Merge ~ebarretto/ubuntu-cve-tracker:usn-oval-improvement into ubuntu-cve-tracker:master

[Eduardo Barretto]

This PR solves the following:

1. fix generate OVAL test suite, as it is currently broken
2. update CVE tracker URL in oval generation (and also in test suite)
3. in USN OVAL use usn description instead of summary field
4. add product description, based on binary pocket information, this way we can
mention if a fix is in LTS or available via UA
5. fix generate OVAL test suite because of changes mentioned above

[Alex Murray (alexmurray)]

LGTM in general but I don't love the idea of hard-coding the product name info stuff - and instead would prefer if we can somehow add this into cve_lib directly and look it up via the subprojects configuration.

Also I get one failure when running the end_to_end oval lib test on impish (but the other oval_lib test suites all pass):

[amurray:~/ubuntu … ubuntu-cve-tracker] master(13)+* 14s ± PYTHONPATH=scripts pytest-3 test/test_oval_lib_end_to_end.py
============================================================================================================ test session starts =============================================================================================================
platform linux -- Python 3.9.7, pytest-6.0.2, py-1.10.0, pluggy-0.13.0
rootdir: /home/amurray/ubuntu/git/ubuntu-cve-tracker
collected 4 items

test/test_oval_lib_end_to_end.py ..F. [100%]

================================================================================================================== FAILURES ==================================================================================================================
__________________________________________________________________ TestOvalLibEndToEnd.test_validate_entire_oci_oval[com.ubuntu.bionic.usn.oval.xml-bionic_20180814-bionic] __________________________________________________________________

self = <test_oval_lib_end_to_end.TestOvalLibEndToEnd object at 0x7f98d9e65c10>, dpkg_file = 'com.ubuntu.bionic.usn.oval.xml', manifest = 'bionic_20180814', release = 'bionic'

    @pytest.mark.parametrize("dpkg_file,manifest,release",
         # The timestamped gold manifest oscap output has not been manually
         # checked but it's nice to flag changes to the results of past USNs
         [(util.bionic_dpkg_file, "bionic_20180814", "bionic"),
         (util.trusty_dpkg_file, "trusty_20191107", "trusty")])
    def test_validate_entire_oci_oval(self, dpkg_file, manifest, release):
        """Coherence check of entire generated oci OVAL"""
> util.create_validate_oci(dpkg_file, "{}_full".format(release),
            ["--usn-oval-release", release], manifest, release)

test/test_oval_lib_end_to_end.py:31:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

cls = <class 'test_utils.TestUtilities'>, output_file = 'com.ubuntu.bionic.usn.oval.xml', new_filename = 'bionic_full', oscap_args = ['--usn-oval-release', 'bionic'], manifest = 'bionic_20180814', gold_file = 'bionic'

    @classmethod
    def create_validate_oci(cls, output_file, new_filename, oscap_args,
            manifest, gold_file):
        """Generat...

review: Approve

[Eduardo Barretto (ebarretto)]

hmm, that's odd, the tests here are passing just fine:

$ pytest-3 test/test_oval_lib_end_to_end.py
==================================================================================================================================== test session starts =====================================================================================================================================
platform linux -- Python 3.6.9, pytest-3.3.2, py-1.5.2, pluggy-0.6.0
rootdir: /home/ubuntu/git-pulls/ubuntu-cve-tracker, inifile:
collected 4 items

test/test_oval_lib_end_to_end.py .... [100%]

================================================================================================================================= 4 passed in 148.45 seconds =================================================================================================================================

did you run the tests on top of the branch or did you rebase the branch?
I'm curious on why it is giving different results.

[Steve Beattie (sbeattie)]

On Thu, Nov 04, 2021 at 01:37:57AM -0000, Alex Murray wrote:
> Review: Approve
>
> LGTM in general but I don't love the idea of hard-coding the product name info stuff - and instead would prefer if we can somehow add this into cve_lib directly and look it up via the subprojects configuration.
>
> Also I get one failure when running the end_to_end oval lib test on impish (but the other oval_lib test suites all pass):

I was getting the same failure in the same way, see below for a deep
dive into why and feedback on the generated results:

> [amurray:~/ubuntu … ubuntu-cve-tracker] master(13)+* 14s ± PYTHONPATH=scripts pytest-3 test/test_oval_lib_end_to_end.py
> ============================================================================================================ test session starts =============================================================================================================
> platform linux -- Python 3.9.7, pytest-6.0.2, py-1.10.0, pluggy-0.13.0
> rootdir: /home/amurray/ubuntu/git/ubuntu-cve-tracker
> collected 4 items
>
> test/test_oval_lib_end_to_end.py ..F. [100%]
>
> ================================================================================================================== FAILURES ==================================================================================================================
> __________________________________________________________________ TestOvalLibEndToEnd.test_validate_entire_oci_oval[com.ubuntu.bionic.usn.oval.xml-bionic_20180814-bionic] __________________________________________________________________
>
> self = <test_oval_lib_end_to_end.TestOvalLibEndToEnd object at 0x7f98d9e65c10>, dpkg_file = 'com.ubuntu.bionic.usn.oval.xml', manifest = 'bionic_20180814', release = 'bionic'
>
> @pytest.mark.parametrize("dpkg_file,manifest,release",
> # The timestamped gold manifest oscap output has not been manually
> # checked but it's nice to flag changes to the results of past USNs
> [(util.bionic_dpkg_file, "bionic_20180814", "bionic"),
> (util.trusty_dpkg_file, "trusty_20191107", "trusty")])
> def test_validate_entire_oci_oval(self, dpkg_file, manifest, release):
> """Coherence check of entire generated oci OVAL"""
> > util.create_validate_oci(dpkg_file, "{}_full".format(release),
> ["--usn-oval-release", release], manifest, release)
>
> test/test_oval_lib_end_to_end.py:31:
> _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
>
> cls = <class 'test_utils.TestUtilities'>, output_file = 'com.ubuntu.bionic.usn.oval.xml', new_f...

[Eduardo Barretto (ebarretto)]

On Tue, Nov 09, 2021 at 03:06:31AM -0800, Steve Beattie wrote:
> On Thu, Nov 04, 2021 at 01:37:57AM -0000, Alex Murray wrote:
> > Review: Approve
> >
> > LGTM in general but I don't love the idea of hard-coding the product name info stuff - and instead would prefer if we can somehow add this into cve_lib directly and look it up via the subprojects configuration.
> >
> > Also I get one failure when running the end_to_end oval lib test on impish (but the other oval_lib test suites all pass):
>
> I was getting the same failure in the same way, see below for a deep
> dive into why and feedback on the generated results:
>

Thanks for debugging it. I've a few comments below.

