Ubuntu CVE Tracker

Merge ~eslerm/ubuntu-cve-tracker:cna-info into ubuntu-cve-tracker:master

Proposed by Mark Esler on 2024-04-03

Status:	Needs review
Proposed branch:	~eslerm/ubuntu-cve-tracker:cna-info
Merge into:	ubuntu-cve-tracker:master
Diff against target:	362 lines (+356/-0) 1 file modified scripts/cna_info.py (+356/-0)
Related bugs:	Link a bug report

Reviewer	Review Type	Date Requested	Status
Ubuntu Security Team		2024-04-03	Pending
Review via email: mp+463549@code.launchpad.net

Commit message

cna_info.py: init with all valid CNAs until ~2024-03

Description of the change

this was part of vulnerability_translate.py

breaking into smaller, more maintainable, pieces

Revision history for this message

Mark Esler (eslerm) wrote on 2024-04-09:

For context of how this is will be use, these dictionary keys are present in the CVE List and NVD's CVE datasets. By having a lookup table, we _could_ use CNA information in UCT.

One example is to identify CNA during initial CVE Triage and if a CNA has never assigned a CVE in UCT _yet_, it is a heuristic.

Another is to address https://bugs.launchpad.net/ubuntu-cve-tracker/+bug/2054762 where we are blanket attributing NVD for (nearly) all CVSS scores which are not generated by ubuntu. Attributing CNAs properly is not only technically correct, but drives priority* and could become a heuristic for triagers. (*iiuc, only NVD scores drive FedRAMP priority)

Revision history for this message

Alex Murray (alexmurray) wrote on 2024-04-12:

Would it be better to maintain these as YAML files instead to allow for easier editing? Then a simple python script to load them?

Unmerged commits

4d50f43... by Mark Esler on 2024-04-03

cna_info.py: init with all valid CNAs until ~2024-03

	unit-tests:0 (build)
	check-cves:0 (build)

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk

Subscribers

People subscribed via source and target branches

to all changes:

Aravind

Mark Esler

Philip Roche

Robert C Jennings

Simon Quigley

Steve Beattie

Ubuntu Security Team

 diff --git a/scripts/cna_info.py b/scripts/cna_info.py
 new file mode 100755
 index 0000000..e4f3048
 --- /dev/null
 +++ b/scripts/cna_info.py
@@ -0,0 +1,356 @@
++#!/usr/bin/env python3
++
++"""
++cna_info.py maintains CNA information for other UCT scripts
++
++TRACKED_CNAS and NOT_FOR_US_CNAS are dictionaries with the same format.
++
++Keys are unique IDs that refer to a specific CNA. These keys are present in
++upstream CVE Program's CVE List V5 [0] and NVD's API 2.0 [1] CVE data.
++
++Values are common names for CNAs. An empty value means that the common name
++is unknown or simply unset. Dictionaries are maintained alphabetically by
++value. Common names are concatenated to a single lowercase word.
++
++TRACKED_CNAS are CNAs which have assigned CVEs tracked in ./active or ./retired.
++
++NOT_FOR_US_CNAS are CNAs which have never (yet) assigned a CVE tracked in
++./active or ./retired.
++
++KNOWN_CNAS combines TRACKED_CNAS and NOT_FOR_US_CNAS.
++
++[0] https://github.com/CVEProject/cvelistV5
++[1] https://nvd.nist.gov/general/news/api-20-announcements
++
++Copyright 2023-2024, Canonical Ltd.
++Author: Mark Esler <mark.esler@canonical.com>
++"""
++
++# CNAs which have assigned at least one CVE tracked in UCT's
++# ./active or ./retired
++TRACKED_CNAS = {
++    "psirt@adobe.com": "adobe",
++    "cve@aliasrobotics.com": "aliasrobotics",
++    "psirt@amd.com": "amd",
++    "security@android.com": "android",
++    "security@apache.org": "apache",
++    "product-security@apple.com": "apple",
++    "arm-security@arm.com": "arm",
++    "security@atlassian.com": "atlassian",
++    "secure@blackberry.com": "blackberry",
++    "cret@cert.org": "cert",
++    "cvd@cert.pl": "certpl",
++    "security@checkmk.com": "checkmk",
++    "cve@checkpoint.com": "checkpoint",
++    "chrome-cve-admin@google.com": "chrome",
++    "talos-cna@cisco.com": "cisco",
++    "ykramarz@cisco.com": "cisco",
++    "cna@cloudflare.com": "cloudflare",
++    "security@debian.org": "debian",
++    "security_alert@emc.com": "dell",
++    "ics-cert@hq.dhs.gov": "dhs",
++    "security@documentfoundation.org": "documentfoundation",
++    "mlhess@drupal.org": "drupal",
++    "security@duo.com": "duo",
++    "emo@eclipse.org": "eclipse",
++    "infosec@edk2.groups.io": "edk2",
++    "bressers@elastic.co": "elastic",
++    "security@eset.com": "eset",
++    "PSIRT-CNA@flexerasoftware.com": "flexsoftware",
++    "cve-notifications-us@f-secure.com": "fsecure",
++    "f5sirt@f5.com": "f5",
++    "cve-assign@fb.com": "facebook",
++    "help@fluidattacks.com": "fluidattack",
++    "secteam@freebsd.org": "freebsd",
++    "security-advisories@github.com": "github",
++    "cve@gitlab.com": "gitlab",
++    "security@golang.org": "golang",
++    "cve-coordination@google.com": "google",
++    "security@grafana.com": "grafana",
++    "support@hackerone.com": "hackerone",
++    "security@hashicorp.com": "hashicorp",
++    "psirt@hcl.com": "hcl",
++    "psirt@huawei.com": "huawei",
++    "security@huntr.dev": "huntr",
++    "psirt@us.ibm.com": "ibm",
++    "cve-coordination@incibe.es": "incibe",
++    "secure@intel.com": "intel",
++    "cve-request@iojs.org": "iojs",
++    "security-officer@isc.org": "isc",
++    "cna@cyber.gov.il": "isreal",
++    "jenkinsci-cert@googlegroups.com": "jenkinsci",
++    "reefs@jfrog.com": "jfrog",
++    "jordan@liggitt.net": "jordan",
++    "josh@bress.net": "josh",
