Merge ~emitorino/ubuntu-cve-tracker:detect_priority_mismatch into ubuntu-cve-tracker:master

[Emilia Torino]

- scripts/detect_priorities_mismatches.py: add script to load CVEs and detect when the Ubuntu priority deviates from the CVSS score
- scripts/active_edit: support setting the priority reason only
- cve_lib: allow to load table only for CVEs published after certain date

This new script can be run like:

$ python3 scripts/detect_priorities_mismatches.py --published-since 2024-01-01

It detects CVEs which their Ubuntu priority deviates from the CVSS score and after displaying basic information, it allow to set the Priority reason in an interactive mode. This requires that the cvss information in $UCT is updated (i.e. ./scripts/process_cves refresh-cvss is previously run). This is not a hard requirement, but ideal.

The idea of this MP is to discuss this implementation. Further testing and checks are still required

[Steve Beattie (sbeattie)]

Hey Emi, I gave this a try and this is a good direction for the workflow. I appreciated the addition of the number of CVEs that need a priority explanation, I tweaked it a bit to report that out of the total number of CVEs examined within the given time period, with the following diff:

--- a/scripts/detect_priorities_mismatches.py
+++ b/scripts/detect_priorities_mismatches.py
@@ -59,7 +59,7 @@ if __name__ == "__main__":

     if cves_with_mismatches:
         total_cves_to_process = len(cves_with_mismatches)
- print(f"\n==== Listing {total_cves_to_process} CVEs with Ubuntu Priority different than CVSS base severity ====")
+ print(f"\n==== Listing {total_cves_to_process} CVEs (out of {len(full_cves_information)}) with Ubuntu Priority different than CVSS base severity
 ====")
         for index, cve in enumerate(cves_with_mismatches):
             print(f"\n=========== {index + 1}/{total_cves_to_process}: {cve} ===========")
             print(cves_with_mismatches[cve]['Description'])

which results in output like so since the beginning of 2024 based on current UCT as of now:

==== Listing 246 CVEs (out of 477) with Ubuntu Priority different than CVSS base severity ====

In examining the CVEs that popped up, I found that I ended up opening up the CVE file to examine the reference links and bug reports to dig into more details about each CVE.

Something you might consider is how check-cves reports the options available to the user at https://git.launchpad.net/ubuntu-cve-tracker/tree/scripts/check-cves#n1101 ; I don't think it needs to be as verbose, but the ways of indicating which key to press and what the default is if one simply presses enter may be useful.

I would like a way to generate a non-interactive report of CVEs that need action.

One thing that might be nice is instead of having the published_since argument to load_table(), take a criteria function as an argument, where the function expects to be passed a CVE and return True or False to include it, allowing use of different criteria besides being published after a given date as options to load_table(). You could then have load_table_published_since() if you wanted that the detect_priorities_mismatch.py calls that under the hood invokes load_table() with a criteria function that looks for published dates after the passed date.

[Emilia Torino (emitorino)]

> Hey Emi, I gave this a try and this is a good direction for the workflow. I
> appreciated the addition of the number of CVEs that need a priority
> explanation, I tweaked it a bit to report that out of the total number of CVEs
> examined within the given time period, with the following diff:
>
> --- a/scripts/detect_priorities_mismatches.py
> +++ b/scripts/detect_priorities_mismatches.py
> @@ -59,7 +59,7 @@ if __name__ == "__main__":
>
> if cves_with_mismatches:
> total_cves_to_process = len(cves_with_mismatches)
> - print(f"\n==== Listing {total_cves_to_process} CVEs with Ubuntu
> Priority different than CVSS base severity ====")
> + print(f"\n==== Listing {total_cves_to_process} CVEs (out of
> {len(full_cves_information)}) with Ubuntu Priority different than CVSS base
> severity
> ====")
> for index, cve in enumerate(cves_with_mismatches):
> print(f"\n=========== {index + 1}/{total_cves_to_process}: {cve}
> ===========")
> print(cves_with_mismatches[cve]['Description'])
>
> which results in output like so since the beginning of 2024 based on current
> UCT as of now:
>
> ==== Listing 246 CVEs (out of 477) with Ubuntu Priority different than CVSS
> base severity ====

Thanks for the diff. It's very insightful. I have applied it https://git.launchpad.net/~emitorino/ubuntu-cve-tracker/commit/?id=e99397b8cddba3e9eb89222ce1782fe625fd3da7

>
> In examining the CVEs that popped up, I found that I ended up opening up the
> CVE file to examine the reference links and bug reports to dig into more
> details about each CVE.
>
> Something you might consider is how check-cves reports the options available
> to the user at https://git.launchpad.net/ubuntu-cve-
> tracker/tree/scripts/check-cves#n1101 ; I don't think it needs to be as
> verbose, but the ways of indicating which key to press and what the default is
> if one simply presses enter may be useful.
>
> I would like a way to generate a non-interactive report of CVEs that need
> action.
>
> One thing that might be nice is instead of having the published_since argument
> to load_table(), take a criteria function as an argument, where the function
> expects to be passed a CVE and return True or False to include it, allowing
> use of different criteria besides being published after a given date as
> options to load_table(). You could then have load_table_published_since() if
> you wanted that the detect_priorities_mismatch.py calls that under the hood
> invokes load_table() with a criteria function that looks for published dates
> after the passed date.

Thanks for the feedback! I will work on the suggestions.