> > [amurray:~/ubuntu … ubuntu-cve-tracker] master(13)+* 14s ± PYTHONPATH=scripts pytest-3 test/test_oval_lib_end_to_end.py
> > ============================================================================================================ test session starts =============================================================================================================
> > platform linux -- Python 3.9.7, pytest-6.0.2, py-1.10.0, pluggy-0.13.0
> > rootdir: /home/amurray/ubuntu/git/ubuntu-cve-tracker
> > collected 4 items
> >
> > test/test_oval_lib_end_to_end.py ..F. [100%]
> >
> > ================================================================================================================== FAILURES ==================================================================================================================
> > __________________________________________________________________ TestOvalLibEndToEnd.test_validate_entire_oci_oval[com.ubuntu.bionic.usn.oval.xml-bionic_20180814-bionic] __________________________________________________________________
> >
> > self = <test_oval_lib_end_to_end.TestOvalLibEndToEnd object at 0x7f98d9e65c10>, dpkg_file = 'com.ubuntu.bionic.usn.oval.xml', manifest = 'bionic_20180814', release = 'bionic'
> >
> > @pytest.mark.parametrize("dpkg_file,manifest,release",
> > # The timestamped gold manifest oscap output has not been manually
> > # checked but it's nice to flag changes to the results of past USNs
> > [(util.bionic_dpkg_file, "bionic_20180814", "bionic"),
> > (util.trusty_dpkg_file, "trusty_20191107", "trusty")])
> > def test_validate_entire_oci_oval(self, dpkg_file, manifest, release):
> > """Coherence check of entire generated oci OVAL"""
> > > util.create_validate_oci(dpkg_file, "{}_full".format(release),
> > ["--usn-oval-release", release], manifest, release)
> >
> > test/test_oval_lib_end_to_end.py:31:
> > _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ...

[Steve Beattie (sbeattie)]

Hi,

The changes in:

  1e13b6edc8 ("Fix test test_create_dict_from_cve_file")

On Fri, Oct 29, 2021 at 03:13:31PM -0000, Eduardo Barretto wrote:
> <advisory <email address hidden>">
> <severity>Medium</severity>
> - <issued date="2020-06-09"/>
> + <issued date="2020-06-10"/>
> <ref>https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SRBDS</ref>
> </advisory>

> <advisory <email address hidden>">
> <severity>Medium</severity>
> - <issued date="2020-06-09"/>
> + <issued date="2020-06-10"/>
> <ref>https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SRBDS</ref>
> </advisory>

ends up breaking the tests:

  TestOvalLibUnit::test_create_usn_definition
  TestOvalLibUnit::test_invalid_priority_usn_definition

for me. The problem is that oval_lib.py::create_usn_definition()
pulls the published timestamp from the USN db via
datetime.datetime.fromtimestamp without a timezone, so python converts
it to your local timezone.

The right way to fix this is to set the timezone
to datetime.timezone.utc explicitly as an argument to
datetime.datetime.fromtimestamp() but python2.7 doesn't have that
and makes it non-trivial to use a tzinfo timezone without using a
third-party library.

Converting oval_lib.py to use datetime.datetime.utcfromtimestamp()
instead would likely address this in the short term, but people
*should* be using oval info from the public vm where python3 is used.

Thanks.

--
Steve Beattie
<email address hidden>

[Steve Beattie (sbeattie)]

On Tue, Nov 09, 2021 at 01:19:24PM +0100, Eduardo Barretto wrote:
> On Tue, Nov 09, 2021 at 03:06:31AM -0800, Steve Beattie wrote:
> > On Thu, Nov 04, 2021 at 01:37:57AM -0000, Alex Murray wrote:
> > - The origin for each of the fix/USN is pulled from the product
> > description and ignores the significant effort Emi and Paulo have
> > gone through to annotate in all our USNs where each individual binary
> > can pulled from (security or esm-infra), which leads to USNs that
> > were published when trusty was still in LTS status being marked as
> > available from UA Infra.
> >
>
> Feel free to correct me here, but this is something that I discussed with
> Paulo during this development, as a lot of trusty USNs didn't have a pocket
> information, and I had to work around it in the code. According to Paulo,
> they didn't include information to trusty as the UA client doesn't support
> trusty. Also, he said this would be easy to be pushed if needed, so we could
> try to fix this before merging this branch.

Oh, I totally missed that this is happening for trusty only, because I
was debugging the trusty end-to-end tests. Okay, I can
live with that. It would be good to have a xenial end-to-end test in
that case as well.

(I would like to push the logic encapsulated in
OvalGeneratorUSN.get_product_description() out of that
class/oval_lib.py so that if other tools need to rely on the same
logic, they can get access to it in a more central place. But I'm
not entirely sure what the interface for it should look like.)

--
Steve Beattie
<email address hidden>

[Eduardo Barretto (ebarretto)]

On Mon, Nov 15, 2021 at 07:54:53AM -0800, Steve Beattie wrote:
> On Tue, Nov 09, 2021 at 01:19:24PM +0100, Eduardo Barretto wrote:
> > On Tue, Nov 09, 2021 at 03:06:31AM -0800, Steve Beattie wrote:
> > > On Thu, Nov 04, 2021 at 01:37:57AM -0000, Alex Murray wrote:
> > > - The origin for each of the fix/USN is pulled from the product
> > > description and ignores the significant effort Emi and Paulo have
> > > gone through to annotate in all our USNs where each individual binary
> > > can pulled from (security or esm-infra), which leads to USNs that
> > > were published when trusty was still in LTS status being marked as
> > > available from UA Infra.
> > >
> >
> > Feel free to correct me here, but this is something that I discussed with
> > Paulo during this development, as a lot of trusty USNs didn't have a pocket
> > information, and I had to work around it in the code. According to Paulo,
> > they didn't include information to trusty as the UA client doesn't support
> > trusty. Also, he said this would be easy to be pushed if needed, so we could
> > try to fix this before merging this branch.
>
> Oh, I totally missed that this is happening for trusty only, because I
> was debugging the trusty end-to-end tests. Okay, I can
> live with that. It would be good to have a xenial end-to-end test in
> that case as well.
>
> (I would like to push the logic encapsulated in
> OvalGeneratorUSN.get_product_description() out of that
> class/oval_lib.py so that if other tools need to rely on the same
> logic, they can get access to it in a more central place. But I'm
> not entirely sure what the interface for it should look like.)

Ack! I will take a look at it, it might be a good idea to have this is in cve_lib.
I will try to come up with something.

Regarding my previous email that I mentioned about testing on Nessus to see
if the description looks correct. Unfortunately I couldn't because Nessus free
version doesn't allow to read OVAL files. Do we have a paid Nessus instance
anywhere at Canonical?