++    "vultures@jpcert.or.jp": "jpcert",
++    "sirt@juniper.net": "juniper",
++    "vulnerability@kaspersky.com": "kaspersky",
++    "416baaa9-dc9f-4396-8d5f-8c081fb06d67": "kernel",
++    "mandiant-cve@google.com": "mandiant",
++    "responsibledisclosure@mattermost.com": "mattermost",
++    "vulnerabilitylab@mend.io": "mendio",
++    "secure@microsoft.com": "microsoft",
++    "cve@mitre.org": "mitre",
++    "cna@mongodb.com": "mongodb",
++    "security@mozilla.org": "mozilla",
++    "sep@nlnetlabs.nl": "nlnetlabs",
++    "vulnerability@ncsc.ch": "nscs",
++    "nvd@nist.gov": "nvd",
++    "psirt@nvidia.com": "nvidia",
++    "security@odoo.com": "odoo",
++    "research@onekey.com": "onekey",
++    "security@open-xchange.com": "ope-xchange",
++    "security@openanolis.org": "openanolis",
++    "security@opencloudos.tech": "opencloudos",
++    "securities@openeuler.org": "openeuler",
++    "openssl-security@openssl.org": "openssl",
++    "security@opentext.com": "opentext",
++    "security@openvpn.net": "openvpn",
++    "secalert_us@oracle.com": "oracle",
++    "security@otrs.com": "otrs",
++    "psirt@paloaltonetworks.com": "paloalto",
++    "security@pandorafms.com": "pandorafms",
++    "audit@patchstack.com": "patchstack",
++    "patrick@puiterwijk.org": "patrick",
++    "security@php.net": "php",
++    "security@pivotal.io": "pivotal",
++    "security@puppet.com": "puppet",
++    "cna@python.org": "python",
++    "product-security@qualcomm.com": "qualcomm",
++    "cve@rapid7.con": "rapid7",
++    "secalert@redhat.com": "redhat",
++    "security@sierrawireless.com": "sierrawireless",
++    "cve_disclosure@tech.gov.sg": "singapore",
++    "report@snyk.io": "snyk",
++    "info@starlabs.sg": "starlabs",
++    "meissner@suse.de": "suse",
++    "disclosure@synopsys.com": "synopsys",
++    "cve@takeonme.org": "takeonme",
++    "security@tcpdump.org": "tcpdump",
++    "vulnreport@tenable.com": "tenable",
++    "security@tibco.com": "tibco",
++    "trellixpsirt@trellix.com": "trellix",
++    "security@ubuntu.com": "ubuntu",
++    "vuln@vdoo.com": "vdoo",
++    "security@vmware.com": "vmware",
++    "cna@vuldb.com": "vuldb",
++    "psirt@wdc.com": "wdc",
++    "facts@wolfssl.com": "wolfssl",
++    "security@wordfence.com": "wordfence",
++    "contact@wpscan.com": "wpscan",
++    "disclosure@vulncheck.com": "wulncheck",
++    "security@xen.org": "xen",
++    "xpdf@xpdfreader.com": "xpdf",
++    "browser-security@yandex-team.ru": "yandex",
++    "security@zabbix.com": "zabbix",
++    "zdi-disclosures@trendmicro.com": "zdi",
++    "vulnerabilities@zephyrproject.org": "zephyr",
++    "46fe6300-5254-4a98-9594-a9567bec8179": "",
++    "6b35d637-e00f-4228-858c-b20ad6e1d07b": "",
++    "bc94ec7e-8909-4cbb-83df-d2fc9330fa88": "",
++    "larry0@me.com": "",
++}
++
++
++# CNAs which have never (yet) assigned a CVE tracked in UCT's
++# ./active or ./retired
++NOT_FOR_US_CNAS = {
++    "cert@airbus.com": "airbus",
++    "psirt@autodesk.com": "autodesk",
++    "cve-requests@bitdefender.com": "bitdefender",
++    "psirt@bosch.com": "bosch",
++    "vuln@ca.com": "broadcom",
++    "cybersecurity@dahuatech.com": "dahuatechnology",
++    "CybersecurityCOE@eaton.com": "easton",
++    "psirt@fortinet.com": "fortinet",
++    "security-alert@hpe.com": "hpe",
++    "productsecurity@jci.com": "johnsoncontrols",
++    "psirt@lenovo.com": "lenovo",
++    "cve@navercorp.com": "navercorporation",
++    "security-alert@netapp.com": "netapp",
++    "cna@sap.com": "sap",
++    "cybersecurity@se.com": "schneiderelectric",