[Alex Murray (alexmurray)]

Thanks for this @emitorino - I wonder if we should put some of this logic into cve_lib itself (or perhaps some other "common" library) so that it can be shared with check-syntax since ideally we would have check-syntax enforce this check as well. Thoughts?

[Emilia Torino (emitorino)]

> Thanks for this @emitorino - I wonder if we should put some of this logic into
> cve_lib itself (or perhaps some other "common" library) so that it can be
> shared with check-syntax since ideally we would have check-syntax enforce this
> check as well. Thoughts?

Hey Alex, sure thing! this was indeed recommended already by eslerm and pfsmorigo.
Once we are happy with the UX of this, I will definitely refactor and consider this. Thanks!

[Steve Beattie (sbeattie)]

One thing we talked about was adding tags that could either be indicators for the priority assessing role, or could be expanded into the explanation itself. A really simple sample of the data store for this could look something like:

diff --git a/meta_lists/priority_explanations.yaml b/meta_lists/priority_explanations.yaml
new file mode 100644
index 00000000000..868d5011dca
--- /dev/null
+++ b/meta_lists/priority_explanations.yaml
@@ -0,0 +1,7 @@
+# standardized priority reason text
+# tag/keyword based, so that we can add the tags as part of triage and
+# re-triage to make it easier to generate.
+---
+kernel-debugfs: |
+ Exploitation requires write access to debugfs entries, which are
+ restricted to root by default on Ubuntu kernels.

[Emilia Torino (emitorino)]

> One thing we talked about was adding tags that could either be indicators for
> the priority assessing role, or could be expanded into the explanation itself.
> A really simple sample of the data store for this could look something like:
>
> diff --git a/meta_lists/priority_explanations.yaml
> b/meta_lists/priority_explanations.yaml
> new file mode 100644
> index 00000000000..868d5011dca
> --- /dev/null
> +++ b/meta_lists/priority_explanations.yaml
> @@ -0,0 +1,7 @@
> +# standardized priority reason text
> +# tag/keyword based, so that we can add the tags as part of triage and
> +# re-triage to make it easier to generate.
> +---
> +kernel-debugfs: |
> + Exploitation requires write access to debugfs entries, which are
> + restricted to root by default on Ubuntu kernels.

Added in https://git.launchpad.net/~emitorino/ubuntu-cve-tracker/commit/?id=8c994d7350484b43b72b876a84764548185a00db

I also added:

1) the capability to filter CVEs published until a provided date https://git.launchpad.net/~emitorino/ubuntu-cve-tracker/commit/?id=0ada37ceebc83e7ad345e8a45f15bbd22e1082af. So this combined with --published-since can allow to filter by a range

2) The support for non-interactive (i.e. tmpfile) mode https://git.launchpad.net/~emitorino/ubuntu-cve-tracker/commit/?id=44f9c8be7a6aef70ce65bcec4caf46b35259469f

[Steve Beattie (sbeattie)]

Thanks Emi. I went ahead and merged this branch, after trying to ensure that the changes to active_edit were safe (but hit LP: #2058614 in the existing code).

One issue I hit with the non-interactive mode is, in testing in particular the some recenet kernel CVEs, the descriptions include code related things, including C pointers, which the interpreter tried to parse as a command and failed. To reproduce:

$ ./scripts/detect_priorities_mismatches.py --packages linux --published-since 2024-02-01
[... text elided ...]
=========== 12/18: CVE-2024-26589 ===========
In the Linux kernel, the following vulnerability has been resolved: bpf:
Reject variable offset alu on PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KEYS,
check_flow_keys_access() only uses fixed off for validation. However,
variable offset ptr alu is not prohibited for this ptr kind. So the
variable offset is not checked. The following prog is accepted: func#0 @0
0: R1=ctx() R10=fp0 0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx() 1: (79) r7 =
*(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ;
[... rest elided ...]

which results in:

============================ Summary =============================
18 CVEs needing priority reason
0 CVEs processed:
 - 0 skipped CVE(s)
 - 0 CVE(s) automatically updated with their corresponding reasons
 - 0 CVE(s) opened in editor for manual edit
 - 1 issue(s)
 - #425: Invalid CVE ID format: *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ;

So likely we need to indent the description and any other fields that might have lines that start with '*'.

(I think this is why the experimental triage interface prefixes all the information as comments / '#'; then the processor can ignore any such lines, rather than worrying about individual fields of info colliding with actions.)

review: Approve

diff --git a/meta_lists/priority_explanations.yaml b/meta_lists/priority_explanations.yaml
new file mode 100644
index 0000000..868d501
--- /dev/null
+++ b/meta_lists/priority_explanations.yaml
@@ -0,0 +1,7 @@
+# standardized priority reason text
+# tag/keyword based, so that we can add the tags as part of triage and
+# re-triage to make it easier to generate.
+---
+kernel-debugfs: |
+  Exploitation requires write access to debugfs entries, which are
+  restricted to root by default on Ubuntu kernels.
diff --git a/scripts/active_edit b/scripts/active_edit
index a0e0efa..cb4beb4 100755
--- a/scripts/active_edit
+++ b/scripts/active_edit
@@ -33,6 +33,7 @@ parser.add_option("-e", "--embargoed", dest="embargoed", help="This is an embarg
 parser.add_option("-y", "--yes", dest="autoconfirm", help="Do not ask for confirmation", action="store_true")
 parser.add_option("-P", "--public", dest="public_date", help="Record date the CVE went public (default to today in UTC)", metavar="YYYY-MM-DD")
 parser.add_option("--priority", help="Record a priority for the CVE", default=None)
+parser.add_option("-R", "--priority-reason", help="Record a priority reason for the CVE", default=None)
 parser.add_option("-C", "--cvss", help="CVSS3.1 rating", metavar="CVSS:3.1/AV:_/AC:_/PR:_/UI:_/S:_/C:_/I:_/A:_")
 parser.add_option("-d", "--description", help="Description", default=None)
 (options, args) = parser.parse_args()
@@ -164,17 +165,18 @@ def add_pkg(p, fp, fixed, parent, embargoed, break_fixes):
 
