advisory-parser 1.12__tar.gz → 1.13__tar.gz

{advisory-parser-1.12/advisory_parser.egg-info → advisory_parser-1.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: advisory-parser
-Version: 1.12
+Version: 1.13
 Summary: Security flaw parser for upstream security advisories
 Home-page: https://github.com/RedHatProductSecurity/advisory-parser
 Author: Martin Prpič, Red Hat Product Security
@@ -16,7 +16,12 @@ Classifier: Programming Language :: Python :: 3.6
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
 License-File: LICENSE
+Requires-Dist: beautifulsoup4>=4.0.0
+Requires-Dist: cvss>=2.0
 
 Advisory Parser
 ===============
@@ -54,7 +59,7 @@ Currently available parsers include:
 
     "Google Chrome", `<https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html>`_
     "Adobe Flash", `<https://helpx.adobe.com/security/products/flash-player/apsb17-17.html>`_
-    "Jenkins", ""
+    "Jenkins", `<https://www.jenkins.io/security/advisory/2023-04-12>`_
     "MySQL", `<http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html>`_
     "phpMyAdmin", ""
     "Wireshark", ""

{advisory-parser-1.12 → advisory_parser-1.13}/README.rst

@@ -34,7 +34,7 @@ Currently available parsers include:
 
     "Google Chrome", `<https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html>`_
     "Adobe Flash", `<https://helpx.adobe.com/security/products/flash-player/apsb17-17.html>`_
-    "Jenkins", ""
+    "Jenkins", `<https://www.jenkins.io/security/advisory/2023-04-12>`_
     "MySQL", `<http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html>`_
     "phpMyAdmin", ""
     "Wireshark", ""

{advisory-parser-1.12 → advisory_parser-1.13}/advisory_parser/__init__.py

@@ -5,4 +5,4 @@
 from .parser import Parser
 
 
-__version__ = "1.12"
+__version__ = "1.13"

{advisory-parser-1.12 → advisory_parser-1.13}/advisory_parser/flaw.py

@@ -27,7 +27,6 @@ class Flaw:
         fixed_in=None,
         advisory_id=None,
     ):
-
         # List of CVEs relating to a single security flaw.
         self.cves = cves or []
 

{advisory-parser-1.12 → advisory_parser-1.13}/advisory_parser/parser.py

@@ -32,8 +32,8 @@ class Parser:
         elif "oracle.com" in url:
             return parse_mysql_advisory(url)
 
-        elif "jenkins-ci" in url:
-            pass
+        elif "jenkins.io" in url:
+            return parse_jenkins_advisory(url)
 
         elif "phpmyadmin" in url:
             pass

{advisory-parser-1.12 → advisory_parser-1.13}/advisory_parser/parsers/__init__.py

@@ -5,3 +5,4 @@
 from .chrome import parse_chrome_advisory
 from .flash import parse_flash_advisory
 from .mysql import parse_mysql_advisory
+from .jenkins import parse_jenkins_advisory

