Merge ~alexmurray/ubuntu-cve-tracker:active-edit-fix-cvss-handling-for-lp2058614 into ubuntu-cve-tracker:master

[Alex Murray]

scripts/active_edit: fix CVSS handling (LP: #2058614)

When specifying CVSS need to specify the source as well as the CVSS vector
string separated by a comma - then also ensure we add the base score and
severity to the CVE file as well.

Signed-off-by: Alex Murray <email address hidden>

[Marc Deslauriers (mdeslaur)]

Didn't try it, but LGTM.

review: Approve

diff --git a/scripts/active_edit b/scripts/active_edit
index cb4beb4..84bdb23 100755
--- a/scripts/active_edit
+++ b/scripts/active_edit
@@ -34,7 +34,7 @@ parser.add_option("-y", "--yes", dest="autoconfirm", help="Do not ask for confir
 parser.add_option("-P", "--public", dest="public_date", help="Record date the CVE went public (default to today in UTC)", metavar="YYYY-MM-DD")
 parser.add_option("--priority", help="Record a priority for the CVE", default=None)
 parser.add_option("-R", "--priority-reason", help="Record a priority reason for the CVE", default=None)
-parser.add_option("-C", "--cvss", help="CVSS3.1 rating", metavar="CVSS:3.1/AV:_/AC:_/PR:_/UI:_/S:_/C:_/I:_/A:_")
+parser.add_option("-C", "--cvss", help="Assigner and CVSS3.1 rating, separated by a comma", metavar="assigner,CVSS:3.1/AV:_/AC:_/PR:_/UI:_/S:_/C:_/I:_/A:_", action="append")
 parser.add_option("-d", "--description", help="Description", default=None)
 (options, args) = parser.parse_args()
 
@@ -259,7 +259,11 @@ def create_or_update_cve(cve, packages, priority=None, bug_urls=None,
             print('CVSS:', file=fp)
             for entry in (cvss if cvss else []):
                 src, cvss = entry
-                print(' %s: %s' % (src, cvss), file=fp)
+                print(' %s: %s [%.1f %s]' %
+                      (src,
+                       cvss["baseMetricV3"]["cvssV3"]["vectorString"],
+                       cvss["baseMetricV3"]["cvssV3"]["baseScore"],
+                       cvss["baseMetricV3"]["cvssV3"]["baseSeverity"]), file=fp)
 
         for p in pkgs:
             add_pkg(p, fp, fixed, None, embargoed, break_fixes)
@@ -277,6 +281,16 @@ def update_file_metadata(metadata, value, cve_fp):
     cve_fp.seek(0)
     cve_fp.writelines(cve_content)
 
+def parse_cvss_options(cvsses):
+    parsed = []
+    for cvss in cvsses:
+        parts = cvss.split(",")
+        if len(parts) != 2:
+            raise ValueError("specified CVSS '%s' does not contain a source" % cvss)
+        source = parts[0]
+        vector = parts[1]
+        parsed.append((source, cve_lib.parse_cvss(vector)))
+    return parsed
 
 pkg_db = cve_lib.load_package_db()
 
@@ -304,5 +318,12 @@ if not pat.search(cve):
         print("Bad CVE entry.  Should be CVE-XXXX-XXXX\n", file=sys.stderr)
     sys.exit(1)
 
+if options.cvss:
+    try:
+        options.cvss = parse_cvss_options(options.cvss)
+    except Exception as e:
+        print("Error parsing CVSS option: %s" % str(e), file=sys.stderr)
+        sys.exit(1)
+
 create_or_update_cve(cve, pkgs, priority=options.priority, bug_urls=options.bug_urls, ref_urls=options.ref_urls, public_date=options.public_date, desc=options.description, cvss=options.cvss, embargoed=options.embargoed, breakfix=options.breakfix, priority_reason=options.priority_reason)
 sys.exit(0)