[Steve Beattie (sbeattie)]

FYI, so far I have merged or cherry-picked into master the following commits:

  2b3442c1e2 ("test_utils: Indent")
  335af7c6ad ("Fix gold_oci_results bionic data")
  1e13b6edc8 ("Fix test test_create_dict_from_cve_file")

I also applied the commit from

  https://code.launchpad.net/~ebarretto/ubuntu-cve-tracker/+git/ubuntu-cve-tracker/+merge/411027

that was to replace the commit:

  28e9604767 ("Fix test oval definition_mock and invalid_priority_ret")

but had to revert it because it turned out python2 was being used in an unexpected place (and the fix requires python3), but I'm hoping to be able to get that use converted to python3 shortly, so I can put the fix back in place.

I'll also continue to push through cherry-picking more of the commits that are okay to apply.

46f74ad... by Eduardo Barretto on 2021-11-17

cve_lib: Add description to subprojects

06eeeb2... by Eduardo Barretto on 2021-11-17

cve_lib: Add function get_subproject_description and also retrieve the

description for a external subproject

[Eduardo Barretto (ebarretto)]

I've rebased the commits to address:
1. removed commit ("Fix test oval definition_mock and invalid_priority_ret"), as discussed this is UTC related issue, so it isn't needed and will affect test results for others.
2. move the product description to cve_lib. Added it as part of the subprojects/releases. As Alex suggested, I will be pushing a change to the customer-ppa-tracking with the following: https://pastebin.canonical.com/p/H6Dcbd86QM/
3. Rebased oval_lib and the tests because of #2

[Alex Murray (alexmurray)]

Thanks for the product description changes @ebarretto but I can't see any changes to cve_lib in the diff here or in any of the commits - did you push the changes?

[Steve Beattie (sbeattie)]

On Wed, Nov 17, 2021 at 11:20:20PM -0000, Alex Murray wrote:
> Thanks for the product description changes @ebarretto but I can't see any changes to cve_lib in the diff here or in any of the commits - did you push the changes?

I think it accidentally got pushed as a branch on the team repo,
rather than a rebased (force-)push to the branch in @ebarretto's
launchpad repo.

--
Steve Beattie
<email address hidden>

[Eduardo Barretto (ebarretto)]

Oh sorry about that, I've just pushed to the right place.

On Wed, Nov 17, 2021 at 11:30:39PM -0000, Steve Beattie wrote:
> On Wed, Nov 17, 2021 at 11:20:20PM -0000, Alex Murray wrote:
> > Thanks for the product description changes @ebarretto but I can't see any changes to cve_lib in the diff here or in any of the commits - did you push the changes?
>
> I think it accidentally got pushed as a branch on the team repo,
> rather than a rebased (force-)push to the branch in @ebarretto's
> launchpad repo.
>
> --
> Steve Beattie
> <email address hidden>
>
> https://code.launchpad.net/~ebarretto/ubuntu-cve-tracker/+git/ubuntu-cve-tracker/+merge/411027
> You are the owner of ~ebarretto/ubuntu-cve-tracker:usn-oval-improvement.
>

[Alex Murray (alexmurray)]

Thanks - one small comment on the new function for cve_lib - also I wonder about the name "Regular Release" - should this perhaps be "Standard Release" or "Interim Release" (I am not sure if we have a proper name to refer to the non-LTS releases but I am not sure "Regular" is the right word here) - perhaps just "Standard Support Release"?

[Eduardo Barretto (ebarretto)]

On Thu, Nov 18, 2021 at 10:56:52PM -0000, Alex Murray wrote:
> Thanks - one small comment on the new function for cve_lib - also I wonder about the name "Regular Release" - should this perhaps be "Standard Release" or "Interim Release" (I am not sure if we have a proper name to refer to the non-LTS releases but I am not sure "Regular" is the right word here) - perhaps just "Standard Support Release"?

I'm not a big fan on the Regular Release name, but I actually got it from: https://wiki.ubuntu.com/Releases
"Regular releases are supported for 9 months."

Depending on what we want to name it, we might need to revisit our external communications.

>
> Diff comments:
>
> > diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
> > index fd714cf..6e63d0a 100755
> > --- a/scripts/cve_lib.py
> > +++ b/scripts/cve_lib.py
> > @@ -374,6 +413,17 @@ def release_alias(rel):
> > pass
> > return alias
> >
> > +def get_subproject_description(rel):
> > + """Return the description for a given release."""
> > + _, _, _, details = get_subproject_details(rel)
> > + if details:
> > + try:
> > + description = details["description"]
> > + except KeyError:
> > + print("Subproject does not have a descrition.", file=sys.stderr)
> > + return description
>
> description will be unbound if the details does not contain one - also we don't usually print errors in cve_lib from what I recall... should this return an empty string perhaps if none is found? Or 'None'?
>

I can either do a 'pass' or raise the Exception, we actually have a bit of everything in cve_lib,
including printing.
Maybe 'pass' is enough as it won't stop execution. Just let me know what you think is best and
I will adjust accordingly :)

> > +
> > +
> > def get_external_subproject_cve_dir(subproject):
> > """Get the directory where CVE files are stored for the subproject.
> >
>
>
> --
> https://code.launchpad.net/~ebarretto/ubuntu-cve-tracker/+git/ubuntu-cve-tracker/+merge/411027
> You are the owner of ~ebarretto/ubuntu-cve-tracker:usn-oval-improvement.
>

[Alex Murray (alexmurray)]

Cool, let's not bikeshed on the naming - stick with Regular Release then. Also whilst I would love to move to using actual Exceptions more I found with some other updates I did which tried to raise them in more scenarios that it broke too much other stuff that wasn't written to expect them to be raised - so probably better to silently pass it and return None or an empty string I guess (depending on how the calling code expects the return value to look - ie if it is checking for None then return it)

[Seth Arnold (seth-arnold)]

On Mon, Nov 22, 2021 at 09:30:53AM -0000, Eduardo Barretto wrote:
> On Thu, Nov 18, 2021 at 10:56:52PM -0000, Alex Murray wrote:
> > Thanks - one small comment on the new function for cve_lib - also I
> > wonder about the name "Regular Release" - should this perhaps be
> > "Standard Release" or "Interim Release" (I am not sure if we have a
> > proper name to refer to the non-LTS releases but I am not sure
> > "Regular" is the right word here) - perhaps just "Standard Support
> > Release"?
>
> I'm not a big fan on the Regular Release name, but I actually got it from: https://wiki.ubuntu.com/Releases
> "Regular releases are supported for 9 months."

This page uses "Interim release" https://ubuntu.com/about/release-cycle
and it feels more likely to have been reviewed by marketing / brand
specialists than the wiki page :)

[Eduardo Barretto (ebarretto)]

Just rebased and pushed moving "Regular Release" to "Interim Release" as suggested by Seth. Thanks!
And made a pass in the description and set description to "?" as this was the previous comment in our oval files.