advisory_parser-1.13/advisory_parser/parsers/jenkins.py

@@ -0,0 +1,177 @@
+# Copyright (c) 2019 Red Hat, Inc.
+# Author: Shubh Bapna
+# License: LGPLv3+
+
+import re
+from datetime import datetime
+
+from advisory_parser.exceptions import AdvisoryParserTextException
+from advisory_parser.flaw import Flaw
+from .utils import find_tag_by_text, CVE_REGEX, find_tag_by_id, get_request
+from cvss import CVSS3
+
+TO_RH_SEVERITY = {
+    "None": "low",
+    "Low": "low",
+    "Medium": "moderate",
+    "High": "important",
+    "Critical": "critical",
+}
+
+
+def parse_jenkins_advisory(url):
+    severity_to_cvss3_map = extract_severity_to_cvss3_map(url)
+    fixes = extract_fixes(url)
+
+    # extract date from the url
+    public_date_match = re.compile(r"\d{4}-\d{2}-\d{2}").search(url).group()
+    try:
+        public_date = datetime.strptime(public_date_match, "%Y-%m-%d")
+    except ValueError:
+        raise AdvisoryParserTextException(
+            "Could not parse public date ({}) from {}".format(public_date_match, url)
+        )
+
+    # split it into chunks of advisories
+    advisories = extract_advisories(url)
+    if len(advisories) == 0:
+        raise AdvisoryParserTextException("No security fixes found in {}".format(url))
+
+    flaws, warnings = [], []
+    for index, advisory in enumerate(advisories):
+        severity = re.search(r"(SECURITY-\d+(\s\(\d\))?)", advisory).group(1)
+        if severity not in severity_to_cvss3_map.keys():
+            warnings.append("Could not find impact or cvss; skipping: {}".format(severity))
+            continue
+
+        cves = list(set(CVE_REGEX.findall(advisory)))
+        if len(cves) == 0:
+            warnings.append("Could not find CVEs or bugs; skipping: {}".format(severity))
+            continue
+
+        from_url = url + "#" + severity
+        summary = advisory.strip().split("\n")[0].strip()
+        impact = severity_to_cvss3_map[severity]["impact"]
+        cvss3 = severity_to_cvss3_map[severity]["score"]
+        description = extract_description(advisory, index == len(advisories) - 1)
+        affected_plugins = extract_affected_plugins(advisory)
+        affected_plugins_fix = extract_affected_plugins_fixes(
+            affected_plugins, fixes, summary, description, severity, warnings
+        )
+
+        flaws.append(
+            Flaw(
+                from_url=from_url,
+                cves=cves,
+                summary=f"jenkins-plugin: {', '.join(affected_plugins)}: {summary}",
+                public_date=public_date,
+                cvss3=cvss3,
+                impact=impact,
+                fixed_in=affected_plugins_fix,
+                description=description,
+                advisory_id=severity,
+            )
+        )
+
+    return flaws, warnings
+
+
+def extract_description(advisory, is_last):
+    description = "\n".join(advisory.strip().split("Description:")[-1].strip().split("\n")[:-1])
+    # if it is last advisory then we have to remove more stuff from description
+    if is_last:
+        description = description.split("Severity\n")[0].strip()
+    return description
+
+
+def extract_affected_plugins(advisory):
+    return [
+        a.strip()
+        for a in re.search(r"Affected plugins?:\n((.*\n)*?.*?)\nDescription", advisory)
+        .group(1)
+        .strip()
+        .split(",")
+    ]
+
+
+def extract_affected_plugins_fixes(
+    affected_plugins, fixes, summary, description, severity, warnings
+):
+    affected_plugins_fixes = {}
+    for fix in fixes:
+        if (
+            fix.lower() in affected_plugins
+            or summary.find(fix) != -1
+            or description.find(fix) != -1
+        ):
+            affected_plugins_fixes[fix.lower()] = fixes[fix]
+
+    for affected_plugin in affected_plugins:
+        if affected_plugin not in affected_plugins_fixes:
+            warnings.append(
+                "{}: Could not find a fixed version for {} plugin".format(severity, affected_plugin)
+            )
+
+    return affected_plugins_fixes
+
+
+def extract_severity_to_cvss3_map(url):
+    severity_list = find_tag_by_text(url, "h2", re.compile(r"\s*Severity\s*")).findNext("ul")
+    severity_to_cvss3_map = {}
+
+    # jenkins marks each severity with a high, medium or low impact and links that with a url to
+    # a cvss calculator. depending on the security advisory, each high, medium or low might be
+    # different from the next high, medium or low, so we will try to extract the cvss vector to get
+    # the most accurate cvss3 score
+    for c in severity_list.findChildren("li"):
+        severity, _ = list(c.stripped_strings)
+
+        # the href url contains the cvss vector after the # example:
+        # https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+        css3_vector = c.findNext().attrs["href"].split("#")[-1]
+
+        # severity contains a colon at the end so have to remove that
+        score = CVSS3(css3_vector)
+        severity_to_cvss3_map[severity[:-1]] = {
+            "score": score.rh_vector(),
+            "impact": TO_RH_SEVERITY[score.severities()[0]],
+        }
+
+    return severity_to_cvss3_map
+
+
+def extract_fixes(url):
+    fixes_list = find_tag_by_text(url, "h2", re.compile(r"\s*Fix\s*")).findNext("ul")
+    plugins_to_fix = {}
+    # jenkins does include fixes in each advisories' description but that makes it harder to extract
+    # it also does have a list of fixes for each plugin for all the advisories at the end of the page
+    for fix in fixes_list.findChildren("li"):
+        plugin = list(fix.stripped_strings)[0].split("Plugin")[0].strip()
+        version = list(fix.stripped_strings)[1].split("version")[1].strip()
+        plugins_to_fix.setdefault(plugin, []).append(version)
+    return plugins_to_fix
+
+
+def extract_advisories(url):
+    tag_list = find_tag_by_id(url, "h3", re.compile(r"SECURITY-\d+"))
+    # append end tag
+    tag_list.append(find_tag_by_text(url, "h2", re.compile(r"\s*Severity\s*")))
+
+    start, end = 0, 1
+    all_texts = []
+
+    while end < len(tag_list):
+        curr_text = ""
+        curr_tag = tag_list[start]
+        end_tag = tag_list[end]
+
+        while curr_tag != end_tag:
+            curr_text += curr_tag.get_text()
+            curr_tag = curr_tag.next_sibling
+
+        # Filter out blank lines and leading/trailing spaces
+        all_texts.append("\n".join(line.strip() for line in curr_text.splitlines() if line))
+        start = end
+        end += 1
+
+    return all_texts

{advisory-parser-1.12 → advisory_parser-1.13}/advisory_parser/parsers/mysql.py

@@ -2,6 +2,7 @@
 # Author: Martin Prpič, Red Hat Product Security
 # License: LGPLv3+
 
+import calendar
 import re
 from datetime import datetime, timedelta
 
@@ -14,6 +15,21 @@ from .utils import get_request, get_text_from_url, CVE_REGEX
 MARIADB_VULN_PAGE = "https://mariadb.com/kb/en/security/"
 VERSION_REGEX = re.compile(r"(\d\d?\.\d\.\d\d?)")
 
