[PATCH] Fix parsing of FKIE CVEs
[email protected] Wed, 30 Jul 2025 05:42:12 -0700
| Newsgroups | org.yoctoproject.lists.poky |
|---|---|
| Message-ID | <[email protected]> |
Hi all, I noticed issues with the parsing of CVEs from the FKIE-CAD feed (update_db_fkie() in cve-update-db-native.bb)s: - It tries to read an accessVector for CVSS v3 & v4 while the attribute is actually called attackVector. - It ignores metrics with type "Secondary" even if there is no"Primary". This leads to a lot of CVEs with accessVector, vectorString and score set to UNKNOWN/None/0. The bug is in master and has been there since FKIE was introduced. I attached patches to fix the issue.
0002-cve-update-db-native-FKIE-CVE-parsing-Use-Secondary-.patch
(application/octet-stream, 4.3 KB)
From 000980cd55d94e929107d4e28a3a87fe29d27e1a Mon Sep 17 00:00:00 2001 From: Jonathan Schnitzler <[email protected]> Date: Wed, 30 Jul 2025 14:28:51 +0200 Subject: [PATCH 2/2] cve-update-db-native: FKIE CVE parsing: Use Secondary metric If there is no primary metric use the Secondary one. Signed-off-by: Jonathan Schnitzler <[email protected]> --- .../recipes-core/meta/cve-update-db-native.bb | 53 ++++++++++++------- 1 file changed, 33 insertions(+), 20 deletions(-) diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb index c8e74bd27e..58b791d999 100644 --- a/meta/recipes-core/meta/cve-update-db-native.bb +++ b/meta/recipes-core/meta/cve-update-db-native.bb @@ -330,6 +330,15 @@ def update_db_nvdjson(conn, jsondata): for config in configurations: parse_node_and_insert(conn, config, cveId, True) +def get_metric_entry(metric): + primaries = [c for c in metric if c['type'] == "Primary"] + secondaries = [c for c in metric if c['type'] == "Secondary"] + if len(primaries) > 0: + return primaries[0] + elif len(secondaries)>0: + return secondaries[0] + return None + def update_db_fkie(conn, jsondata): import json root = json.loads(jsondata) @@ -350,37 +359,41 @@ def update_db_fkie(conn, jsondata): cveDesc = elt['descriptions'][0]['value'] date = elt['lastModified'] try: - for m in elt['metrics']['cvssMetricV2']: - if m['type'] == 'Primary': - accessVector = m['cvssData']['accessVector'] - vectorString = m['cvssData']['vectorString'] - cvssv2 = m['cvssData']['baseScore'] + if 'cvssMetricV2' in elt['metrics']: + entry = get_metric_entry(elt['metrics']['cvssMetricV2']) + if entry: + accessVector = entry['cvssData']['accessVector'] + vectorString = entry['cvssData']['vectorString'] + cvssv2 = entry['cvssData']['baseScore'] except KeyError: cvssv2 = 0.0 try: - for m in elt['metrics']['cvssMetricV30']: - if m['type'] == 'Primary': - accessVector = m['cvssData']['attackVector'] - vectorString = m['cvssData']['vectorString'] - cvssv3 = m['cvssData']['baseScore'] + if 'cvssMetricV30' in elt['metrics']: + entry = get_metric_entry(elt['metrics']['cvssMetricV30']) + if entry: + accessVector = entry['cvssData']['attackVector'] + vectorString = entry['cvssData']['vectorString'] + cvssv3 = entry['cvssData']['baseScore'] except KeyError: accessVector = accessVector or "UNKNOWN" cvssv3 = 0.0 try: - for m in elt['metrics']['cvssMetricV31']: - if m['type'] == 'Primary': - accessVector = m['cvssData']['attackVector'] - vectorString = m['cvssData']['vectorString'] - cvssv3 = m['cvssData']['baseScore'] + if 'cvssMetricV31' in elt['metrics']: + entry = get_metric_entry(elt['metrics']['cvssMetricV31']) + if entry: + accessVector = entry['cvssData']['attackVector'] + vectorString = entry['cvssData']['vectorString'] + cvssv3 = entry['cvssData']['baseScore'] except KeyError: accessVector = accessVector or "UNKNOWN" cvssv3 = 0.0 try: - for m in elt['metrics']['cvssMetricV40']: - if m['type'] == 'Primary': - accessVector = m['cvssData']['attackVector'] - vectorString = m['cvssData']['vectorString'] - cvssv4 = m['cvssData']['baseScore'] + if 'cvssMetricV40' in elt['metrics']: + entry = get_metric_entry(elt['metrics']['cvssMetricV40']) + if entry: + accessVector = entry['cvssData']['attackVector'] + vectorString = entry['cvssData']['vectorString'] + cvssv4 = entry['cvssData']['baseScore'] except KeyError: accessVector = accessVector or "UNKNOWN" cvssv4 = 0.0 -- 2.50.1
0001-cve-update-db-native-Fix-FKIE-CVE-accessVector-parsi.patch
(application/octet-stream, 2.1 KB)
From cc51283469ce1ceae4d2d798a3ec1767d76b69bb Mon Sep 17 00:00:00 2001 From: Jonathan Schnitzler <[email protected]> Date: Wed, 30 Jul 2025 14:27:03 +0200 Subject: [PATCH 1/2] cve-update-db-native: Fix FKIE CVE accessVector parsing Use "attackVector" for CVSS >= 3 as it only CVSS v2 uses "accessVector". Signed-off-by: Jonathan Schnitzler <[email protected]> --- meta/recipes-core/meta/cve-update-db-native.bb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb index 86cd1a1a21..c8e74bd27e 100644 --- a/meta/recipes-core/meta/cve-update-db-native.bb +++ b/meta/recipes-core/meta/cve-update-db-native.bb @@ -360,7 +360,7 @@ def update_db_fkie(conn, jsondata): try: for m in elt['metrics']['cvssMetricV30']: if m['type'] == 'Primary': - accessVector = m['cvssData']['accessVector'] + accessVector = m['cvssData']['attackVector'] vectorString = m['cvssData']['vectorString'] cvssv3 = m['cvssData']['baseScore'] except KeyError: @@ -369,7 +369,7 @@ def update_db_fkie(conn, jsondata): try: for m in elt['metrics']['cvssMetricV31']: if m['type'] == 'Primary': - accessVector = m['cvssData']['accessVector'] + accessVector = m['cvssData']['attackVector'] vectorString = m['cvssData']['vectorString'] cvssv3 = m['cvssData']['baseScore'] except KeyError: @@ -378,7 +378,7 @@ def update_db_fkie(conn, jsondata): try: for m in elt['metrics']['cvssMetricV40']: if m['type'] == 'Primary': - accessVector = m['cvssData']['accessVector'] + accessVector = m['cvssData']['attackVector'] vectorString = m['cvssData']['vectorString'] cvssv4 = m['cvssData']['baseScore'] except KeyError: -- 2.50.1