cve_schema 0.1.0

data/spec/data_meta_spec.rb

@@ -0,0 +1,167 @@
+require 'spec_helper'
+require 'shared_examples'
+require 'cve_schema/cve/data_meta'
+
+describe CVESchema::CVE::DataMeta do
+  describe "#initialize" do
+    let(:id)       { CVESchema::CVE::ID.parse('CVE-2021-9999') }
+    let(:assigner) { 'foo@example.com' }
+
+    describe "required keywords" do
+      context "when id: is not given" do
+        it do
+          expect {
+            described_class.new(assigner: assigner)
+          }.to raise_error(ArgumentError)
+        end
+      end
+
+      context "when assigner: is not given" do
+        it do
+          expect {
+            described_class.new(id: id)
+          }.to raise_error(ArgumentError)
+        end
+      end
+    end
+
+    context "when updated: is given" do
+      let(:updated) { Time.now }
+
+      subject do
+        described_class.new(id: id, assigner: assigner, updated: updated)
+      end
+
+      it "must set #updated" do
+        expect(subject.updated).to eq(updated)
+      end
+    end
+  end
+
+  describe ".load" do
+    include_examples ".load"
+
+    let(:json_node) { json_tree['CVE_data_meta'] }
+
+    context '"ID":' do
+      let(:json_value) { json_node['ID'] }
+      let(:expected)   { CVESchema::CVE::ID.parse(json_value) }
+
+      it 'must parse the "ID": CVE ID and set #id' do
+        expect(subject.id).to eq(expected)
+      end
+
+      context 'when the "ID" key is missing' do
+        before { json_node.delete('ID') }
+
+        it do
+          expect {
+            described_class.load(json_node)
+          }.to raise_error(CVESchema::CVE::MissingJSONKey)
+        end
+      end
+    end
+
+    context '"ASSIGNER":' do
+      it "must set #assigner" do
+        expect(subject.assigner).to eq(json_node['ASSIGNER'])
+      end
+
+      context 'when the "ASSIGNER" key is missing' do
+        before { json_node.delete('ASSIGNER') }
+
+        it do
+          expect {
+            described_class.load(json_node)
+          }.to raise_error(CVESchema::CVE::MissingJSONKey)
+        end
+      end
+    end
+
+    context '"UPDATED":' do
+      pending 'need to find a CVE with the "UPDATED": key' do
+        let(:json_value) { json_node['UPDATED'] }
+        let(:expected)   { CVESchema::CVE::Timestamp.parse(json_value) }
+
+        it 'must parse the "UPDATED": Timestamp and set #updated' do
+          expect(subject.updated).to eq(expected)
+        end
+      end
+    end
+
+    context '"SERIAL":' do
+      pending 'need to find a CVE with the "SERIAL": key' do
+        it "must set #serial" do
+          expect(subject.serial).to eq(json_node['SERIAL'])
+        end
+      end
+    end
+
+    context '"DATE_REQUESTED":' do
+      pending 'need to find a CVE with the "DATE_REQUESTED": key' do
+        let(:json_value) { json_node['DATE_REQUESTED'] }
+        let(:expected)   { CVESchema::CVE::Timestamp.parse(json_value) }
+
+        it 'must parse the "DATE_REQUESTED": Timestamp and set #date_requested' do
+          expect(subject.date_requested).to eq(expected)
+        end
+      end
+    end
+
+    context '"DATE_ASSIGNED":' do
+      pending 'need to find a CVE with the "DATE_ASSIGNED": key' do
+        let(:json_value) { json_node['DATE_ASSIGNED'] }
+        let(:expected)   { CVESchema::CVE::Timestamp.parse(json_value) }
+
+        it 'must parse the "DATE_ASSIGNED": Timestamp and set #date_assigned' do
+          expect(subject.date_assigned).to eq(expected)
+        end
+      end
+    end
+
+    context '"DATE_PUBLIC":' do
+      let(:json_value) { json_node['DATE_PUBLIC'] }
+      let(:expected)   { CVESchema::CVE::Timestamp.parse(json_value) }
+
+      it 'must parse the "DATE_PUBLIC": Timestamp and set #date_public' do
+        expect(subject.date_public).to eq(expected)
+      end
+    end
+
+    context '"STATE":' do
+      let(:json_value) { json_node['STATE'] }
+      let(:expected)   { json_value.to_sym  }
+
+      it 'must parse the "STATE": value and set #state' do
+        expect(subject.state).to eq(expected)
+      end
+    end
+
+    context '"TITLE":' do
+      it "must set #title" do
+        expect(subject.title).to eq(json_node['TITLE'])
+      end
+    end
+
+    context '"REQUESTER":' do
+      pending 'need to find a CVE with the "REQUESTED": key' do
+        it "must set #serial" do
+          expect(subject.serial).to eq(json_node['REQUESTER'])
+        end
+      end
+    end
+
+    context '"REPLACED_BY":' do
+      pending 'need to find a CVE with the "REPLACED_BY": key' do
+        let(:json_value) { json_node['REPLACED_BY'] }
+        let(:expected) do
+          json_value.split(',').map(&CVESchema::CVE::ID.method(:parse))
+        end
+
+        it 'must parse the "REPLACED_BY": String of IDs and set #replaced_by' do
+          expect(subject.replaced_by).to eq(expected)
+        end
+      end
+    end
+  end
+end

