forked from DependencyTrack/dependency-track
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
De-duplicate CPEs in NVD feed file parsing
Some CVE records contain duplicate CPEs. The original parsing logic did not de-duplicate those, consequently causing duplicate `VulnerableSoftware` records in the database. De-duplication was already handled in `NistApiMirrorTask`, but not `NistMirrorTask`. Relates to DependencyTrack#3663 Signed-off-by: nscuro <[email protected]>
- Loading branch information
Showing
4 changed files
with
247 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
187 changes: 187 additions & 0 deletions
187
src/test/resources/unit/nvd/feed/nvdcve-1.1-2021_duplicate-cpes.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,187 @@ | ||
| { | ||
| "CVE_data_type": "CVE", | ||
| "CVE_data_format": "MITRE", | ||
| "CVE_data_version": "4.0", | ||
| "CVE_data_numberOfCVEs": "22423", | ||
| "CVE_data_timestamp": "2024-04-30T07:00Z", | ||
| "CVE_Items": [ | ||
| { | ||
| "cve": { | ||
| "data_type": "CVE", | ||
| "data_format": "MITRE", | ||
| "data_version": "4.0", | ||
| "CVE_data_meta": { | ||
| "ID": "CVE-2021-0002", | ||
| "ASSIGNER": "[email protected]" | ||
| }, | ||
| "problemtype": { | ||
| "problemtype_data": [ | ||
| { | ||
| "description": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CWE-754" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| "references": { | ||
| "reference_data": [ | ||
| { | ||
| "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00515.html", | ||
| "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00515.html", | ||
| "refsource": "MISC", | ||
| "tags": [ | ||
| "Vendor Advisory" | ||
| ] | ||
| }, | ||
| { | ||
| "url": "https://security.netapp.com/advisory/ntap-20210827-0008/", | ||
| "name": "https://security.netapp.com/advisory/ntap-20210827-0008/", | ||
| "refsource": "CONFIRM", | ||
| "tags": [ | ||
| "Third Party Advisory" | ||
| ] | ||
| }, | ||
| { | ||
| "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUZYFCI7N4TFZSIGA7WGZ4Q7V3EK76GH/", | ||
| "name": "FEDORA-2021-9807b754d9", | ||
| "refsource": "", | ||
| "tags": [] | ||
| }, | ||
| { | ||
| "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKMUMLUH6ENNMLGTJ5AFRF6764ILEMYJ/", | ||
| "name": "FEDORA-2021-cbad295a90", | ||
| "refsource": "", | ||
| "tags": [] | ||
| }, | ||
| { | ||
| "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFLYHRQPDF6ZMESCI3HRNOP6D6GELPFR/", | ||
| "name": "FEDORA-2021-9818cabe0d", | ||
| "refsource": "", | ||
| "tags": [] | ||
| } | ||
| ] | ||
| }, | ||
| "description": { | ||
| "description_data": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "Improper conditions check in some Intel(R) Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enable information disclosure or denial of service via local access." | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "configurations": { | ||
| "CVE_data_version": "4.0", | ||
| "nodes": [ | ||
| { | ||
| "operator": "AND", | ||
| "children": [ | ||
| { | ||
| "operator": "OR", | ||
| "children": [], | ||
| "cpe_match": [ | ||
| { | ||
| "vulnerable": true, | ||
| "cpe23Uri": "cpe:2.3:o:intel:ethernet_controller_e810_firmware:*:*:*:*:*:linux:*:*", | ||
| "versionEndExcluding": "1.4.11", | ||
| "cpe_name": [] | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "operator": "OR", | ||
| "children": [], | ||
| "cpe_match": [ | ||
| { | ||
| "vulnerable": false, | ||
| "cpe23Uri": "cpe:2.3:h:intel:ethernet_controller_e810:-:*:*:*:*:*:*:*", | ||
| "cpe_name": [] | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "cpe_match": [] | ||
| }, | ||
| { | ||
| "operator": "OR", | ||
| "children": [], | ||
| "cpe_match": [ | ||
| { | ||
| "vulnerable": true, | ||
| "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", | ||
| "cpe_name": [] | ||
| }, | ||
| { | ||
| "vulnerable": true, | ||
| "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", | ||
| "cpe_name": [] | ||
| }, | ||
| { | ||
| "vulnerable": true, | ||
| "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", | ||
| "cpe_name": [] | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "operator": "OR", | ||
| "children": [], | ||
| "cpe_match": [ | ||
| { | ||
| "vulnerable": true, | ||
| "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", | ||
| "cpe_name": [] | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| "impact": { | ||
| "baseMetricV3": { | ||
| "cvssV3": { | ||
| "version": "3.1", | ||
| "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", | ||
| "attackVector": "LOCAL", | ||
| "attackComplexity": "LOW", | ||
| "privilegesRequired": "LOW", | ||
| "userInteraction": "NONE", | ||
| "scope": "UNCHANGED", | ||
| "confidentialityImpact": "HIGH", | ||
| "integrityImpact": "NONE", | ||
| "availabilityImpact": "HIGH", | ||
| "baseScore": 7.1, | ||
| "baseSeverity": "HIGH" | ||
| }, | ||
| "exploitabilityScore": 1.8, | ||
| "impactScore": 5.2 | ||
| }, | ||
| "baseMetricV2": { | ||
| "cvssV2": { | ||
| "version": "2.0", | ||
| "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:P", | ||
| "accessVector": "LOCAL", | ||
| "accessComplexity": "LOW", | ||
| "authentication": "NONE", | ||
| "confidentialityImpact": "PARTIAL", | ||
| "integrityImpact": "NONE", | ||
| "availabilityImpact": "PARTIAL", | ||
| "baseScore": 3.6 | ||
| }, | ||
| "severity": "LOW", | ||
| "exploitabilityScore": 3.9, | ||
| "impactScore": 4.9, | ||
| "acInsufInfo": false, | ||
| "obtainAllPrivilege": false, | ||
| "obtainUserPrivilege": false, | ||
| "obtainOtherPrivilege": false, | ||
| "userInteractionRequired": false | ||
| } | ||
| }, | ||
| "publishedDate": "2021-08-11T13:15Z", | ||
| "lastModifiedDate": "2023-11-07T03:27Z" | ||
| } | ||
| ] | ||
| } |