Upstream SUSE OVAL archives and CVSS data is changing

anchore / vunnel

Tool for collecting vulnerability data from various sources (used to build the grype database)

Apache License 2.0

63 stars 23 forks source link

Upstream SUSE OVAL archives and CVSS data is changing #571

Closed msmeissn closed 6 days ago

msmeissn commented 2 months ago

What would you like to be added:

You can download SUSE oval data now .bz2 compressed. We plan to discontinue the .gz compressed data.
We changed the severity impact mappings. We now use the CVSS v3.1 offical values: low, medium, high, critical

Why is this needed:

changes on SUSE side.

Additional context:

msmeissn commented 2 months ago

CVE lines now look like:

        <cve impact="high" cvss3="7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" href="https://www.suse.com/security/cve/CVE-2002-20001/">CVE-2002-20001 at SUSE</cve>
        <cve impact="high" cvss3="7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" href="https://nvd.nist.gov/vuln/detail/CVE-2002-20001">CVE-2002-20001 at NVD</cve>

tgerla commented 2 months ago

Hi @msmeissn, thank you for the heads up. When will the .gz files stop being generated? It should be an easy enough change on our side but it would be helpful to know when the change will happen. Thanks!

Dev note: change .gz to .bz2 here: https://github.com/anchore/vunnel/blob/44df4e25300a4450211301f7349c0ec8c891e026/src/vunnel/providers/sles/parser.py#L49

spiffcs commented 2 months ago

Dev Note: We can find the new listing of .bz2 files here

kzantow commented 2 months ago

Also, it looks like we will need to update the severities here:

https://github.com/anchore/vunnel/blob/main/src/vunnel/providers/sles/parser.py#L39

msmeissn commented 2 months ago

I currently have no timeline for discontinuing .gz format, as I do not know all the users. So at least a year I would say