data/spec/description.rb

@@ -0,0 +1,24 @@
+require 'spec_helper'
+require 'cve_schema/cve/description'
+
+describe CVESchema::CVE::Description do
+  it { expect(described_class).to include(CVESchema::CVE::HasLangValue) }
+
+  describe "#na?" do
+    let(:lang) { 'eng' }
+
+    subject { described_class.new(lang: lang, value: value) }
+
+    context "when value is 'n/a'" do
+      let(:value) { 'n/a' }
+
+      it { expect(subject.na?).to be(true) }
+    end
+
+    context "when value is not 'n/a'" do
+      let(:value) { 'foo' }
+
+      it { expect(subject.na?).to be(false) }
+    end
+  end
+end

data/spec/exploit_spec.rb

@@ -0,0 +1,6 @@
+require 'spec_helper'
+require 'cve_schema/cve/exploit'
+
+describe CVESchema::CVE::Exploit do
+  it { expect(described_class).to include(CVESchema::CVE::HasLangValue) }
+end

data/spec/fixtures/CVE-2020-1994.json

@@ -0,0 +1,140 @@
+{
+    "CVE_data_meta": {
+        "ASSIGNER": "psirt@paloaltonetworks.com",
+        "DATE_PUBLIC": "2020-05-13T16:00:00.000Z",
+        "ID": "CVE-2020-1994",
+        "STATE": "PUBLIC",
+        "TITLE": "PAN-OS: Predictable temporary file vulnerability"
+    },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "PAN-OS",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_affected": "<",
+                                            "version_name": "8.1",
+                                            "version_value": "8.1.13"
+                                        },
+                                        {
+                                            "version_affected": "<",
+                                            "version_name": "9.0",
+                                            "version_value": "9.0.7"
+                                        },
+                                        {
+                                            "version_affected": "=",
+                                            "version_name": "7.1",
+                                            "version_value": "7.1.*"
+                                        },
+                                        {
+                                            "version_affected": "=",
+                                            "version_name": "8.0",
+                                            "version_value": "8.0.*"
+                                        },
+                                        {
+                                            "version_affected": "!>=",
+                                            "version_name": "8.1",
+                                            "version_value": "8.1.13"
+                                        },
+                                        {
+                                            "version_affected": "!>=",
+                                            "version_name": "9.0",
+                                            "version_value": "9.0.7"
+                                        },
+                                        {
+                                            "version_affected": "!>=",
+                                            "version_name": "9.1",
+                                            "version_value": "9.1.0"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "Palo Alto Networks"
+                }
+            ]
+        }
+    },
+    "credit": [
+        {
+            "lang": "eng",
+            "value": "This issue was found by a customer."
+        }
+    ],
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
+    "description": {
+        "description_data": [
+            {
+                "lang": "eng",
+                "value": "A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7."
+            }
+        ]
+    },
+    "generator": {
+        "engine": "Vulnogram 0.0.9"
+    },
+    "impact": {
+        "cvss": {
+            "attackComplexity": "HIGH",
+            "attackVector": "LOCAL",
+            "availabilityImpact": "NONE",
+            "baseScore": 4.1,
+            "baseSeverity": "MEDIUM",
+            "confidentialityImpact": "NONE",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "HIGH",
+            "scope": "UNCHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
+            "version": "3.1"
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-377 Insecure Temporary File"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "refsource": "MISC",
+                "url": "https://security.paloaltonetworks.com/CVE-2020-1994",
+                "name": "https://security.paloaltonetworks.com/CVE-2020-1994"
+            }
+        ]
+    },
+    "solution": [
+        {
+            "lang": "eng",
+            "value": "This issue is fixed in PAN-OS 8.1.13, PAN-OS 9.0.7, PAN-OS 9.1.0, and all later PAN-OS versions.\n\nPAN-OS 8.0 is now end-of-life as of October 31, 2019, and is no longer covered by our Product Security Assurance policies.\n\nPAN-OS 7.1 is on extended support until June 30, 2020, and is only being considered for critical security vulnerability fixes."
+        }
+    ],
+    "source": {
+        "defect": [
+            "PAN-123391"
+        ],
+        "discovery": "USER"
+    },
+    "timeline": [
+        {
+            "lang": "eng",
+            "time": "2020-05-13T16:00:00.000Z",
+            "value": "Initial publication"
+        }
+    ]
+}

