summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core/meta/cve-update-db-native.bb
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-core/meta/cve-update-db-native.bb')
-rw-r--r--meta/recipes-core/meta/cve-update-db-native.bb218
1 files changed, 0 insertions, 218 deletions
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
deleted file mode 100644
index cf62e1e32c..0000000000
--- a/meta/recipes-core/meta/cve-update-db-native.bb
+++ /dev/null
@@ -1,218 +0,0 @@
1SUMMARY = "Updates the NVD CVE database"
2LICENSE = "MIT"
3
4INHIBIT_DEFAULT_DEPS = "1"
5
6inherit native
7
8deltask do_unpack
9deltask do_patch
10deltask do_configure
11deltask do_compile
12deltask do_install
13deltask do_populate_sysroot
14
15python () {
16 if not bb.data.inherits_class("cve-check", d):
17 raise bb.parse.SkipRecipe("Skip recipe when cve-check class is not loaded.")
18}
19
20python do_fetch() {
21 """
22 Update NVD database with json data feed
23 """
24 import bb.utils
25 import bb.progress
26 import sqlite3, urllib, urllib.parse, gzip
27 from datetime import date
28
29 bb.utils.export_proxies(d)
30
31 BASE_URL = "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-"
32 YEAR_START = 2002
33
34 db_file = d.getVar("CVE_CHECK_DB_FILE")
35 db_dir = os.path.dirname(db_file)
36
37 if os.path.exists("{0}-journal".format(db_file)):
38 # If a journal is present the last update might have been interrupted. In that case,
39 # just wipe any leftovers and force the DB to be recreated.
40 os.remove("{0}-journal".format(db_file))
41
42 if os.path.exists(db_file):
43 os.remove(db_file)
44
45 # Don't refresh the database more than once an hour
46 try:
47 import time
48 if time.time() - os.path.getmtime(db_file) < (60*60):
49 bb.debug(2, "Recently updated, skipping")
50 return
51 except OSError:
52 pass
53
54 bb.utils.mkdirhier(db_dir)
55
56 # Connect to database
57 conn = sqlite3.connect(db_file)
58 c = conn.cursor()
59
60 initialize_db(c)
61
62 with bb.progress.ProgressHandler(d) as ph, open(os.path.join(d.getVar("TMPDIR"), 'cve_check'), 'a') as cve_f:
63 total_years = date.today().year + 1 - YEAR_START
64 for i, year in enumerate(range(YEAR_START, date.today().year + 1)):
65 bb.debug(2, "Updating %d" % year)
66 ph.update((float(i + 1) / total_years) * 100)
67 year_url = BASE_URL + str(year)
68 meta_url = year_url + ".meta"
69 json_url = year_url + ".json.gz"
70
71 # Retrieve meta last modified date
72 try:
73 response = urllib.request.urlopen(meta_url)
74 except urllib.error.URLError as e:
75 cve_f.write('Warning: CVE db update error, Unable to fetch CVE data.\n\n')
76 bb.warn("Failed to fetch CVE data (%s)" % e.reason)
77 return
78
79 if response:
80 for l in response.read().decode("utf-8").splitlines():
81 key, value = l.split(":", 1)
82 if key == "lastModifiedDate":
83 last_modified = value
84 break
85 else:
86 bb.warn("Cannot parse CVE metadata, update failed")
87 return
88
89 # Compare with current db last modified date
90 c.execute("select DATE from META where YEAR = ?", (year,))
91 meta = c.fetchone()
92 if not meta or meta[0] != last_modified:
93 bb.debug(2, "Updating entries")
94 # Clear products table entries corresponding to current year
95 c.execute("delete from PRODUCTS where ID like ?", ('CVE-%d%%' % year,))
96
97 # Update db with current year json file
98 try:
99 response = urllib.request.urlopen(json_url)
100 if response:
101 update_db(c, gzip.decompress(response.read()).decode('utf-8'))
102 c.execute("insert or replace into META values (?, ?)", [year, last_modified])
103 except urllib.error.URLError as e:
104 cve_f.write('Warning: CVE db update error, CVE data is outdated.\n\n')
105 bb.warn("Cannot parse CVE data (%s), update failed" % e.reason)
106 return
107 else:
108 bb.debug(2, "Already up to date (last modified %s)" % last_modified)
109 # Update success, set the date to cve_check file.