[Alex Murray (alexmurray)]

LGTM, thanks!

review: Approve

[Eduardo Barretto (ebarretto)]

Thanks, just merged it

diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index fd714cf..359ba25 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -101,6 +101,7 @@ subprojects = {
         "alias": "precise/esm",
         "ppa": "ubuntu-esm/esm",
         "parent": "ubuntu/precise",
+        "description": "Available with UA Infra or UA Desktop",
     },
     "esm/trusty": {
         "eol": False,
@@ -109,6 +110,7 @@ subprojects = {
         "alias": "trusty/esm",
         "ppa": "ubuntu-esm/esm-infra-security",
         "parent": "ubuntu/trusty",
+        "description": "Available with UA Infra or UA Desktop",
     },
     "esm-infra/xenial": {
         "eol": False,
@@ -117,187 +119,224 @@ subprojects = {
         "name": "Ubuntu 16.04 ESM (Xenial Xerus)",
         "ppa": "ubuntu-esm/esm-infra-security",
         "parent": "ubuntu/xenial",
+        "description": "Available with UA Infra or UA Desktop",
     },
     "ubuntu/warty": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "warty",
+        "description": "Interim Release",
     },
     "ubuntu/hoary": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "hoary",
+        "description": "Interim Release",
     },
     "ubuntu/breezy": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "breezy",
+        "description": "Interim Release",
     },
     "ubuntu/dapper": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "dapper",
+        "description": "Long Term Support",
     },
     "ubuntu/edgy": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "edgy",
+        "description": "Interim Release",
     },
     "ubuntu/feisty": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "feisty",
+        "description": "Interim Release",
     },
     "ubuntu/gutsy": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "gutsy",
+        "description": "Interim Release",
     },
     "ubuntu/hardy": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "hardy",
+        "description": "Long Term Support",
     },
     "ubuntu/intrepid": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "intrepid",
+        "description": "Interim Release",
     },
     "ubuntu/jaunty": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "jaunty",
+        "description": "Interim Release",
     },
     "ubuntu/karmic": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "karmic",
+        "description": "Interim Release",
     },
     "ubuntu/lucid": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "lucid",
+        "description": "Long Term Support",
     },
     "ubuntu/maverick": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "maverick",
+        "description": "Interim Release",
     },
     "ubuntu/natty": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "natty",
+        "description": "Interim Release",
     },
     "ubuntu/oneiric": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "oneiric",
+        "description": "Interim Release",
     },
     "ubuntu/precise": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "precise",
+        "description": "Long Term Support",
     },
     "ubuntu/quantal": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "quantal",
+        "description": "Interim Release",
     },
     "ubuntu/raring": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "raring",
+        "description": "Interim Release",
     },
     "ubuntu/saucy": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "saucy",
+        "description": "Interim Release",
     },
     "ubuntu/trusty": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "trusty",
+        "description": "Long Term Support",
     },
     "ubuntu/utopic": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "utopic",
+        "description": "Interim Release",
     },
     "ubuntu/vivid": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "vivid",
+        "description": "Interim Release",
     },
     "ubuntu/wily": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "wily",
+        "description": "Interim Release",
     },
     "ubuntu/xenial": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "xenial",
+        "description": "Long Term Support",
     },
     "ubuntu/yakkety": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "yakkety",
+        "description": "Interim Release",
     },
     "ubuntu/zesty": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "zesty",
+        "description": "Interim Release",
     },
     "ubuntu/artful": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "artful",
+        "description": "Interim Release",
     },
     "ubuntu/bionic": {
         "eol": False,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "bionic",
+        "description": "Long Term Support",
     },
     "ubuntu/cosmic": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "cosmic",
+        "description": "Interim Release",
     },
     "ubuntu/disco": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "disco",
+        "description": "Interim Release",
     },
     "ubuntu/eoan": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "eoan",
+        "description": "Interim Release",
     },
     "ubuntu/focal": {
         "eol": False,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "focal",
+        "description": "Long Term Support",
     },
     "ubuntu/groovy": {
         "eol": True,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "groovy",
+        "description": "Interim Release",
     },
     "ubuntu/hirsute": {
         "eol": False,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "hirsute",
+        "description": "Interim Release",
     },
     "ubuntu/impish": {
         "eol": False,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "impish",
+        "description": "Interim Release",
     },
     "ubuntu/jammy": {
         "eol": False,
         "components": ["main", "restricted", "universe", "multiverse", "partner"],
         "alias": "jammy",
         "devel": True,  # there can be only one ⚔
+        "description": "Long Term Support",
     },
     "snap": {
         "eol": False,
@@ -374,6 +413,19 @@ def release_alias(rel):
             pass
     return alias
 
+def get_subproject_description(rel):
+    """Return the description for a given release."""
+    description = "?"
+    _, _, _, details = get_subproject_details(rel)
+    if details:
+        try:
+            description = details["description"]
+        except KeyError:
+            pass
+
+    return description
+
+
 def get_external_subproject_cve_dir(subproject):
     """Get the directory where CVE files are stored for the subproject.
 
@@ -462,6 +514,7 @@ def load_external_subprojects():
             # subproject settings
             config = read_external_subproject_config(rel)
             subprojects[rel].setdefault("ppa", config["ppa"])
+            subprojects[rel].setdefault("description", config["description"])
             subprojects[rel].setdefault("parent", config["parent"])
         except:
             pass
diff --git a/scripts/oval_lib.py b/scripts/oval_lib.py
index c01f986..fb89f71 100644
--- a/scripts/oval_lib.py
+++ b/scripts/oval_lib.py
@@ -28,7 +28,7 @@ import sys
 import tempfile
 import collections
 
-from cve_lib import load_cve
+from cve_lib import load_cve, get_subproject_description
 from cve_lib import parse_cvss as cvss_score
 
 from xml.sax.saxutils import escape
@@ -743,11 +743,7 @@ class OvalGeneratorUSN():
         usn_severity = self.get_usn_severity([self.priorities[cve['Priority']]
                                                         for cve in cves_info])
 