data/spec/fixtures/CVE-2020-2005.json

@@ -0,0 +1,152 @@
+{
+    "CVE_data_meta": {
+        "ASSIGNER": "psirt@paloaltonetworks.com",
+        "DATE_PUBLIC": "2020-05-13T16:00:00.000Z",
+        "ID": "CVE-2020-2005",
+        "STATE": "PUBLIC",
+        "TITLE": "PAN-OS: GlobalProtect Clientless VPN session hijacking"
+    },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "PAN-OS",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_affected": "<",
+                                            "version_name": "7.1",
+                                            "version_value": "7.1.26"
+                                        },
+                                        {
+                                            "version_affected": "<",
+                                            "version_name": "8.1",
+                                            "version_value": "8.1.13"
+                                        },
+                                        {
+                                            "version_affected": "<",
+                                            "version_name": "9.0",
+                                            "version_value": "9.0.7"
+                                        },
+                                        {
+                                            "version_affected": "!>=",
+                                            "version_name": "7.1",
+                                            "version_value": "7.1.26"
+                                        },
+                                        {
+                                            "version_affected": "!>=",
+                                            "version_name": "8.1",
+                                            "version_value": "8.1.13"
+                                        },
+                                        {
+                                            "version_affected": "!>=",
+                                            "version_name": "9.0",
+                                            "version_value": "9.0.7"
+                                        },
+                                        {
+                                            "version_affected": "=",
+                                            "version_name": "8.0",
+                                            "version_value": "8.0.*"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "Palo Alto Networks"
+                }
+            ]
+        }
+    },
+    "configuration": [
+        {
+            "lang": "eng",
+            "value": "This issue only affects firewalls configured with GlobalProtect Clientless VPN."
+        }
+    ],
+    "credit": [
+        {
+            "lang": "eng",
+            "value": "This issue was discovered by Ron Masas of Palo Alto Networks during internal security review."
+        }
+    ],
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
+    "description": {
+        "description_data": [
+            {
+                "lang": "eng",
+                "value": "A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; All versions of PAN-OS 8.0."
+            }
+        ]
+    },
+    "generator": {
+        "engine": "Vulnogram 0.0.9"
+    },
+    "impact": {
+        "cvss": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "NONE",
+            "baseScore": 7.1,
+            "baseSeverity": "HIGH",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "LOW",
+            "privilegesRequired": "NONE",
+            "scope": "UNCHANGED",
+            "userInteraction": "REQUIRED",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
+            "version": "3.1"
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-79 Cross-site Scripting (XSS)"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "refsource": "MISC",
+                "url": "https://security.paloaltonetworks.com/CVE-2020-2005",
+                "name": "https://security.paloaltonetworks.com/CVE-2020-2005"
+            }
+        ]
+    },
+    "solution": [
+        {
+            "lang": "eng",
+            "value": "This issue is fixed in PAN-OS 7.1.26, PAN-OS 8.1.13, PAN-OS 9.0.7, and all later versions of PAN-OS.\n\nPAN-OS 8.0 is now end-of-life as of October 31, 2019, and is no longer covered by our Product Security Assurance policies."
+        }
+    ],
+    "source": {
+        "defect": [
+            "GPCON-551"
+        ],
+        "discovery": "INTERNAL"
+    },
+    "timeline": [
+        {
+            "lang": "eng",
+            "time": "2020-05-13T16:00:00.000Z",
+            "value": "Initial publication"
+        }
+    ],
+    "work_around": [
+        {
+            "lang": "eng",
+            "value": "Configure GlobalProtect Clientless VPN to only access known trusted websites, and block access all other websites."
+        }
+    ]
+}