 def create_or_update_cve(cve, packages, priority=None, bug_urls=None,
                          ref_urls=None, public_date=None, desc=None,
-                         cvss=None, embargoed=False, breakfix=False):
-
+                         cvss=None, embargoed=False, breakfix=False,
+                         priority_reason=None):
     pkgs = []
     break_fixes = []
     fixed = {}
     # parse optional fixed_in release and version from package name
-    for p in packages:
-        tmp_p = p.split(',')
-        pkg = tmp_p[0]
-        pkgs.append(pkg)
-        fixed[pkg] = tmp_p[1:]
+    if packages:
+        for p in packages:
+            tmp_p = p.split(',')
+            pkg = tmp_p[0]
+            pkgs.append(pkg)
+            fixed[pkg] = tmp_p[1:]
 
     update = False
     try:
@@ -219,8 +221,10 @@ def create_or_update_cve(cve, packages, priority=None, bug_urls=None,
     if not embargoed and not public_date:
         public_date = datetime.now(timezone.utc).strftime("%Y-%m-%d")
 
-    if update:
+    if update and not priority_reason:
         mode = "a"
+    elif update and priority_reason:
+        mode = "r+"
     else:
         mode = "x"
     with open(dst, mode, encoding="utf-8") as fp:
@@ -245,8 +249,10 @@ def create_or_update_cve(cve, packages, priority=None, bug_urls=None,
             for url in (bug_urls if bug_urls else []):
                 print(" %s" % url, file=fp)
             priority_text = priority if priority else "untriaged"
-            if priority in cve_lib.PRIORITY_REASON_REQUIRED:
+            if priority in cve_lib.PRIORITY_REASON_REQUIRED and not priority_reason:
                 priority_text += "\n XXX-Reason-XXX"
+            elif priority and priority_reason:
+                priority_text += f"\n {priority_reason}"
             print('Priority: %s' % priority_text, file=fp)
             print('Discovered-by:', file=fp)
             print('Assigned-to:', file=fp)
@@ -257,14 +263,22 @@ def create_or_update_cve(cve, packages, priority=None, bug_urls=None,
 
         for p in pkgs:
             add_pkg(p, fp, fixed, None, embargoed, break_fixes)
+        if priority_reason:
+            metadata_to_update = "Priority:"
+            update_file_metadata(metadata_to_update, priority_reason, fp)
 
 
+def update_file_metadata(metadata, value, cve_fp):
+    cve_content = cve_fp.readlines()
+    for cve_line_number, cve_line in enumerate (cve_content):
+        if cve_line.startswith(metadata):
+            # TODO: check length + wrap lines + existing reason
+            cve_content[cve_line_number] += f" {value}\n"
+    cve_fp.seek(0)
+    cve_fp.writelines(cve_content)
 
-pkg_db = cve_lib.load_package_db()
 
-if not options.pkgs:
-    parser.print_help()
-    sys.exit(1)
+pkg_db = cve_lib.load_package_db()
 
 if not options.cve:
     parser.print_help()
@@ -290,5 +304,5 @@ if not pat.search(cve):
         print("Bad CVE entry.  Should be CVE-XXXX-XXXX\n", file=sys.stderr)
     sys.exit(1)
 
-create_or_update_cve(cve, pkgs, priority=options.priority, bug_urls=options.bug_urls, ref_urls=options.ref_urls, public_date=options.public_date, desc=options.description, cvss=options.cvss, embargoed=options.embargoed, breakfix=options.breakfix)
+create_or_update_cve(cve, pkgs, priority=options.priority, bug_urls=options.bug_urls, ref_urls=options.ref_urls, public_date=options.public_date, desc=options.description, cvss=options.cvss, embargoed=options.embargoed, breakfix=options.breakfix, priority_reason=options.priority_reason)
 sys.exit(0)
diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index 95c8f65..7aeb4dd 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -29,6 +29,9 @@ from uct.config import read_uct_config
 from functools import reduce
 from functools import lru_cache
 
+CVE_FILTER_NAME = "cve_filter_name"
+CVE_FILTER_ARGS = "cve_filter_args"
+
 def set_cve_dir(path):
     '''Return a path with CVEs in it. Specifically:
        - if 'path' has CVEs in it, return path
@@ -2576,12 +2579,52 @@ def load_all(cves, uems, rcves=[]):
         table.setdefault(cve, info)
     return table
 
+# Get CVE date information only, in the format of "%Y-%m-%d"
+def parse_cve_pub_date(cve_public_date_from_file):
+    cve_public_date = None
+    date_only = cve_public_date_from_file.split()[0]
+    if date_only != "unknown":
+        try:
+            cve_public_date = datetime.datetime.strptime(date_only, "%Y-%m-%d")
+        except ValueError as e:
+            print(f"WARN: Invalid CVE PublicDate: {date_only}. {e}")
+    return cve_public_date
+
+
+def cve_published_since(cve_info, published_since):
+    cve_public_date = parse_cve_pub_date(cve_info['PublicDate'])
+    return cve_public_date and cve_public_date > published_since
+
+
+def cve_published_until(cve_info, published_until):
+    cve_public_date = parse_cve_pub_date(cve_info['PublicDate'])
+    return cve_public_date and cve_public_date < published_until
+
+
+def cve_published_in_range(cve_info, published_since, published_until):
+    return cve_published_since(cve_info, published_since) and cve_published_until(cve_info, published_until)
 