-        # Bugged USN sometimes has isummary others don't
-        if 'isummary' in usn_object:
-            summary_info = usn_object['isummary']
-        else:
-            summary_info = usn_object['summary']
+        product_description = get_subproject_description(self.release_codename)
 
         mapping = {
             'id': id_base,
@@ -756,7 +752,7 @@ class OvalGeneratorUSN():
             'title': "{} -- {}".format(usn_object['id'], usn_object['title']),
             'plataform': "Ubuntu {}".format(self.release['desc']),
             'usn_url': self.usn_base_url.format(usn_object['id']),
-            'description': ' '.join(summary_info.strip().split('\n')),
+            'description': escape(' '.join(usn_object['description'].strip().split('\n'))),
             'cves_references': cve_references,
             'bug_references': bug_references,
             'severity': usn_severity,
@@ -767,7 +763,7 @@ class OvalGeneratorUSN():
         # convert number versions of binary pkgs into test criteria
         criteria = []
         for test_ref in test_refs:
-            criteria.append('<criterion test_ref="{0}:tst:{1}" comment="?" />'.format(self.ns, test_ref['testref_id']))
+            criteria.append('<criterion test_ref="{0}:tst:{1}" comment="{2}" />'.format(self.ns, test_ref['testref_id'], product_description))
         mapping['criteria'] = '\n              '.join(criteria)
 
         definition = \
@@ -794,39 +790,41 @@ class OvalGeneratorUSN():
 
         return definition
 
-    def create_usn_test(self, id_base):
+    def create_usn_test(self, id_base, product):
         mapping = {
             'id': id_base,
             'ns': self.ns,
+            'product': product,
         }
 
         if self.oval_format == 'dpkg':
             test = \
         """
-        <linux:dpkginfo_test id="{ns}:tst:{id}" version="1" check_existence="at_least_one_exists" check="at least one" comment="?">
+        <linux:dpkginfo_test id="{ns}:tst:{id}" version="1" check_existence="at_least_one_exists" check="at least one" comment="{product}">
           <linux:object object_ref="{ns}:obj:{id}"/>
           <linux:state state_ref="{ns}:ste:{id}"/>
         </linux:dpkginfo_test>""".format(**mapping)
         else:
             test = \
         """
-        <ind:textfilecontent54_test id="{ns}:tst:{id}" version="1" check_existence="at_least_one_exists" check="at least one" comment="?">
+        <ind:textfilecontent54_test id="{ns}:tst:{id}" version="1" check_existence="at_least_one_exists" check="at least one" comment="{product}">
           <ind:object object_ref="{ns}:obj:{id}"/>
           <ind:state state_ref="{ns}:ste:{id}"/>
         </ind:textfilecontent54_test>""".format(**mapping)
 
         return test
 
-    def create_usn_object(self, id_base):
+    def create_usn_object(self, id_base, product):
         mapping = {
             'id': id_base,
             'ns': self.ns,
+            'product': product,
         }
 
         if self.oval_format == 'dpkg':
             _object = \
         """
-        <linux:dpkginfo_object id="{ns}:obj:{id}" version="1">
+        <linux:dpkginfo_object id="{ns}:obj:{id}" version="1" comment="{product}">
           <linux:name var_ref="{ns}:var:{id}" var_check="at least one" />
         </linux:dpkginfo_object>""".format(**mapping)
         else:
@@ -835,7 +833,7 @@ class OvalGeneratorUSN():
 
             _object = \
         """
-        <ind:textfilecontent54_object id="{ns}:obj:{id}" version="1">
+        <ind:textfilecontent54_object id="{ns}:obj:{id}" version="1" comment="{product}">
           <ind:path>{path}</ind:path>
           <ind:filename>manifest</ind:filename>
           <ind:pattern operation="pattern match" datatype="string" var_ref="{ns}:var:{id}" var_check="at least one" />
@@ -844,10 +842,11 @@ class OvalGeneratorUSN():
 
         return _object
 
-    def create_usn_state(self, binary_version, id_base):
+    def create_usn_state(self, binary_version, id_base, product):
         mapping = {
             'id': id_base,
             'ns': self.ns,
+            'product': product,
         }
 
         if self.oval_format == 'dpkg':
@@ -858,7 +857,7 @@ class OvalGeneratorUSN():
 
             state = \
         """
-        <linux:dpkginfo_state id="{ns}:ste:{id}" version="1">
+        <linux:dpkginfo_state id="{ns}:ste:{id}" version="1" comment="{product}">
           <linux:evr datatype="evr_string" operation="less than">{bversion}</linux:evr>
         </linux:dpkginfo_state>""".format(**mapping)
 
@@ -867,13 +866,13 @@ class OvalGeneratorUSN():
 
             state = \
         """
-        <ind:textfilecontent54_state id="{ns}:ste:{id}" version="1">
+        <ind:textfilecontent54_state id="{ns}:ste:{id}" version="1" comment="{product}">
           <ind:subexpression datatype="evr_string" operation="less than">{bversion}</ind:subexpression>
         </ind:textfilecontent54_state>""".format(**mapping)
 
         return state
 
-    def create_usn_variable(self, id_base, binaries_list):
+    def create_usn_variable(self, id_base, binaries_list, product):
         values = ""
         if self.oval_format == 'dpkg':
             for binary in binaries_list:
@@ -889,12 +888,13 @@ class OvalGeneratorUSN():
         mapping = {
             'id': id_base,
             'ns': self.ns,
-            'values': values.strip()
+            'values': values.strip(),
+            'product': product,
         }
 
         constant_variable = \
         """
-        <constant_variable id="{ns}:var:{id}" version="1" datatype="string" comment="?">
+        <constant_variable id="{ns}:var:{id}" version="1" datatype="string" comment="{product}">
             {values}
         </constant_variable>""".format(**mapping)
 
@@ -999,6 +999,8 @@ class OvalGeneratorUSN():
 
         binary_versions = self.get_version_from_binaries(usn_allbinaries)
 
+        product_description = get_subproject_description(self.release_codename)
+
         # group binaries with same version (most likely from same source)
         # and create a test_ref for the group to be used when creating
         # the oval def, test, state and var.
@@ -1016,10 +1018,10 @@ class OvalGeneratorUSN():
         self.oval_structure['definition'].write(usn_def)
 
         for test_ref in test_refs:
-            usn_test = self.create_usn_test(test_ref['testref_id'])
-            usn_obj = self.create_usn_object(test_ref['testref_id'])
-            usn_state = self.create_usn_state(test_ref['version'], test_ref['testref_id'])
-            usn_variable = self.create_usn_variable(test_ref['testref_id'], test_ref['pkgs'])
+            usn_test = self.create_usn_test(test_ref['testref_id'], product_description)
+            usn_obj = self.create_usn_object(test_ref['testref_id'], product_description)
+            usn_state = self.create_usn_state(test_ref['version'], test_ref['testref_id'], product_description)
+            usn_variable = self.create_usn_variable(test_ref['testref_id'], test_ref['pkgs'], product_description)
 
             self.oval_structure['test'].write(usn_test)
             self.oval_structure['object'].write(usn_obj)
diff --git a/test/test_oval_lib_unit.py b/test/test_oval_lib_unit.py
index b904fcb..8444bde 100644
--- a/test/test_oval_lib_unit.py
+++ b/test/test_oval_lib_unit.py
@@ -57,13 +57,18 @@ class TestOvalLibUnit:
         ['linux-image-oem-osp1'], '5.0.0-1042.43':
         ['linux-image-5.0.0-1042-gke']}
 
