1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Extracts the data from the security tracker and creates OVAL queries to
# be used with the OVAL query interpreter (see http://oval.mitre.org)
# (c) 2016 Sebastien Delafond <sdelafond@gmail.com>
# (c) 2015 Nicholas Luedtke
# Licensed under the GNU General Public License version 2.
import os
from subprocess import call
import sys
import logging
import argparse
import json
from datetime import date
import oval.definition.generator
from oval.parser import dsa
from oval.parser import wml
dsaref = {}
# TODO: these may need changed or reworked.
DEBIAN_VERSION = {"wheezy" : "7.0", "jessie" : "8.2", "stretch" : "9.0",
"sid" : "9.0", "etch" : "4.0", "squeeze":"6.0", "lenny":"5.0"}
def usage (prog = "parse-wml-oval.py"):
"""Print information about script flags and options"""
print """usage: %s [vh] [-d <directory>]\t-d\twhich directory use for
dsa definition search\t-v\tverbose mode\t-h\tthis help""" % prog
def printdsas(dsaref):
""" Generate and print OVAL Definitions for collected DSA information """
ovalDefinitions = oval.definition.generator.createOVALDefinitions (dsaref)
oval.definition.generator.printOVALDefinitions (ovalDefinitions)
def parseJSON(json_data, year):
"""
Parse the JSON data and extract information needed for OVAL definitions
:param json_data: Json_Data
:return:
"""
today = date.today()
logging.log(logging.DEBUG, "Start of JSON Parse.")
for package in json_data:
logging.log(logging.DEBUG, "Parsing package %s" % package)
for CVE in json_data[package]:
if CVE.find(year) < 0:
continue
logging.log(logging.DEBUG, "Getting releases for %s" % CVE)
release = {}
for rel in json_data[package][CVE]['releases']:
if json_data[package][CVE]['releases'][rel]['status'] != \
'resolved':
fixed_v = '0'
f_str = 'no'
else:
fixed_v = json_data[package][CVE]['releases'][rel]['fixed_version']
f_str = 'yes'
release.update({DEBIAN_VERSION[rel]: {u'all': {
package: fixed_v}}})
# print json.dumps(json_data[package][CVE])
# sys.exit(1)
ovalId = oval.definition.generator.getOvalId(CVE)
dsaref.update({ovalId: {"packages": package,
'description': CVE, # "title" element in XML
'vulnerable': "yes",
'date': str(today.isoformat()),
'fixed': f_str,
'actualDescription': json_data[package][CVE].get("description",""),
'moreinfo': "",
'release': release, 'secrefs': CVE}})
logging.log(logging.DEBUG, "Created entry in dsaref %s" % ovalId)
def get_json_data(json_file):
"""
Retrieves JSON formatted data from a file.
:param json_file:
:return: JSON data (dependent on the file loaded, usually a dictionary.)
"""
logging.log(logging.DEBUG, "Extracting JSON file %s" % json_file)
with open(json_file, "r") as json_d:
d = json.load(json_d)
return d
def main(args):
"""
Main function for parseJSON2Oval.py
:param args:
:return:
"""
if args['verbose']:
logging.basicConfig(level=logging.DEBUG)
else:
logging.basicConfig(level=logging.WARNING)
# unpack args
json_file = args['JSONfile']
temp_file = args['tmp']
year = args['year']
if json_file:
json_data = get_json_data(json_file)
else:
logging.log(logging.DEBUG, "Preparing to download JSONfile")
if os.path.isfile(temp_file):
logging.log(logging.WARNING, "Removing file %s" % temp_file)
os.remove(temp_file)
logging.log(logging.DEBUG, "Issuing wget for JSON file")
args = ['wget', 'https://security-tracker.debian.org/tracker/data/json',
'-O', temp_file]
call(args)
logging.log(logging.DEBUG, "File %s received" % temp_file)
json_data = get_json_data(temp_file)
if os.path.isfile(temp_file):
logging.log(logging.DEBUG, "Removing file %s" % temp_file)
os.remove(temp_file)
parseJSON(json_data, year)
#parsedirs (opts['-d'], '.data', 2)
logging.log(logging.INFO, "Finished parsing JSON data")
printdsas(dsaref)
if __name__ == "__main__":
PARSER = argparse.ArgumentParser(description='Generates oval definitions '
'from the JSON file used to '
'build the Debian Security '
'Tracker.')
PARSER.add_argument('-v', '--verbose', help='Verbose Mode',
action="store_true")
PARSER.add_argument('-j', '--JSONfile', type=str,
help='Local JSON file to use. This will use a local '
'copy of the JSON file instead of downloading from'
' it from the server. default=none', default=None)
PARSER.add_argument('-t', '--tmp', type=str,
help='Temporary file to download JSON file to. Warning:'
' if this file already exists it will be removed '
'prior to downloading the JSON file. default= '
'./DebSecTrackTMP.t', default='./DebSecTrackTMP.t')
PARSER.add_argument('-y', '--year', type=str,
help='Limit to this year. default= ' '2016', default='2016')
PARSER.add_argument('-i', '--id', type=int,
help='id number to start defintions at. default=100',
default=100)
ARGS = vars(PARSER.parse_args())
main(ARGS)
|