-# supported options
+
+def cve_affecting_pkgs(cve_info, packages):
+    # removing whitespaces, if they exist before cchecking
+    cve_affected_packages = [x.strip(' ') for x in cve_info['pkgs']]
+    packages_in_filter = [x.strip(' ') for x in packages]
+    return [pkg for pkg in packages_in_filter if pkg in cve_affected_packages]
+
+
+def cve_in_list(cve_info, cve_list):
+    cve_id = cve_info["id"]
+    return cve_id in cve_list
+
+
+
+# supported options for opt argument
 #  pkgfamily = rename linux-source-* packages to "linux", or "xen-*" to "xen"
 #  packages = list of packages to pay attention to
 #  debug = bool, display debug information
-def load_table(cves, uems, opt=None, rcves=[], icves=[]):
+
+#  filters = list of functions and , only load CVEs matching the filters criteria
+def load_table(cves, uems, opt=None, rcves=[], icves=[], filters=None):
     table = dict()
     priority = dict()
     listcves = []
@@ -2599,6 +2642,21 @@ def load_table(cves, uems, opt=None, rcves=[], icves=[]):
             cvedir = ignored_dir
         cvefile = os.path.join(cvedir, cve)
         info = load_cve(cvefile)
+        # Allowing to filter cves based on a list of filter functions
+        # with their corresponding args
+        filters_matched = True
+        for filter in filters:
+            filter_name = filter[CVE_FILTER_NAME]
+            filter_args = filter[CVE_FILTER_ARGS]
+            # always adding cve_info to any filter function its needed
+            info["id"] = cve
+            filter_args["cve_info"] = info
+            if not filter_name(**filter_args):
+                filters_matched = False
+                break
+        if not filters_matched:
+            # Skipping CVEs which have not matched provided filters, if any
+            continue
         cveinfo[cve] = info
 