-    test_refs_mock = [{'version': '5.0.0.1042.27', 'pkgs':
-        ['linux-image-gke-5.0'], 'testref_id': '438810000000'}, {'version':
-        '5.0.0-1059.64', 'pkgs': ['linux-image-5.0.0-1059-oem-osp1'],
-        'testref_id': '438810000010'}, {'version': '5.0.0.1059.58', 'pkgs':
-        ['linux-image-oem-osp1'], 'testref_id': '438810000020'}, {'version':
-        '5.0.0-1042.43', 'pkgs': ['linux-image-5.0.0-1042-gke'], 'testref_id':
-        '438810000030'}]
+    test_refs_mock = [{'version': '5.0.0.1042.27',
+                       'pkgs': ['linux-image-gke-5.0'],
+                       'testref_id': '438810000000'},
+                      {'version': '5.0.0-1059.64',
+                       'pkgs': ['linux-image-5.0.0-1059-oem-osp1'],
+                       'testref_id': '438810000010'},
+                      {'version': '5.0.0.1059.58',
+                       'pkgs': ['linux-image-oem-osp1'],
+                       'testref_id': '438810000020'},
+                      {'version': '5.0.0-1042.43',
+                       'pkgs': ['linux-image-5.0.0-1042-gke'],
+                       'testref_id': '438810000030'}]
 
     definition_mock = """
         <definition id="oval:com.ubuntu.bionic:def:43881000000" version="1" class="patch">
@@ -79,7 +84,11 @@ class TestOvalLibUnit:
               <reference source="CVE" ref_url="https://ubuntu.com/security/CVE-2020-12464" ref_id="CVE-2020-12464"/>
               <reference source="CVE" ref_url="https://ubuntu.com/security/CVE-2020-12659" ref_id="CVE-2020-12659"/>
               <reference source="CVE" ref_url="https://ubuntu.com/security/CVE-2020-1749" ref_id="CVE-2020-1749"/>
+<<<<<<< test/test_oval_lib_unit.py
               <description>Several security issues were fixed in the Linux kernel.</description>
+=======
+              <description>It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2020-0067)  It was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processor cores. A local attacker could use this to expose sensitive information. (CVE-2020-0543)  Piotr Krysiuk discovered that race conditions existed in the file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12114)  It was discovered that the USB susbsystem's scatter-gather implementation in the Linux kernel did not properly take data references in some situations, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12464)  Bui Quang Minh discovered that the XDP socket implementation in the Linux kernel did not properly validate meta-data passed from user space, leading to an out-of-bounds write vulnerability. A local attacker with the CAP_NET_ADMIN capability could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12659)  Xiumei Mu discovered that the IPSec implementation in the Linux kernel did not properly encrypt IPv6 traffic in some situations. An attacker could use this to expose sensitive information. (CVE-2020-1749)</description>
+>>>>>>> test/test_oval_lib_unit.py
               <advisory from="[e-mail]">
                  <severity>Medium</severity>
                  <issued date="2020-06-09"/>
@@ -87,10 +96,10 @@ class TestOvalLibUnit:
               </advisory>
            </metadata>
            <criteria operator="OR">
-              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000000" comment="?" />
-              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000010" comment="?" />
-              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000020" comment="?" />
-              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000030" comment="?" />
+              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000000" comment="Long Term Support" />
+              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000010" comment="Long Term Support" />
+              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000020" comment="Long Term Support" />
+              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000030" comment="Long Term Support" />
            </criteria>
         </definition>"""
 
@@ -102,55 +111,55 @@ class TestOvalLibUnit:
               <reference source="CVE" ref_url="https://ubuntu.com/security/CVE-2020-1749" ref_id="CVE-2020-1749"/>"""
 
     test_mock = ["""
-        <linux:dpkginfo_test id="oval:com.ubuntu.bionic:tst:438810000000" version="1" check_existence="at_least_one_exists" check="at least one" comment="?">
+        <linux:dpkginfo_test id="oval:com.ubuntu.bionic:tst:438810000000" version="1" check_existence="at_least_one_exists" check="at least one" comment="Long Term Support">
           <linux:object object_ref="oval:com.ubuntu.bionic:obj:438810000000"/>
           <linux:state state_ref="oval:com.ubuntu.bionic:ste:438810000000"/>
         </linux:dpkginfo_test>""",
         """
-        <linux:dpkginfo_test id="oval:com.ubuntu.bionic:tst:438810000010" version="1" check_existence="at_least_one_exists" check="at least one" comment="?">
+        <linux:dpkginfo_test id="oval:com.ubuntu.bionic:tst:438810000010" version="1" check_existence="at_least_one_exists" check="at least one" comment="Long Term Support">
           <linux:object object_ref="oval:com.ubuntu.bionic:obj:438810000010"/>
           <linux:state state_ref="oval:com.ubuntu.bionic:ste:438810000010"/>
         </linux:dpkginfo_test>
 """,
         """
-        <linux:dpkginfo_test id="oval:com.ubuntu.bionic:tst:438810000020" version="1" check_existence="at_least_one_exists" check="at least one" comment="?">
+        <linux:dpkginfo_test id="oval:com.ubuntu.bionic:tst:438810000020" version="1" check_existence="at_least_one_exists" check="at least one" comment="Long Term Support">
           <linux:object object_ref="oval:com.ubuntu.bionic:obj:438810000020"/>
           <linux:state state_ref="oval:com.ubuntu.bionic:ste:438810000020"/>
         </linux:dpkginfo_test>
 """,
         """
-        <linux:dpkginfo_test id="oval:com.ubuntu.bionic:tst:438810000030" version="1" check_existence="at_least_one_exists" check="at least one" comment="?">
+        <linux:dpkginfo_test id="oval:com.ubuntu.bionic:tst:438810000030" version="1" check_existence="at_least_one_exists" check="at least one" comment="Long Term Support">
           <linux:object object_ref="oval:com.ubuntu.bionic:obj:438810000030"/>
           <linux:state state_ref="oval:com.ubuntu.bionic:ste:438810000030"/>
         </linux:dpkginfo_test>
 """]
 
     test_oci_mock = """
-        <ind:textfilecontent54_test id="oval:com.ubuntu.bionic:tst:445310000000" version="1" check_existence="at_least_one_exists" check="at least one" comment="?">
+        <ind:textfilecontent54_test id="oval:com.ubuntu.bionic:tst:445310000000" version="1" check_existence="at_least_one_exists" check="at least one" comment="Long Term Support">
           <ind:object object_ref="oval:com.ubuntu.bionic:obj:445310000000"/>
           <ind:state state_ref="oval:com.ubuntu.bionic:ste:445310000000"/>
         </ind:textfilecontent54_test>"""
 
 
     obj_mock = ["""
-        <linux:dpkginfo_object id="oval:com.ubuntu.bionic:obj:438810000000" version="1">
+        <linux:dpkginfo_object id="oval:com.ubuntu.bionic:obj:438810000000" version="1" comment="Long Term Support">
           <linux:name var_ref="oval:com.ubuntu.bionic:var:438810000000" var_check="at least one" />
         </linux:dpkginfo_object>""",
         """
-        <linux:dpkginfo_object id="oval:com.ubuntu.bionic:obj:438810000010" version="1">
+        <linux:dpkginfo_object id="oval:com.ubuntu.bionic:obj:438810000010" version="1" comment="Long Term Support">
           <linux:name var_ref="oval:com.ubuntu.bionic:var:438810000010" var_check="at least one" />
         </linux:dpkginfo_object>""",
         """
-        <linux:dpkginfo_object id="oval:com.ubuntu.bionic:obj:438810000020" version="1">
+        <linux:dpkginfo_object id="oval:com.ubuntu.bionic:obj:438810000020" version="1" comment="Long Term Support">
           <linux:name var_ref="oval:com.ubuntu.bionic:var:438810000020" var_check="at least one" />
         </linux:dpkginfo_object>""",
         """
-        <linux:dpkginfo_object id="oval:com.ubuntu.bionic:obj:438810000030" version="1">
+        <linux:dpkginfo_object id="oval:com.ubuntu.bionic:obj:438810000030" version="1" comment="Long Term Support">
           <linux:name var_ref="oval:com.ubuntu.bionic:var:438810000030" var_check="at least one" />
         </linux:dpkginfo_object>"""]
 
     obj_oci_mock = """
-        <ind:textfilecontent54_object id="oval:com.ubuntu.bionic:obj:445310000000" version="1">
+        <ind:textfilecontent54_object id="oval:com.ubuntu.bionic:obj:445310000000" version="1" comment="Long Term Support">
           <ind:path>.</ind:path>
           <ind:filename>manifest</ind:filename>
           <ind:pattern operation="pattern match" datatype="string" var_ref="oval:com.ubuntu.bionic:var:445310000000" var_check="at least one" />
@@ -158,51 +167,51 @@ class TestOvalLibUnit:
         </ind:textfilecontent54_object>"""
 
     state_mock = ["""
-        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:438810000000" version="1">
+        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:438810000000" version="1" comment="Long Term Support">
           <linux:evr datatype="evr_string" operation="less than">0:5.0.0.1042.27</linux:evr>
         </linux:dpkginfo_state>""",
         """
-        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:438810000010" version="1">
+        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:438810000010" version="1" comment="Long Term Support">
           <linux:evr datatype="evr_string" operation="less than">0:5.0.0-1059.64</linux:evr>
         </linux:dpkginfo_state>""",
         """
-        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:438810000020" version="1">
+        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:438810000020" version="1" comment="Long Term Support">
           <linux:evr datatype="evr_string" operation="less than">0:5.0.0.1059.58</linux:evr>
         </linux:dpkginfo_state>""",
         """
-        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:438810000030" version="1">
+        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:438810000030" version="1" comment="Long Term Support">
           <linux:evr datatype="evr_string" operation="less than">0:5.0.0-1042.43</linux:evr>
         </linux:dpkginfo_state>"""]
 
     state_epoch_mock = """
-        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:437210000000" version="1">
+        <linux:dpkginfo_state id="oval:com.ubuntu.bionic:ste:437210000000" version="1" comment="Long Term Support">
           <linux:evr datatype="evr_string" operation="less than">1:4.2-3ubuntu6.1</linux:evr>
         </linux:dpkginfo_state>"""
 
     state_oci_mock = """
-        <ind:textfilecontent54_state id="oval:com.ubuntu.bionic:ste:438810000000" version="1">
+        <ind:textfilecontent54_state id="oval:com.ubuntu.bionic:ste:438810000000" version="1" comment="Long Term Support">
           <ind:subexpression datatype="evr_string" operation="less than">5.0.0.1042.27</ind:subexpression>
         </ind:textfilecontent54_state>"""
 
     var_mock = ["""
-        <constant_variable id="oval:com.ubuntu.bionic:var:438810000000" version="1" datatype="string" comment="?">
+        <constant_variable id="oval:com.ubuntu.bionic:var:438810000000" version="1" datatype="string" comment="Long Term Support">
             <value>linux-image-gke-5.0</value>
         </constant_variable>""",
         """
-        <constant_variable id="oval:com.ubuntu.bionic:var:438810000010" version="1" datatype="string" comment="?">
+        <constant_variable id="oval:com.ubuntu.bionic:var:438810000010" version="1" datatype="string" comment="Long Term Support">
             <value>linux-image-5.0.0-1059-oem-osp1</value>
         </constant_variable>""",
         """
-        <constant_variable id="oval:com.ubuntu.bionic:var:438810000020" version="1" datatype="string" comment="?">
+        <constant_variable id="oval:com.ubuntu.bionic:var:438810000020" version="1" datatype="string" comment="Long Term Support">
             <value>linux-image-oem-osp1</value>
         </constant_variable>""",
         """
-        <constant_variable id="oval:com.ubuntu.bionic:var:438810000030" version="1" datatype="string" comment="?">
+        <constant_variable id="oval:com.ubuntu.bionic:var:438810000030" version="1" datatype="string" comment="Long Term Support">
             <value>linux-image-5.0.0-1042-gke</value>
         </constant_variable>"""]
 
     var_oci_mock = """
-        <constant_variable id="oval:com.ubuntu.bionic:var:438810000000" version="1" datatype="string" comment="?">
+        <constant_variable id="oval:com.ubuntu.bionic:var:438810000000" version="1" datatype="string" comment="Long Term Support">
             <value>^linux-image-gke-5.0\s+(.*)</value>
         </constant_variable>"""
 
@@ -211,12 +220,14 @@ class TestOvalLibUnit:
         'linux-image-oem-osp1': {'version': '5.0.0.1059.58'},
         'linux-image-5.0.0-1042-gke': {'version': '5.0.0-1042.43'}}
 
