Merge ~pfsmorigo/ubuntu-cve-tracker:pfsmorigo/add_impact_field into ubuntu-cve-tracker:master

[Paulo Flabiano Smorigo]

This is the changed need in the upload script to send the impact field to the web security API. The support from the web site is working and I tested using a CVE as example:

https://ubuntu.com/security/cves/CVE-2021-21311.json

[Alex Murray (alexmurray)]

LGTM - is there a corresponding web team API change for this?

review: Approve

[Steve Beattie (sbeattie)]

One question:

I see the example json here includes, in addition to the base v3 vector, the exploitabilityScore and impactScore fields, which aren't included in our stored vectors in the CVE tracker, and are not computed as part of cve_lib.parse_cvss(). I see them also referenced in the web team API change for this at https://github.com/canonical/ubuntu-com-security-api/pull/121/files.

I don't see them being computed in the publish-cves-to-website-api.py script, so (a) where are they coming from, and (b) if they aren't coming from the script, is that going to cause a problem when submitting cves with this change?

Also, can you add comments noting that the cvss3 variable contains just the computd base score, and the impact field contains the full base vector? I know that now, but in two weeks I will surely have forgotten, and will likely be confused if I have to diagnose any problems with this script more than two weeks from now.

Thanks!

[Steve Beattie (sbeattie)]

Oh actually, I misunderstood the parse_cvss() api, it is computing these things. Okay, modulo adding some hint comments, this LGTM. Thanks!

review: Approve

[Paulo Flabiano Smorigo (pfsmorigo)]

> LGTM - is there a corresponding web team API change for this?

Yes. The web api accept this new field as you can see in the json like above. The web team will soon change the webpage in order to show those informations.

[Paulo Flabiano Smorigo (pfsmorigo)]

> One question:
>
> I see the example json here includes, in addition to the base v3 vector, the
> exploitabilityScore and impactScore fields, which aren't included in our
> stored vectors in the CVE tracker, and are not computed as part of
> cve_lib.parse_cvss(). I see them also referenced in the web team API change
> for this at https://github.com/canonical/ubuntu-com-security-
> api/pull/121/files.

Hmm, both are calculated in parse_cvss, right?
https://git.launchpad.net/ubuntu-cve-tracker/tree/scripts/cve_lib.py#n2993

This link is the result of the PR I sent to fix the problem of not accepting the impact data.

>
> I don't see them being computed in the publish-cves-to-website-api.py script,
> so (a) where are they coming from, and (b) if they aren't coming from the
> script, is that going to cause a problem when submitting cves with this
> change?
>
> Also, can you add comments noting that the cvss3 variable contains just the
> computd base score, and the impact field contains the full base vector? I know
> that now, but in two weeks I will surely have forgotten, and will likely be
> confused if I have to diagnose any problems with this script more than two
> weeks from now.

Sure, I'll add a comment.

>
> Thanks!

[Paulo Flabiano Smorigo (pfsmorigo)]

> Oh actually, I misunderstood the parse_cvss() api, it is computing these
> things. Okay, modulo adding some hint comments, this LGTM. Thanks!

Oh, sorry about my previous comment! I'll add a comment, tks!!

[Paulo Flabiano Smorigo (pfsmorigo)]

Update the commit with a comment in both fields as requested.

[Steve Beattie (sbeattie)]

Thanks, please commit.

review: Approve

diff --git a/scripts/publish-cves-to-website-api.py b/scripts/publish-cves-to-website-api.py
index 6acc6ea..a591670 100755
--- a/scripts/publish-cves-to-website-api.py
+++ b/scripts/publish-cves-to-website-api.py
@@ -81,18 +81,20 @@ def post_single_cve(cve_filename):
         references.pop(0)
 
     cvss3 = None
+    impact = None
     if len(cve_data["CVSS"]) > 0:
         if "3." in cve_data["CVSS"][0]['vector']:
             # Use CVSS3
             try:
-                c = cve_lib.parse_cvss(cve_data["CVSS"][0]['vector'])
-                cvss3 = c['baseMetricV3']['cvssV3']['baseScore']
+                impact = cve_lib.parse_cvss(cve_data["CVSS"][0]['vector'])
+                cvss3 = impact['baseMetricV3']['cvssV3']['baseScore']
             except ValueError as e:
                 print(
                     "%s: bad CVSS data %s, skipping: %s" % (cve_filename, cve_data["CVSS"][0]['vector'], e),
                     file=sys.stderr
                 )
                 cvss3 = None
+                impact = None
 
     packages = []
     tags = {}
@@ -160,7 +162,8 @@ def post_single_cve(cve_filename):
         "mitigation": cve_data.get("Mitigation", ""),
         "notes": notes,
         "priority": priority,
-        "cvss3": cvss3,  # CVSS vector to convert into Base score
+        "cvss3": cvss3,  # CVSS3 computed base score
+        "impact": impact, # Full CVSS3 base vector structure
         "references": references,
         "bugs": cve_data["Bugs"].strip().split("\n"),
         "packages": packages,