         # Allow for Priority overrides
diff --git a/scripts/detect_priorities_mismatches.py b/scripts/detect_priorities_mismatches.py
new file mode 100644
index 0000000..0d249da
--- /dev/null
+++ b/scripts/detect_priorities_mismatches.py
@@ -0,0 +1,321 @@
+#!/usr/bin/python3
+import argparse
+import os
+import subprocess
+import sys
+import tempfile
+from datetime import datetime
+import cve_lib
+
+ACTION_ADD_REASON = "add-reason"
+ACTION_EDIT_REASON = "edit-reason"
+ACTION_SKIP = "skip"
+
+EXPECTED_CVE_DESCRIPTIONS = (
+    "UNSUPPORTED", # ** UNSUPPORTED WHEN ASSIGNED **
+    "DISPUTED", # ** DISPUTED **
+    "REJECT", # ** REJECT **
+    "Note:", # **Note:** This is only exploitable
+    "This", # *This bug only affects
+    "info", # *info` actually points
+    "not" #*not* get upgraded
+)
+
+def get_cvss_base_severity(cvss_information):
+    base_severity = None
+    for cvss in cvss_information:
+        if cvss['source'] == "nvd":
+            cvss_base_severity = cvss['baseSeverity']
+            if cvss_base_severity != "NONE":
+                    base_severity = cvss_base_severity
+    return base_severity
+
+
+def display_command_file_usage(output, line_prefix=''):
+    output.write(f'{line_prefix} The following commands can be used in this file:\n')
+    output.write(f'{line_prefix} \n')
+    output.write(f'{line_prefix}"* Add a CVE Ubuntu priority reason to the tracker:"\n')
+    output.write(f'{line_prefix}"  <CVE> {ACTION_ADD_REASON} <REASON> ..."\n')
+    output.write(f'{line_prefix}"* Add a CVE Ubuntu priority reason in your editor:"\n')
+    output.write(f'{line_prefix}"  <CVE> {ACTION_EDIT_REASON} ..."\n')
+    output.write(f'{line_prefix}"* Temporarily skip over a CVE:"\n')
+    output.write(f'{line_prefix}"  <CVE> {ACTION_SKIP}\n"\n')
+    output.flush()
+
+
+def process_command_file(cves_output_content):
+    cves_output_content.seek(0)
+    line_number = 0
+    cves = set()
+    skipped_cves = set()
+    cves_to_add_reason_automatically = dict ()
+    invalid_lines = dict()
+    for line in cves_output_content.readlines():
+        line_number += 1
+        line = line.strip()
+
+        # We only want to action on lines starting with *
+        if not line or not line.startswith('*'):
+            continue
+
+        line_content = line.split()
+        try:
+            # action lines should start with * prefix, followed by a CVE number and desired action
+            (cve, action) = (line_content[1].strip().upper(), line_content[2])
+        except IndexError:
+            invalid_lines[str(line_number)] = [line, "Invalid line format"]
+            continue
+
+        # Ignore lines that look like action lines but are expected cve descriptions
+        if cve.startswith(EXPECTED_CVE_DESCRIPTIONS):
+            continue
+
+        if not cve.startswith('CVE-'):
+            # The first arg should look like a CVE ID
+            invalid_lines[str(line_number)] = [line, "Invalid CVE ID format"]
+            continue
+
+        if cve in cves:
+            invalid_lines[str(line_number)] = [line, f"Operation over {cve} was already performed"]
+            continue
+
+        cves.add(cve)
+        # This action sets the priority reason to the file without opening an editor
+        if action == ACTION_ADD_REASON:
+            # If the priority reason should be added, it must be present
+            try:
+                reason = " ".join(line_content[3:])
+            except IndexError:
+                invalid_lines[str(line_number)] = [line, f"Reason was not specified for {cve}"]
+                continue
+            cves_to_add_reason_automatically[cve] = [line, reason]
+
+        # This action opens an editor to edit the CVE
+        elif action == ACTION_EDIT_REASON:
+            try:
+                # find_cve will through ValueError exception if cve file is not found
+                cve_path= cve_lib.find_cve(cve)
+            except ValueError as e:
+                invalid_lines[str(line_number)] = [line, f"Unable to find cve file for {cve}: {e}"]
+                continue
+            cves_to_add_reason_in_editor[cve] = {"path": cve_path}
+
+        elif action == ACTION_SKIP:
+            # If the CVE should be skipped, no arguments are allowed
+            if len(line_content) > 3:
+                invalid_lines[str(line_number)] = [line, "Invalid skip command"]
+                continue
+            skipped_cves.add(cve)
+
+        else:
+            # The second arg must be a known action
+            invalid_lines[str(line_number)] = [line, f"Unknown action {action}"]
+    return invalid_lines, cves_to_add_reason_automatically, cves_to_add_reason_in_editor, skipped_cves
+
+
+def active_edit_priority_reason(cve, reason):
+    # TODO: check for script dir location
+    # TODO: check reason input
+    success = True
+    cmd = ['./scripts/active_edit', '-c', cve, '-R', reason]
+    try:
+        subprocess.run(cmd, check=True)
+    except subprocess.CalledProcessError as e:
+        output(f"ERROR while updating CVE file. {e}")
+        success = False
+    return success
+
+
+def report(errors, cves_to_add_reason_automatically, cves_to_add_reason_in_editor, skipped_cves, total, temp_file, interactive, keep_tmp_file):
+    print("\n============================ Summary =============================")
+    print(f"{total} CVEs needing priority reason")
+    print(f"{len(skipped_cves) + len(cves_to_add_reason_automatically) + len(cves_to_add_reason_in_editor)} CVEs processed:")
+    print(f" - {len(skipped_cves)} skipped CVE(s)")
+    print(f" - {len(cves_to_add_reason_automatically)} CVE(s) automatically updated with their corresponding reasons")
+    if not interactive:
+        print(f" - {len(cves_to_add_reason_in_editor)} CVE(s) opened in editor for manual edit")
+    print(f" - {len(errors)} issue(s)")
+    for error in errors:
+        if not interactive:
+            # In non-interactive mode, we have more information to report
