Merge ~litios/ubuntu-cve-tracker:oval-fixes-improvements into ubuntu-cve-tracker:master

[David Fernandez Gonzalez]

[OVAL]

-- Fix get_pkgs function to prevent race conditions --

    Sometimes, depending on how the CVEs are loaded, function
    get_pkgs wouldn't handle the packages properly. This would
    result in different binaries between runs, making OVAL inconsistent.

-- Retrieve update pocket + extra CVE fields --

    Add a function to retrieve the pocket of a given
    package and version from the cache.

    Add Mitigation and Notes fields to the CVE.

    This is needed for the JSON per-package generation.

[Eduardo Barretto (ebarretto)]

lgtm, thanks!

review: Approve

diff --git a/scripts/oval_lib.py b/scripts/oval_lib.py
index 489200e..b30a987 100644
--- a/scripts/oval_lib.py
+++ b/scripts/oval_lib.py
@@ -144,26 +144,41 @@ def generate_cve_tag(cve):
     cve_ref += '>{0}</cve>'.format(cve['Candidate'])
     return cve_ref
 
+def get_real_release(cache, source_name, release) -> str:
+    """ return the release in which the package is present.
+        This applies for the cases where a parent release
+        contains the package but not the requested release.
+    """
+
+    if release in cache and source_name in cache[release]: return release
+
+    rel = release
+    while cve_lib.release_parent(rel):
+        rel = cve_lib.release_parent(rel)
+        if source_name in cache[rel]:
+            return rel
+
+    # if the source package does not exist in any release, return None
+    return None
+
+def get_pocket(cache, source_name, version, release):
+    """ return the pocket of a specific package version in a release """
+    rel = get_real_release(cache, source_name, release)
+    if not rel: return None, None
+
+    return rel, cache[rel][source_name][version]['pocket']
+
 def get_binarypkgs(cache, source_name, release):
     """ return a list of binary packages from the source package version """
     packages_to_ignore = ("-dev", "-doc", "-dbg", "-dbgsym", "-udeb", "-locale-")
     binaries_map = collections.defaultdict(dict)
-
-    if source_name not in cache[release]:
-        rel = release
-        while cve_lib.release_parent(rel):
-            rel = cve_lib.release_parent(rel)
-            r , vb  = get_binarypkgs(cache, source_name, rel)
-            if r:
-                return r, vb
-
-        # if a source package does not exist in such a release
-        # return None
-        return None, None
     
-    for source_version in cache[release][source_name]:
+    rel = get_real_release(cache, source_name, release)
+    if not rel: return None, None
+
+    for source_version in cache[rel][source_name]:
         binaries_map.setdefault(source_version, dict())
-        for binary, bin_data in cache[release][source_name][source_version]['binaries'].items():
+        for binary, bin_data in cache[rel][source_name][source_version]['binaries'].items():
             # for kernel we only want linux images
             if source_name.startswith('linux') and not binary.startswith('linux-image-'):
                 continue
@@ -173,7 +188,7 @@ def get_binarypkgs(cache, source_name, release):
                 binaries_map[source_version].setdefault(bin_data['version'], list())
                 binaries_map[source_version][bin_data['version']].append(binary)
 
-    return release, binaries_map
+    return rel, binaries_map
 
 class CVEPkgRelEntry:
     def __init__(self, pkg, release, cve, status, note) -> None:
@@ -284,6 +299,8 @@ class CVE:
         self.cvss = info['CVSS']
         self.assigned_to = info['Assigned-to'] if 'Assigned-to' in info else ''
         self.discoverd_by = info['Discovered-by'] if 'Discovered-by' in info else ''
+        self.notes = info['Notes']
+        self.mitigation = info['Mitigation'].strip() if 'Mitigation' in info else ''
         self.usns = []
         self.references = []
         self.bugs = []
@@ -315,13 +332,17 @@ class CVE:
             else:
                 pkg_rel_entry = self.pkg_rel_entries[str(pkg)]
                 curr_pkg_rel_entry = self.pkg_rel_entries[str(pkg_rel[pkg.name])]
-                if curr_pkg_rel_entry.status == 'fixed':
-                    priority = releases.index(pkg.rel) > releases.index(pkg_rel[pkg.name].rel) and \
-                        pkg_rel_entry.fixed_version in pkg.versions_binaries
+
+                if curr_pkg_rel_entry.status == 'fixed' and pkg_rel_entry.status == 'fixed':
+                    """Both fixed, we keep the oldest release"""
+                    update = releases.index(pkg.rel) > releases.index(pkg_rel[pkg.name].rel)
                 else:
-                    priority = releases.index(pkg.rel) < releases.index(pkg_rel[pkg.name].rel)
+                    """ If one is not fixed, we keep whichever is the newest release.
+                        A regression may happen in a child.
+                    """
+                    update = releases.index(pkg.rel) < releases.index(pkg_rel[pkg.name].rel)
 
-                if priority:
+                if update:
                     pkg_rel[pkg.name] = pkg
 
         for pkg in self.pkgs: