Merge ~emitorino/ubuntu-cve-tracker:add_cvss_score_to_ubuntu_table into ubuntu-cve-tracker:master

[Emilia Torino]

- ubuntu_table: add new optional arg to display the NVD provided CVSS score
- cve_lib.py: support getting package component for esm releases
- report-todo-nvd-plot: add script to report outstanding cves based on nvd cvss

acd8454... by Emilia Torino on 2021-11-13

Only getting the original release name if current rel is an active esm release

Signed-off-by: Maria Emilia Torino <email address hidden>

[Alex Murray (alexmurray)]

Thanks for looking into this Emi - the general concept seems fine but a bunch of things can be cleaned up (ie can use the baseSeverity directly from the existing CVSS parsing in cve_lib plus I am not sure we should have some of the other behavioural changes here...

review: Needs Fixing

[Emilia Torino (emitorino)]

I dont think we need this anymore since this was needed for metrics purposes and now we have specific code for this. I am rejecting this MP. Thanks Eduardo for the heads up

Unmerged commits

acd8454... by Emilia Torino on 2021-11-13

Only getting the original release name if current rel is an active esm release

Signed-off-by: Maria Emilia Torino <email address hidden>

86ae092... by Emilia Torino on 2021-11-13

Add support for CVSS rating into ubuntu table

Signed-off-by: Maria Emilia Torino <email address hidden>

diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index fd714cf..4e2cd10 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -1884,6 +1884,8 @@ def is_supported(map, pkg, rel, cvedata=None):
        ('universe-binary' in cvedata['tags'][pkg] or
         'not-ue' in cvedata['tags'][pkg]):
         return False
+    if is_active_esm_release(rel):
+        rel = get_orig_rel_name(rel)
     # Look for a supported component
     if rel in map and pkg in map[rel] and \
        (map[rel][pkg]['section'] == 'main' or
diff --git a/scripts/report-todo-nvd-plot b/scripts/report-todo-nvd-plot
new file mode 100755
index 0000000..482ea08
--- /dev/null
+++ b/scripts/report-todo-nvd-plot
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+# Author: Emilia Torino <[e-mail]>
+# Copyright (C) 2021 Canonical Ltd.
+#
+# This script is distributed under the terms and conditions of the GNU General
+# Public License, Version 2 or later. See http://www.gnu.org/copyleft/gpl.html
+# for details.
+
+# Reports a terse numeric of CVEs that need attention for supported packages considering
+# the nvd CVSS scoring system.
+TABLE=$(./scripts/ubuntu-table "$@")
+for category in ${CATEGORY:-SUPPORTED}
+do
+  if [ "x$category" = "xuniverse" ]; then
+    filter="-v '(SUPPORTED|PARTNER)'"
+  elif [ "x$category" = "xesm" ]; then
+    filter=""
+  else
+    filter=$category
+  fi
+  # ESM releases does not need to be filtered since ubuntu-table
+  # does not report the SUPPORTED/UNIVERSE value properly and
+  # we query universe and main differently with this script args
+  if [ -n "$filter" ]; then
+    TABLE=$(echo "$TABLE" | grep $filter)
+  fi
+
+  for nvd_prio in nvd_critical nvd_high nvd_medium nvd_low
+  do
+    # make sure we don't count each CVE more than once by sorting on unique CVE id
+    NVD_COUNT=$(echo "$TABLE" | grep "$nvd_prio" | cut -d" " -f1 | sort -u | wc -l)
+    NVD_OUT="$NVD_OUT$NVD_COUNT "
+  done
+  if [ -n "$OUT" ]; then
+    NVD_COUNT=$(echo "$TABLE" | cut -d" " -f2 | cut -d: -f1 | sort -u | wc -l)
+    NVD_OUT="$NVD_OUT$NVD_COUNT"
+  fi
+  echo "$NVD_OUT"
+done
diff --git a/scripts/ubuntu-table b/scripts/ubuntu-table
index e64e200..aa0b563 100755
--- a/scripts/ubuntu-table
+++ b/scripts/ubuntu-table
@@ -28,13 +28,15 @@ map = source_map.load()
 releases = list(cve_lib.all_releases)
 
 
-def htmlTableHeader(show_crd=False, show_assignee=False):
+def htmlTableHeader(show_crd=False, show_assignee=False, show_nvd_cvss=False):
     header = "<thead class=\"thead-dark\">\n"
     header += '<tr><th>CVE</th><th>Package</th>'
     if show_crd:
         header += '<th>CRD</th>'
     if show_assignee:
         header += '<th>Assigned To</th>'
+    if show_nvd_cvss:
+        header += '<th>CVSS</th>'
     for rel in releases:
         name = rel
         header += "<th>%s</th>" % (cve_lib.release_names[name])
@@ -43,6 +45,19 @@ def htmlTableHeader(show_crd=False, show_assignee=False):
     return header
 
