feat(cve/mitre): support go-cve-dictionary:mitre

[MaineK00n]

What did you implement:

A new mitre will be added to the go-cve-dictionary data source. https://github.com/vulsio/go-cve-dictionary/pull/392

mitre includes CVSSv4 and SSVC evaluations by CISA ADP, and this information is added to the detected vulnerabilities.

Type of change

• [x] New feature (non-breaking change which adds functionality)

How Has This Been Tested?

$ go-cve-dictionary fetch mitre 2024
$ go-cve-dictionary fetch nvd 2024

$ cat config.toml
...
[servers]
[servers.pseudo]
type = "pseudo"
cpeNames = [
"cpe:2.3:a:clashforwindows:clash:0.1.0:*:*:*:*:windows:*:*"
]

$ vuls scan
$ vuls report
$ cat results/2024-06-27T22-16-01+0900/pseudo.json | jq '.scannedCves[].cveContents.mitre'
[
  {
    "type": "mitre",
    "cveID": "CVE-2024-5732",
    "title": "Clash Proxy Port improper authentication",
    "summary": "A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability.",
    "cvss2Score": 7.5,
    "cvss2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
    "cvss2Severity": "",
    "cvss3Score": 7.3,
    "cvss3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
    "cvss3Severity": "HIGH",
    "cvss40Score": 6.9,
    "cvss40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
    "cvss40Severity": "MEDIUM",
    "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2024-5732",
    "references": [
      {
        "link": "https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.md",
        "tags": [
          "exploit"
        ]
      },
      {
        "link": "https://vuldb.com/?ctiid.267406",
        "tags": [
          "permissions-required",
          "signature"
        ]
      },
      {
        "link": "https://vuldb.com/?id.267406",
        "tags": [
          "vdb-entry"
        ]
      },
      {
        "link": "https://vuldb.com/?submit.345469",
        "tags": [
          "third-party-advisory"
        ]
      }
    ],
    "cweIDs": [
      "CWE-287"
    ],
    "published": "2024-06-07T10:00:04.02Z",
    "lastModified": "2024-06-07T14:50:46.944Z",
    "optional": {
      "source": "CNA:VulDB"
    }
  },
  {
    "type": "mitre",
    "cveID": "CVE-2024-5732",
    "title": "CISA ADP Vulnrichment",
    "summary": "",
    "cvss2Score": 0,
    "cvss2Vector": "",
    "cvss2Severity": "",
    "cvss3Score": 0,
    "cvss3Vector": "",
    "cvss3Severity": "",
    "cvss40Score": 0,
    "cvss40Vector": "",
    "cvss40Severity": "",
    "ssvc": {
      "exploitation": "none",
      "automatable": "no",
      "technical_impact": "partial"
    },
    "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2024-5732",
    "published": "2024-06-07T10:00:04.02Z",
    "lastModified": "2024-06-07T14:50:46.944Z",
    "optional": {
      "source": "ADP:CISA-ADP"
    }
  }
]

• vuls tui

• vuls report --format-full-text

Checklist:

You don't have to satisfy all of the following.

• [x] Write tests
• [ ] Write documentation
• [x] Check that there aren't other open pull requests for the same issue/feature
• [x] Format your source code by make fmt
• [x] Pass the test by make test
• [x] Provide verification config / commands
• [x] Enable "Allow edits from maintainers" for this PR
• [x] Update the messages below

Is this ready for review?: YES

Reference

• https://github.com/vulsio/go-cve-dictionary/pull/392

[shino]

Just a function name thing:

// FillCvesWithNvdJvnFortinet fills CVE detail with NVD, JVN, Fortinet
func FillCvesWithNvdJvnFortinet(r *models.ScanResult, cnf config.GoCveDictConf, logOpts logging.LogOpts) (err error) {

"and MITRE" ?

[MaineK00n]

Just a function name thing:

// FillCvesWithNvdJvnFortinet fills CVE detail with NVD, JVN, Fortinet
func FillCvesWithNvdJvnFortinet(r *models.ScanResult, cnf config.GoCveDictConf, logOpts logging.LogOpts) (err error) {

"and MITRE" ?

FillCvesWithGoCVEDictionary

[MaineK00n]

@shino please review this commit :pray: https://github.com/future-architect/vuls/pull/1978/commits/3a69be5a1f5d48cec9746d8f960449b5aa218a27