++    "productcert@siemens.com": "siemens",
++    "PSIRT@sonicwall.com": "sonicwall",
++    "secure@symantec.com": "symantec",
++    "security@trendmicro.com": "trendmicro",
++    "twcert@cert.org.tw": "twertcc",
++    "psirt@zte.com.cn": "zte",
++    "vulnerability@cspcert.ph": "",
++    "2499f714-1537-4658-8207-48ae4bb9eae9": "",
++    "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007": "",
++    "57dba5dd-1a03-47f6-8b36-e84e47d335d8": "",
++    "security@search-guard.com": "",
++    "7bc73191-a2b6-4c63-9918-753964601853": "",
++    "security@marklogic.com": "",
++    "a2826606-91e7-4eb6-899e-8484bd4575d5": "",
++    "0a72a055-908d-47f5-a16a-1f09049c16c6": "",
++    "15c01472-ff32-4bec-916d-912e60a9fe4c": "",
++    "22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de": "",
++    "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe": "",
++    "3DS.Information-Security@3ds.com": "",
++    "551230f0-3615-47bd-b7cc-93e92e730bbf": "",
++    "68630edc-a58c-4cbd-9b01-0e130455c8ae": "",
++    "7168b535-132a-4efe-a076-338f829b2eb9": "",
++    "769c9ae7-73c3-4e47-ae19-903170fc3eb8": "",
++    "8a9629cb-c5e7-4d2a-a894-111e8039b7ea": "",
++    "9119a7d8-5eab-497f-8521-727c672e3725": "",
++    "96d4e157-0bf0-48b3-8efd-382c68caf4e0": "",
++    "a87f365f-9d39-4848-9b3a-58c7cae69cab": "",
++    "ed10eef1-636d-4fbe-9993-6890dfa878f8": "",
++    "0fc0942c-577d-436f-ae8e-945763c79b02": "",
++    "36106deb-8e95-420b-a0a0-e70af5d245df": "",
++    "3836d913-7555-4dd0-a509-f5667fdf5fe4": "",
++    "6f8de1f0-f67e-45a6-b68f-98777fdb759c": "",
++    "df4dee71-de3a-4139-9588-11b62fe6c0ff": "",
++    "ff5b8ace-8b95-4078-9743-eac1ca5451de": "",
++    "13061848-ea10-403d-bd75-c83a022c2891": "",
++    "alibaba-cna@list.alibaba-inc.com": "",
++    "ART@zuso.ai": "",
++    "biossecurity@ami.com": "",
++    "bugreport@qualys.com": "",
++    "cert@ncsc.nl": "",
++    "contact@securifera.com": "",
++    "csirt@divd.nl": "",
++    "cve@asrg.io": "",
++    "cve-coordination@logitech.com": "",
++    "cve-coordination@palantir.com": "",
++    "cve@forums.swift.org": "",
++    "cve@jetbrains.com": "",
++    "cve@profelis.com.tr": "",
++    "cves@blacklanternsecurity.com": "",
++    "cve@usom.gov.tr": "",
++    "cve@zscaler.com": "",
++    "cybersecurity@bd.com": "",
++    "cybersecurity@ch.abb.com": "",
++    "cybersecurity@hitachienergy.com": "",
++    "cybersecurity@hitachi-powergrids.com": "",
++    "disclose@cybersecurityworks.com": "",
++    "disclosures@exodusintel.com": "",
++    "disclosures@gallagher.com": "",
++    "disclosures@halborn.com": "",
++    "dl_cve@linecorp.com": "",
++    "dsap-vuln-management@google.com": "",
++    "eb41dac7-0af8-4f84-9f6d-0272772514f4": "",
++    "f98c90f0-e9bd-4fa7-911b-51993f3571fd": "",
++    "fc9afe74-3f80-4fb7-a313-e6f036a89882": "",
++    "GEPowerCVD@ge.com": "",
++    "hirt@hitachi.co.jp": "",
++    "hp-security-alert@hp.com": "",
++    "hsrc@hikvision.com": "",
++    "iletisim@usom.gov.tr": "",
++    "incident@nbu.gov.sk": "",
++    "info@appcheck-ng.com": "",
++    "info@cert.vde.com": "",
++    "info@cybellum.com": "",
++    "info@greenrocketsecurity.com": "",
++    "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp": "",
++    "mobile.security@samsung.com": "",
++    "office@cyberdanube.com": "",
++    "office@obdev.at": "",
++    "openbmc-security@lists.ozlabs.org": "",
++    "ot-cert@dragos.com": "",
++    "paddle-security@baidu.com": "",
++    "prodsec@nozominetworks.com": "",
++    "prodsec@splunk.com": "",
++    "product-cna@github.com": "",
++    "product-security@axis.com": "",
++    "productsecurity@baxter.com": "",
++    "productsecurity@bbraun.com": "",
++    "productsecurity@carrier.com": "",
++    "product-security@gg.jp.panasonic.com": "",
++    "product.security@lge.com": "",
++    "product-security@silabs.com": "",
++    "psirt@arista.com": "",
++    "psirt@esri.com": "",
++    "psirt@forcepoint.com": "",
++    "psirt@forgerock.com": "",
++    "psirt@honeywell.com": "",
++    "psirt-info@cyber.jp.nec.com": "",
++    "psirt@mirantis.com": "",
++    "psirt@moxa.com": "",
++    "psirt@netskope.com": "",
++    "psirt@okta.com": "",
++    "psirt@purestorage.com": "",
++    "PSIRT@rockwellautomation.com": "",
++    "psirt@sailpoint.com": "",
++    "PSIRT@samsung.com": "",
++    "psirt@servicenow.com": "",
++    "psirt@sick.de": "",
++    "psirt@solarwinds.com": "",
++    "PSIRT@synaptics.com": "",
++    "psirt@teamviewer.com": "",
++    "psirt@thalesgroup.com": "",
++    "psirt@tigera.io": "",
++    "responsible-disclosure@pingidentity.com": "",
++    "scy@openharmony.io": "",
++    "sec@hillstonenet.com": "",
++    "secure@citrix.com": "",
++    "secure@ea.com": "",
++    "security@1e.com": "",
++    "security@360.cn": "",
++    "security@42gears.com": "",
++    "security@acronis.com": "",
++    "securityalerts@avaya.com": "",
++    "security-alert@sophos.com": "",
++    "security@asustor.com": "",
++    "security@baicells.com": "",
++    "security@bluespice.com": "",
++    "security@craftersoftware.com": "",
++    "security@deepsurface.com": "",
++    "security@devolutions.net": "",
++    "security@docker.com": "",
++    "security@dotcms.com": "",
++    "security@fidelissecurity.com": "",
++    "security@genetec.com": "",
++    "security@hypr.com": "",
++    "security@illumio.com": "",
++    "security@jetbrains.com": "",
++    "security@joomla.org": "",
++    "security@knime.com": "",
++    "security@liferay.com": "",
++    "security@mautic.org": "",
++    "security@mediatek.com": "",
++    "security@medtronic.com": "",
++    "security@m-files.com": "",
++    "security@mimsoftware.com": "",
++    "security@ni.com": "",
++    "security@nortonlifelock.com": "",
++    "security@octopus.com": "",
++    "security@opennms.com": "",
++    "security@opera.com": "",
++    "security@oppo.com": "",
++    "security@pega.com": "",
++    "security@progress.com": "",
++    "security@proofpoint.com": "",
++    "security@qnapsecurity.com.tw": "",
++    "security@replicated.com": "",
++    "security-report@netflix.com": "",
++    "SecurityResponse@netmotionsoftware.com": "",
++    "security@salesforce.com": "",
++    "security@selinc.com": "",
++    "security@snowsoftware.com": "",
++    "security@synology.com": "",
++    "security@temporal.io": "",
++    "security@teradici.com": "",
++    "security@unisoc.com": "",
++    "security@vaadin.com": "",
++    "security@vivo.com": "",
++    "security.vulnerabilities@algosec.com": "",
++    "security.vulnerabilities@hitachivantara.com": "",
++    "security@xiaomi.com": "",
++    "security@yugabyte.com": "",
++    "security@zoom.us": "",
++    "security@zyxel.com.tw": "",
++    "sirt@brocade.com": "",
++    "sirt@silver-peak.com": "",
++    "support@shopbeat.co.za": "",
++    "vdisclose@cert-in.org.in": "",
++    "vdp@themissinglink.com.au": "",
++    "VulnerabilityReporting@secomea.com": "",
++    "vuln@krcert.or.kr": "",
++    "zowe-security@lists.openmainframeproject.org": "",
++}
++
++
++KNOWN_CNAS = TRACKED_CNAS | NOT_FOR_US_CNAS