 
+def nvd_rating(cvss_string):
+    parsed_cvss = cve_lib.parse_cvss(cvss_string)
+    base_score = parsed_cvss['baseMetricV3']['cvssV3']['baseScore']
+    rating = "nvd_low"
+    if 9 <= base_score <= 10:
+        rating= "nvd_critical"
+    elif 7 <= base_score < 9:
+        rating= "nvd_high"
+    elif 4 <= base_score < 7:
+        rating= "nvd_medium"
+    return rating
+
+
 parser = optparse.OptionParser()
 parser.add_option("-H", "--html", help="Output html", action="store_true")
 parser.add_option("-r", "--all-releases", help="Show details for all releases not just those in releases_list in ~/.ubuntu-security-tools.conf", action="store_true")
@@ -67,6 +82,7 @@ parser.add_option("--public-date", help="Show only packages with a CRD date newe
 parser.add_option("--omit-header", help="Suppress printing the releases header", action="store_true")
 parser.add_option("--show-crd", help="Show CRD", action="store_true")
 parser.add_option("--show-assignee", help="Show who the CVE is assigned to", action="store_true")
+parser.add_option("--show-nvd-cvss", help="Show the CVE CVSS score in the format used by NVD", action="store_true")
 parser.add_option("--omit-status", help="Omit per-release status", action="store_true", default=False)
 parser.add_option("--subproject", help="Show CVE status for a subproject", action="append", default=[])
 (opt, args) = parser.parse_args()
@@ -148,7 +164,7 @@ else:
 
 if opt.html:
     print('<table id="cves" class="table table-bordered table-hover">')
-    print(htmlTableHeader(opt.show_crd, opt.show_assignee))
+    print(htmlTableHeader(opt.show_crd, opt.show_assignee, opt.show_nvd_cvss))
     print("<tbody>\n")
 else:
     prefix = '%-35s'
@@ -156,12 +172,16 @@ else:
     crdformat = '%24s'
     assigneeformat = '%11s'
     relformat = '%14s'
+    # nvd_css score is nvd_<priority> where maximum is nvd_critical
+    cvssformat = '%12s'
     if not opt.omit_header:
         print(prefix % ' ', end=' ')
         if opt.show_crd:
             print(crdformat % 'CRD', end=' ')
         if opt.show_assignee:
             print(assigneeformat % 'Assigned To', end=' ')
+        if opt.show_nvd_cvss:
+            print(cvssformat % 'CVSS', end=' ')
         if not opt.omit_status:
             for rel in releases:
                 if '/' in rel:
@@ -294,6 +314,17 @@ for cve in sorted(cves):
                 if opt.show_assignee:
                     assignee = cveinfo[cve]['Assigned-to']
                     print('<td class="assignee">%s</td>' % (escape(assignee)), end=' ')
+                if opt.show_nvd_cvss:
+                    rating = ""
+                    try:
+                        cvss = cveinfo[cve]['CVSS']
+                        for cvss_source in cvss:
+                            source, value= cvss_source
+                            if source == 'nvd':
+                                rating = nvd_rating(value)
+                    except Exception as e:
+                        rating = ""
+                    print('<td class="cvss">%s</td>' % (escape(rating)), end=' ')
 
                 for rel in releases:
                     if mark[rel] != '*':
@@ -323,8 +354,21 @@ for cve in sorted(cves):
                 if opt.show_assignee:
                     assignee = cveinfo[cve]['Assigned-to']
                     print(assigneeformat % assignee, end=' ')
+                if opt.show_nvd_cvss:
+                    rating = ""
+                    try:
+                        cvss = cveinfo[cve]['CVSS']
+                        for cvss_source in cvss:
+                            source, value = cvss_source
+                            if source == 'nvd':
+                                rating = nvd_rating(value)
+                    except Exception as e:
+                        rating = ""
+                    print(cvssformat % rating, end=' ')
                 if not opt.omit_status:
                     for rel in releases:
+                        if mark[rel] != '*':
+                            universe = True
                         pkg_status = table[cve][pkg][rel]
                         if not opt.unmask_needed and table[cve][pkg][rel] in ['active', 'deferred']:
                             pkg_status = 'needed'