+            print(f" - #{error}: {errors[error][1]}: {errors[error][0]}")
+        else:
+            print(f" - {error}: Unable to edit file.")
+    if not interactive and keep_tmp_file:
+        print(f"\n\ntempfile preserved at: {temp_file}")
+
+
+def setup_tmp_file(keep_tmp_file, tmp_file_content_prefix):
+    tmp_file_prefix="cves-needing-priority-reason."
+    # By default tmpfile is deleted
+    # We might want to preserve it for troubleshooting
+    delete_tmp_file = True
+    if keep_tmp_file:
+        delete_tmp_file = False
+    output = tempfile.NamedTemporaryFile(prefix=tmp_file_prefix, mode='w+', delete=delete_tmp_file)
+    display_command_file_usage(output, tmp_file_content_prefix)
+    return output
+
+
+# TODO: move this to other cve_lib filter
+def get_cves_with_mismatches(full_cves_information):
+    cves_with_mismatches = dict()
+    cves_with_cvss_severity = 0
+    for cve in full_cves_information:
+        ubuntu_priority = full_cves_information[cve]['Priority'][0]
+        cvss_base_severity = get_cvss_base_severity(full_cves_information[cve]['CVSS'])
+        if cvss_base_severity:
+            cves_with_cvss_severity +=1
+            ubuntu_priority_reason = full_cves_information[cve]['Priority'][1]
+            if cvss_base_severity.lower() != ubuntu_priority and not ubuntu_priority_reason:
+                cves_with_mismatches[cve] = full_cves_information[cve]
+    return cves_with_mismatches, cves_with_cvss_severity
+
+
+def check_date(date):
+    try:
+        parsed_date = datetime.strptime(date, "%Y-%m-%d")
+    except ValueError as e:
+        output.write(f"ERROR: invalid date argument value: {date}. {e}")
+        sys.exit(1)
+    return parsed_date
+
+
+def spawn_editor(path):
+    editor = os.getenv('EDITOR', 'vi')
+    subprocess.call([editor, path])
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--published-since",
+        help="Report CVEs published only since the date specified. Format: YYYY-MM-DD",
+    )
+    parser.add_argument(
+        "--published-until",
+        help="Report CVEs published only until the date specified. Format: YYYY-MM-DD",
+    )
+    parser.add_argument(
+        "--packages",
+        help="Report CVEs only affecting the list of comma separated packages. Format: pkg1,pkg2",
+    )
+    parser.add_argument(
+        "--interactive",
+        action ='store_true',
+    )
+    parser.add_argument(
+        "--keep-tmp-file",
+        action ='store_true',
+    )
+    args = parser.parse_args()
+
+    interactive_mode = False
+    original_output = sys.stdout
+    keep_tmp_file = args.keep_tmp_file
+    if args.interactive:
+        # In interactive mode, content is print to std out
+        output = sys.stdout
+        interactive_mode = True
+    else:
+        # In non-interactive mode, content is printed to a tmpfile
+        tmp_file_content_prefix = '# '
+        tmp_file_action_prefix = "* "
+        output = setup_tmp_file(keep_tmp_file, tmp_file_content_prefix)
+
+    cve_table_filters = []
+    since_date = None
+    until_date = None
+    if args.published_since:
+        since_date = check_date(args.published_since)
+        cve_table_filters.append({cve_lib.CVE_FILTER_NAME: cve_lib.cve_published_since, cve_lib.CVE_FILTER_ARGS: {"published_since": since_date}})
+
+    if args.published_until:
+        until_date = check_date(args.published_until)
+        cve_table_filters.append({cve_lib.CVE_FILTER_NAME: cve_lib.cve_published_until, cve_lib.CVE_FILTER_ARGS: {"published_until": until_date}})
+
+    if args.packages:
+        packages = args.packages.split(",")
+        cve_table_filters.append({cve_lib.CVE_FILTER_NAME: cve_lib.cve_affecting_pkgs, cve_lib.CVE_FILTER_ARGS: {"packages": packages}})
+
+    try:
+        print("\n==== Loading CVEs from UCT ====\n")
+        all_cves, embargoed_cves, retired_cves, ignored_cves = cve_lib.get_all_cve_list()
+        (
+            _,
+            _,
+            _,
+            _,
+            full_cves_information,
+        ) = cve_lib.load_table(all_cves, embargoed_cves, None, retired_cves, ignored_cves, cve_table_filters)
+    except ValueError as e:
+        # cve_lib.load_cve() can raises value error on CVE issues
+        print(f"ERROR: unable to load CVEs: {e}")
+        sys.exit(1)
+
+    cves_to_add_reason_automatically = dict()
+    cves_to_add_reason_in_editor = dict ()
+    skipped_cves = set()
+    errors = set()
+    total_cves_to_process = 0
+    tmp_file_name = None
+    cves_with_mismatches, cves_with_cvss_severity = get_cves_with_mismatches(full_cves_information)
+    if cves_with_mismatches:
+        total_cves_to_process = len(cves_with_mismatches)
+
+        output.write(f"\n==== Listing {total_cves_to_process} CVEs (out of {cves_with_cvss_severity}) with Ubuntu Priority different than CVSS base severity ====")
+
+        for index, cve in enumerate(cves_with_mismatches):
+            # Provide basic CVE metadata
+            output.write(f"\n\n=========== {index + 1}/{total_cves_to_process}: {cve} ===========")
+            output.write(f"{cves_with_mismatches[cve]['Description']}")
+            output.write(f"\n- Public Date: {cves_with_mismatches[cve]['PublicDate']}")
+            output.write(f"\n- Ubuntu Priority: {cves_with_mismatches[cve]['Priority'][0]} || CVSS Severity: {get_cvss_base_severity(cves_with_mismatches[cve]['CVSS'])}")
+            output.write(f"\n- Affected packages: {', '.join(cves_with_mismatches[cve]['pkgs'].keys())}")
+            output.write(f"\n- Tags: {', '.join(cves_with_mismatches[cve]['tags'])}")
+            output.write(f"\n- References: {cves_with_mismatches[cve]['References']}")
+            output.write(f"\n- Bugs: {cves_with_mismatches[cve]['Bugs']}")
+
+            # In interactive mode, ask and perform action on every CVE
+            if interactive_mode:
+                output.write("\n\nAdd priority reason? \nY]es, S]kip for now, or Q]uit]")