-    state_args_mock = [["5.0.0.1042.27", "438810000000"], ["5.0.0-1059.64",
-        "438810000010"], ["5.0.0.1059.58", "438810000020"], ["5.0.0-1042.43",
-        "438810000030"]]
-    var_args_mock = [["438810000000", ['linux-image-gke-5.0']],
-        ["438810000010", ['linux-image-5.0.0-1059-oem-osp1']], ["438810000020",
-        ['linux-image-oem-osp1']], ["438810000030", ['linux-image-5.0.0-1042-gke']]]
+    state_args_mock = [["5.0.0.1042.27", "438810000000", "Long Term Support"],
+                       ["5.0.0-1059.64", "438810000010", "Long Term Support"],
+                       ["5.0.0.1059.58", "438810000020", "Long Term Support"],
+                       ["5.0.0-1042.43", "438810000030", "Long Term Support"]]
+    var_args_mock = [["438810000000", ['linux-image-gke-5.0'], "Long Term Support"],
+                     ["438810000010", ['linux-image-5.0.0-1059-oem-osp1'], "Long Term Support"],
+                     ["438810000020", ['linux-image-oem-osp1'], "Long Term Support"],
+                     ["438810000030", ['linux-image-5.0.0-1042-gke'], "Long Term Support"]]
 
     cves_list_mock = ['CVE-2020-0067', 'CVE-2020-0543', 'CVE-2020-12114',
         'CVE-2020-12464', 'CVE-2020-12659', 'CVE-2020-1749']
@@ -272,7 +283,11 @@ class TestOvalLibUnit:
               </affected>
               <reference source="USN" ref_url="https://ubuntu.com/security/notices/USN-4388-1" ref_id="USN-4388-1"/>
               <reference source="CVE" ref_url="https://ubuntu.com/security/CVE-2020-0067" ref_id="CVE-2020-0067"/>
+<<<<<<< test/test_oval_lib_unit.py
               <description>Several security issues were fixed in the Linux kernel.</description>
+=======
+              <description>It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2020-0067)  It was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processor cores. A local attacker could use this to expose sensitive information. (CVE-2020-0543)  Piotr Krysiuk discovered that race conditions existed in the file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12114)  It was discovered that the USB susbsystem's scatter-gather implementation in the Linux kernel did not properly take data references in some situations, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12464)  Bui Quang Minh discovered that the XDP socket implementation in the Linux kernel did not properly validate meta-data passed from user space, leading to an out-of-bounds write vulnerability. A local attacker with the CAP_NET_ADMIN capability could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12659)  Xiumei Mu discovered that the IPSec implementation in the Linux kernel did not properly encrypt IPv6 traffic in some situations. An attacker could use this to expose sensitive information. (CVE-2020-1749)</description>
+>>>>>>> test/test_oval_lib_unit.py
               <advisory from="[e-mail]">
                  <severity>Medium</severity>
                  <issued date="2020-06-09"/>
@@ -280,10 +295,10 @@ class TestOvalLibUnit:
               </advisory>
            </metadata>
            <criteria operator="OR">
-              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000000" comment="?" />
-              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000010" comment="?" />
-              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000020" comment="?" />
-              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000030" comment="?" />
+              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000000" comment="Long Term Support" />
+              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000010" comment="Long Term Support" />
+              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000020" comment="Long Term Support" />
+              <criterion test_ref="oval:com.ubuntu.bionic:tst:438810000030" comment="Long Term Support" />
            </criteria>
         </definition>"""
 
@@ -517,26 +532,29 @@ class TestOvalLibUnit:
 
         assert definition_ret == self.invalid_priority_ret
 
-    @pytest.mark.parametrize("oval_mock,usn_id,ret_mock", [(oval_gen_mock,
-        438810000000, test_mock[0]), (oval_gen_mock_oci, 445310000000,
-            test_oci_mock)])
-    def test_create_usn_test(self, oval_mock, usn_id, ret_mock):
+    @pytest.mark.parametrize("oval_mock,usn_id,prod_description,ret_mock",
+                             [(oval_gen_mock, 438810000000, "Long Term Support", test_mock[0]),
+                              (oval_gen_mock_oci, 445310000000, "Long Term Support", test_oci_mock)])
+    def test_create_usn_test(self, oval_mock, usn_id, prod_description, ret_mock):
         test_ret = oval_lib.OvalGeneratorUSN.create_usn_test(
-            oval_mock, usn_id)
+            oval_mock, usn_id, prod_description)
 
         assert test_ret == ret_mock
 
-    @pytest.mark.parametrize("oval_mock,usn_id,ret_mock", [(oval_gen_mock,
-        438810000000, obj_mock[0]), (oval_gen_mock_oci, 445310000000, obj_oci_mock)])
-    def test_create_usn_obj(self, oval_mock, usn_id, ret_mock):
+    @pytest.mark.parametrize("oval_mock,usn_id,prod_description,ret_mock",
+                             [(oval_gen_mock, 438810000000, "Long Term Support", obj_mock[0]),
+                              (oval_gen_mock_oci, 445310000000, "Long Term Support", obj_oci_mock)])
+    def test_create_usn_obj(self, oval_mock, usn_id, prod_description, ret_mock):
         test_ret = oval_lib.OvalGeneratorUSN.create_usn_object(oval_mock,
-                usn_id)
+                usn_id, prod_description)
 
         assert test_ret == ret_mock
 
-    @pytest.mark.parametrize("oval_mock,args_mock,ret_mock", [(oval_gen_mock,
-        state_args_mock[0], state_mock[0]), (oval_gen_mock, ["1:4.2-3ubuntu6.1", "437210000000"],
-            state_epoch_mock), (oval_gen_mock_oci, state_args_mock[0], state_oci_mock)])
+    @pytest.mark.parametrize("oval_mock,args_mock,ret_mock",
+                             [(oval_gen_mock, state_args_mock[0], state_mock[0]),
+                              (oval_gen_mock, ["1:4.2-3ubuntu6.1", "437210000000",
+                                               "Long Term Support"], state_epoch_mock),
+                              (oval_gen_mock_oci, state_args_mock[0], state_oci_mock)])
     def test_create_usn_state(self, oval_mock, args_mock, ret_mock):
         test_ret = oval_lib.OvalGeneratorUSN.create_usn_state(
             oval_mock, *args_mock)
@@ -566,9 +584,10 @@ class TestOvalLibUnit:
         #Set up dummy vals
         oval_gen_mock = MockOvalGeneratorUSN()
 
-        test_refs_id_calls = [mock.call(oval_gen_mock, "438810000000"),
-            mock.call(oval_gen_mock, "438810000010"), mock.call(oval_gen_mock,
-            "438810000020"), mock.call(oval_gen_mock, "438810000030")]
+        test_refs_id_calls = [mock.call(oval_gen_mock, "438810000000", "Long Term Support"),
+                              mock.call(oval_gen_mock, "438810000010", "Long Term Support"),
+                              mock.call(oval_gen_mock, "438810000020", "Long Term Support"),
+                              mock.call(oval_gen_mock, "438810000030", "Long Term Support")]
         state_calls = [mock.call(oval_gen_mock, *item)
             for item in self.state_args_mock]
         var_calls = [mock.call(oval_gen_mock, *item)