110 if year == date.today().year:
111 cve_f.write('CVE database update : %s\n\n' % date.today())
112
113 conn.commit()
114 conn.close()
115}
116
117do_fetch[lockfiles] += "${CVE_CHECK_DB_FILE_LOCK}"
118do_fetch[file-checksums] = ""
119do_fetch[vardeps] = ""
120
121def initialize_db(c):
122 c.execute("CREATE TABLE IF NOT EXISTS META (YEAR INTEGER UNIQUE, DATE TEXT)")
123
124 c.execute("CREATE TABLE IF NOT EXISTS NVD (ID TEXT UNIQUE, SUMMARY TEXT, \
125 SCOREV2 TEXT, SCOREV3 TEXT, MODIFIED INTEGER, VECTOR TEXT)")
126
127 c.execute("CREATE TABLE IF NOT EXISTS PRODUCTS (ID TEXT, \
128 VENDOR TEXT, PRODUCT TEXT, VERSION_START TEXT, OPERATOR_START TEXT, \
129 VERSION_END TEXT, OPERATOR_END TEXT)")
130 c.execute("CREATE INDEX IF NOT EXISTS PRODUCT_ID_IDX on PRODUCTS(ID);")
131
132def parse_node_and_insert(c, node, cveId):
133 # Parse children node if needed
134 for child in node.get('children', ()):
135 parse_node_and_insert(c, child, cveId)
136
137 def cpe_generator():
138 for cpe in node.get('cpe_match', ()):
139 if not cpe['vulnerable']:
140 return
141 cpe23 = cpe['cpe23Uri'].split(':')
142 vendor = cpe23[3]
143 product = cpe23[4]
144 version = cpe23[5]
145
146 if version != '*' and version != '-':
147 # Version is defined, this is a '=' match
148 yield [cveId, vendor, product, version, '=', '', '']
149 elif version == '-':
150 # no version information is available
151 yield [cveId, vendor, product, version, '', '', '']
152 else:
153 # Parse start version, end version and operators
154 op_start = ''
155 op_end = ''
156 v_start = ''
157 v_end = ''
158
159 if 'versionStartIncluding' in cpe:
160 op_start = '>='
161 v_start = cpe['versionStartIncluding']
162
163 if 'versionStartExcluding' in cpe:
164 op_start = '>'
165 v_start = cpe['versionStartExcluding']
166
167 if 'versionEndIncluding' in cpe:
168 op_end = '<='
169 v_end = cpe['versionEndIncluding']
170
171 if 'versionEndExcluding' in cpe:
172 op_end = '<'
173 v_end = cpe['versionEndExcluding']
174
175 if op_start or op_end or v_start or v_end:
176 yield [cveId, vendor, product, v_start, op_start, v_end, op_end]
177 else:
178 # This is no version information, expressed differently.
179 # Save processing by representing as -.
180 yield [cveId, vendor, product, '-', '', '', '']
181
182 c.executemany("insert into PRODUCTS values (?, ?, ?, ?, ?, ?, ?)", cpe_generator())
183
184def update_db(c, jsondata):
185 import json
186 root = json.loads(jsondata)
187
188 for elt in root['CVE_Items']:
189 if not elt['impact']:
190 continue
191
192 accessVector = None
193 cveId = elt['cve']['CVE_data_meta']['ID']
194 cveDesc = elt['cve']['description']['description_data'][0]['value']
195 date = elt['lastModifiedDate']
196 try:
197 accessVector = elt['impact']['baseMetricV2']['cvssV2']['accessVector']
198 cvssv2 = elt['impact']['baseMetricV2']['cvssV2']['baseScore']
199 except KeyError:
200 cvssv2 = 0.0
201 try:
202 accessVector = accessVector or elt['impact']['baseMetricV3']['cvssV3']['attackVector']
203 cvssv3 = elt['impact']['baseMetricV3']['cvssV3']['baseScore']
204 except KeyError:
205 accessVector = accessVector or "UNKNOWN"
206 cvssv3 = 0.0
207
208 c.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?)",
209 [cveId, cveDesc, cvssv2, cvssv3, date, accessVector])
210
211 configurations = elt['configurations']['nodes']
212 for config in configurations:
213 parse_node_and_insert(c, config, cveId)
214
215
216do_fetch[nostamp] = "1"
217
218EXCLUDE_FROM_WORLD = "1"