+                confirm = input()
+                if confirm.lower() in ('Y', 'y', 'yes', 'YES'):
+                    reason = input("Please add Ubuntu priority reason: ")
+                    if not active_edit_priority_reason(cve, reason):
+                        errors.add(cve)
+                        continue
+                    # In interactive mode, we only add to cves_to_add_reason_automatically
+                    # for later summary purposes.
+                    cves_to_add_reason_automatically[cve] = []
+                elif confirm.lower() in ('Q', 'q', 'quit', 'Quit', 'QUIT'):
+                    output.write("Quiting...\n")
+                    report(errors, cves_to_add_reason_automatically, cves_to_add_reason_in_editor, skipped_cves, total_cves_to_process, None, interactive_mode, keep_tmp_file)
+                    sys.exit(0)
+                elif confirm.lower() in ('S', 's', 'skip', 'Skip', 'SKIP'):
+                    output.write(f"Skipping {cve}\n")
+                    skipped_cves.add(cve)
+                else:
+                    output.write("\n Invalid option, skipping {cve}\n")
+                    skipped_cves.add(cve)
+            # In non-interactive mode, add cve info to file. Actions will be executed later
+            else:
+                output.write(f"\n\n{tmp_file_content_prefix}{tmp_file_action_prefix}{cve} {ACTION_ADD_REASON}")
+                output.write(f"\n{tmp_file_content_prefix}{tmp_file_action_prefix}{cve} {ACTION_EDIT_REASON}")
+                output.write(f"\n{tmp_file_content_prefix}{tmp_file_action_prefix}{cve} {ACTION_SKIP}")
+        if not interactive_mode:
+            output.flush()
+            tmp_file_name = output.name
+            # Show tmp file content in configured editor
+            spawn_editor(output.name)
+            errors, cves_to_add_reason_automatically, cves_to_add_reason_in_editor, skipped_cves = process_command_file(output)
+            for cve in cves_to_add_reason_automatically:
+                reason = cves_to_add_reason_automatically[cve][1]
+                if not active_edit_priority_reason(cve, reason):
+                    file_line = cves_to_add_reason_automatically[cve][0]
+                    errors[cve]=[file_line, "Unable to add priority reason automatically."]
+            for cve in cves_to_add_reason_in_editor:
+                spawn_editor(cves_to_add_reason_in_editor[cve]["path"])
+            # restore original sys.stdout
+            sys.stdout = original_output
+    report(errors, cves_to_add_reason_automatically, cves_to_add_reason_in_editor, skipped_cves, total_cves_to_process, tmp_file_name, interactive_mode, keep_tmp_file)
\ No newline at end of file
diff --git a/scripts/report_priority_offset_spike.py b/scripts/report_priority_offset_spike.py
new file mode 100644
index 0000000..506249f
--- /dev/null
+++ b/scripts/report_priority_offset_spike.py
@@ -0,0 +1,218 @@
+#!/usr/bin/python3
+
+import argparse
+import subprocess
+import sys
+from datetime import datetime
+import cve_lib
+import os
+
+# this is needed to consume google docs apis wrapper
+USM = os.environ.get(
+    "USM", os.path.expandvars("$HOME/git-pulls/ubuntu-security-metrics")
+)
+sys.path.append(f"{USM}")
+
+from metrics.data_sources.google_document import (
+    connect_to_spreadsheet,
+    write_to_spreadsheet,
+    append_row_data
+)
+
+PRIORITY_OFFSET = {
+    'critical': 'high' ,
+    'high': 'medium',
+    'medium': 'low',
+    'low': 'negligible'
+}
+
+PRIORITY_BUMP= {
+    'high': 'critical',
+    'medium': 'high',
+    'low': 'medium',
+    'negligible': 'low'
+}
+
+HIGHER_LEVELS = {
+    'critical' : ['high', 'medium','low'],
+    'high' : ['medium','low'],
+    'medium' : ['low'],
+    'low' : [],
+}
+
+def get_cvss_base_severity(cvss_information):
+    base_severity = None
+    for cvss in cvss_information:
+            if cvss['source'] == "nvd":
+                cvss_base_severity = cvss['baseSeverity']
+                if cvss_base_severity != "NONE":
+                     base_severity = cvss_base_severity
+    return base_severity
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--published-since",
+        help="Report CVEs published only since the date specified. Format: YYYY-MM-DD",
+    )
+    args = parser.parse_args()
+
+    since_date = None
+    if args.published_since:
+        try:
+            since_date = datetime.strptime(args.published_since, "%Y-%m-%d")
+        except ValueError as e:
+            print(f"ERROR: invalid since date argument value: {args.published_since}. {e}")
+            sys.exit(1)
+
+    try:
+        print("\n==== Loading CVEs from UCT ====\n")
+        all_cves, embargoed_cves, retired_cves, ignored_cves = cve_lib.get_all_cve_list()
+        (
+            _,
+            _,
+            _,
+            _,
+            full_cves_information,
+        ) = cve_lib.load_table(all_cves, embargoed_cves, None, retired_cves, ignored_cves, since_date)
+    except ValueError as e:
+        # cve_lib.load_cve() can raises value error on CVE issues
+        print(f"ERROR: unable to load CVEs: {e}")
+        sys.exit(1)
+
+    cves_with_mismatches = dict()
+    cves_with_cvss_severity = 0
+    #cves_with_mismatches = dict()
+    cves_with_mismatches = {'critical': 0, 'high': 0, 'medium': 0, 'low': 0}
+    total_differences = 0
+    cves_with_same = {'critical': 0, 'high': 0, 'medium': 0, 'low': 0}
+    total_same = 0
+    cves_diff = {'critical': 0, 'high': 0, 'medium': 0, 'low': 0}
+    total_diff = 0
+
+    creds_file = "/home/emitorino/register-automation-1338127a145f.json"
+    sheet = connect_to_spreadsheet(creds_file)
+    rows_data = []
+    row = 2
+    missing_cvss = 0
+    equals = 0
+    higher = 0
+    lower = 0
+    for cve in full_cves_information:
+        original_ubuntu_priority = full_cves_information[cve]['Priority'][0]
+        ubuntu_priority = PRIORITY_BUMP[original_ubuntu_priority]
