 120 | continue |
| 121 | |
| 122 | purl = PackageURL( |
| 123 | name=pkg_name, |
| 124 | type="deb", |
| 125 | namespace="debian", |
| 126 | qualifiers={"distro": release_name}, |
| 127 | ) |
| 128 | |
| 129 | if release_record.get("status", "") == "resolved": |
| 130 | fixed_versions.append(version) |
| 131 | else: |
| 132 | affected_versions.append(version) |
| 133 | |
| 134 | if "fixed_version" in release_record: |
| 135 | fixed_versions.append(release_record["fixed_version"]) |
| 136 | |
| 137 | references = [] |
| 138 | debianbug = record.get("debianbug") |
| 139 | if debianbug: |
| 140 | bug_url = f"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug={debianbug}" |
| 141 | references.append(Reference(url=bug_url, reference_id=str(debianbug))) |
| 142 | affected_versions = dedupe(affected_versions) |
| 143 | fixed_versions = dedupe(fixed_versions) |
| 144 | if affected_versions: |
| 145 | affected_version_range = DebianVersionRange.from_versions(affected_versions) |
| 146 | else: |
| 147 | affected_version_range = None |
| 148 | affected_packages = [] |
| 149 | for fixed_version in fixed_versions: |
| 150 | affected_packages.append( |
| 151 | AffectedPackage( |
| 152 | package=purl, |
| 153 | affected_version_range=affected_version_range, |
| 154 | fixed_version=DebianVersion(fixed_version), |
| 155 | ) |