+        print (f"Bumping {original_ubuntu_priority} to {ubuntu_priority}")
+        cvss_base_severity = get_cvss_base_severity(full_cves_information[cve]['CVSS'])
+        needs_explanation = "NO"
+        cve_data = []
+        if cvss_base_severity:
+            cves_with_cvss_severity +=1
+            cvss_base_severity = cvss_base_severity.lower()
+            cve_data = [cve, cvss_base_severity, original_ubuntu_priority, ubuntu_priority]
+            # if cvss_base_severity == ubuntu_priority:
+            #         cves_with_same[cvss_base_severity] +=1
+            #         total_same +=1
+            ubuntu_priority_reason = full_cves_information[cve]['Priority'][1]
+            # if cvss_base_severity.lower() != ubuntu_priority and not ubuntu_priority_reason:
+            #     cves_with_mismatches[cve] = full_cves_information[cve]
+            if cvss_base_severity in PRIORITY_OFFSET:
+                if ubuntu_priority != cvss_base_severity:
+                    cves_with_mismatches[cvss_base_severity] +=1
+                    total_differences +=1
+                    if ubuntu_priority in HIGHER_LEVELS[cvss_base_severity]:
+                        needs_explanation = "YES"
+                        lower += 1
+                    else:
+                        needs_explanation = "Maybe?"
+                        higher += 1
+                else:
+                    equals += 1
+                #     if cvss_base_severity != ubuntu_priority:
+                #         cves_diff[cvss_base_severity] +=1
+                #         total_diff +=1
+                # if cvss_base_severity == ubuntu_priority:
+                #     cves_with_same[cvss_base_severity] +=1
+                #     total_same +=1
+            else:
+                print(f"ERROR: {ubuntu_priority} not in {PRIORITY_OFFSET.keys()}")
+                sys.exit(1)
+            cve_data.append(needs_explanation)
+        else:
+            missing_cvss+=1
+            cve_data = [cve, "None", original_ubuntu_priority, ubuntu_priority, needs_explanation]
+        row = append_row_data(
+                                row,
+                                rows_data,
+                                "{}!A{}:E{}".format("Sheet2", row, row),
+                                cve_data
+                            )
+    
+    print(total_differences)
+    print(cves_with_mismatches)
+    print("ALL CVES")
+    print(len(full_cves_information))
+    print("Missing CVSS")
+    print(missing_cvss)
+    print("NOW LOWER")
+    print(lower)
+    print("NOW HIGER")
+    print(higher)
+    print("NOW EQUALS")
+    print(equals)
+    write_to_spreadsheet(sheet, "1S1L4H5Kfkpgt_j0O2Gk6i8R2e78CFrpaCPyLbRz_No0", rows_data, rows_range=None, batch_update=True)
+    # row = 1
+    # range = 0
+    # delta = 60
+    # for c in data[range, range + delta]:
+    #     values = [c]
+    #     range = "{}!A{}:E{}".format("Sheet1", row, row)
+    #     write_to_spreadsheet(
+    #             sheet, "", values, rows_range=range, batch_update=False
+    #     )
+    #     row +=1
+    # print(total_same)
+    # print(cves_with_same)
+    # print(total_diff)
+    # print(cves_diff)
+    # if cves_with_mismatches:
+    #     total_cves_to_process = len(cves_with_mismatches)
+    #     print(f"\n==== Listing {total_cves_to_process} CVEs (out of {len(full_cves_information)}) with Ubuntu Priority different than CVSS base severity ====")
+    #     for index, cve in enumerate(cves_with_mismatches):
+    #         print(f"\n=========== {index + 1}/{total_cves_to_process}: {cve} ===========")
+    #         print(cves_with_mismatches[cve]['Description'])
+    #         print(f"Ubuntu Priority: {cves_with_mismatches[cve]['Priority'][0]}")
+    #         print(f"CVSS Severity: {get_cvss_base_severity(cves_with_mismatches[cve]['CVSS'])}")
+    #         print(f"Affected packages: {', '.join(cves_with_mismatches[cve]['pkgs'].keys())}")
+    #         print(f"Tags: {', '.join(cves_with_mismatches[cve]['tags'])}")
+    #         print(f"References: {cves_with_mismatches[cve]['References']}")
+    #         print(f"Bugs: {cves_with_mismatches[cve]['Bugs']}")
+
+    # if cves_with_mismatches:
+    #     total_cves_to_process = len(cves_with_mismatches)
+    #     print(f"\n==== Listing {total_cves_to_process} CVEs (out of {cves_with_cvss_severity}) with Ubuntu Priority different than CVSS base severity ====")
+    #     for index, cve in enumerate(cves_with_mismatches):
+    #         print(f"\n=========== {index + 1}/{total_cves_to_process}: {cve} ===========")
+    #         print(cves_with_mismatches[cve]['Description'])
+    #         print(f"Ubuntu Priority: {cves_with_mismatches[cve]['Priority'][0]}")
+    #         print(f"CVSS Severity: {get_cvss_base_severity(cves_with_mismatches[cve]['CVSS'])}")
+    #         print(f"Affected packages: {', '.join(cves_with_mismatches[cve]['pkgs'].keys())}")
+    #         print(f"Tags: {', '.join(cves_with_mismatches[cve]['tags'])}")
+    #         print(f"References: {cves_with_mismatches[cve]['References']}")
+    #         print(f"Bugs: {cves_with_mismatches[cve]['Bugs']}")
+    #         print("Add priority reason? [Y/N/Q(quit)]")
+    #         confirm = input()
+    #         if confirm.lower() in ('Y', 'y', 'yes', 'YES'):
+    #             reason = input("Please add Ubuntu priority reason: ")
+    #             # TODO: check for script dir location
+    #             cmd = ['./scripts/active_edit', '-c', cve, '-R', reason]
+    #             try:
+    #                 subprocess.run(cmd, check=True)
+    #             except subprocess.CalledProcessError as e:
+    #                 print(f"ERROR while updating CVE file. {e}")
+
+    #         elif confirm.lower() in ('Q', 'q', 'quit', 'Quit', 'QUIT'):
+    #             print("Quiting...")
+    #             sys.exit(0)
+    #         elif confirm.lower() in ('N', 'n', 'no', 'NO'):
+    #             print(f"Skipping {cve}")