+month_to_num = {
+    "jan": 1,
+    "feb": 2,
+    "mar": 3,
+    "apr": 4,
+    "may": 5,
+    "jun": 6,
+    "jul": 7,
+    "aug": 8,
+    "sep": 9,
+    "oct": 10,
+    "nov": 11,
+    "dec": 12,
+}
+
 
 def _nearest_tuesday(year, month, day=17):
     """For a given year and month, return nearest Tuesday to the 17th of that month
@@ -24,25 +40,8 @@ def _nearest_tuesday(year, month, day=17):
     July and October."
     [https://www.oracle.com/security-alerts/]
     """
-    month_to_num = {
-        "jan": 1,
-        "feb": 2,
-        "mar": 3,
-        "apr": 4,
-        "may": 5,
-        "jun": 6,
-        "jul": 7,
-        "aug": 8,
-        "sep": 9,
-        "oct": 10,
-        "nov": 11,
-        "dec": 12,
-    }
-
-    if month.lower() not in month_to_num:
-        raise AdvisoryParserTextException("Invalid month parsed from advisory URL:", str(month))
 
-    base_date = datetime(year, month_to_num[month.lower()], day)
+    base_date = datetime(year, month, day)
 
     previous_tuesday = base_date - timedelta(days=((base_date.weekday() + 6) % 7))
     next_tuesday = base_date + timedelta(days=((1 - base_date.weekday()) % 7))
@@ -54,8 +53,35 @@ def _nearest_tuesday(year, month, day=17):
     )
 
 
-def create_mariadb_cve_map():
+def _third_tuesday(year, month):
+    """For a given year and month, return the 3rd Tuesday of that month
+
+    "Critical Patch Updates provide security patches for supported Oracle on-premises products.
+    They are available to customers with valid support contracts. Starting in April 2022,
+    Critical Patch Updates are released on the third Tuesday of January, April, July, and October
+    (They were previously published on the Tuesday closest to the 17th day of January, April, July,
+     and October). The next four dates are:
+
+    16 July 2024
+    15 October 2024
+    21 January 2025
+    15 April 2025
+    "
+    [https://www.oracle.com/security-alerts/]
+    """
+
+    c = calendar.Calendar()
+    monthcal = c.monthdatescalendar(year, month)
+    third_tuesday = [
+        day
+        for week in monthcal
+        for day in week
+        if day.weekday() == calendar.TUESDAY and day.month == month
+    ][2]
+    return third_tuesday
+
 
+def create_mariadb_cve_map():
     # Pull plain text of the MariaDB page since the HTML is invalid: it
     # doesn't define </li> ending tags for list elements. The HTML would
     # have to be parsed with a more lenient parser (html5lib), which is an
@@ -99,7 +125,20 @@ def parse_mysql_advisory(url):
     # Extract the CPU's month and year from the URL since the verbose page has
     # no dates on it
     month, year = url_match.groups()
-    cpu_date = _nearest_tuesday(int(year), month)
+    if month.lower() not in month_to_num:
+        raise AdvisoryParserTextException("Invalid month parsed from advisory URL:", str(month))
+    month_num = month_to_num[month.lower()]
+    year_int = int(year)
+    # Starting in April 2022, Critical Patch Updates are released on the third Tuesday of January,
+    # April, July, and October (They were previously published on the Tuesday closest to the 17th
+    # day of January, April, July, and October).
+    # [https://www.oracle.com/security-alerts/]
+    if year_int < 2022:
+        cpu_date = _nearest_tuesday(year_int, month_num)
+    elif year_int == 2022 and month_num < 4:
+        cpu_date = _nearest_tuesday(year_int, month_num)
+    else:
+        cpu_date = _third_tuesday(year_int, month_num)
     advisory_id = "CPU {} {}".format(month.capitalize(), year)
 
     # Fetch the CPU verbose page

{advisory-parser-1.12 → advisory_parser-1.13}/advisory_parser/parsers/utils.py

@@ -47,3 +47,15 @@ def get_text_from_url(url):
     text = "\n".join(line.strip() for line in text.splitlines() if line)
 
     return text
+
+
+def find_tag_by_text(url, tag, text):
+    html = get_request(url)
+    soup = BeautifulSoup(html, "html.parser")
+    return soup.find(tag, text=text)
+
+
+def find_tag_by_id(url, tag, tag_id):
+    html = get_request(url)
+    soup = BeautifulSoup(html, "html.parser")
+    return soup.findAll(tag, id=tag_id)

{advisory-parser-1.12 → advisory_parser-1.13/advisory_parser.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: advisory-parser
-Version: 1.12
+Version: 1.13
 Summary: Security flaw parser for upstream security advisories
 Home-page: https://github.com/RedHatProductSecurity/advisory-parser
 Author: Martin Prpič, Red Hat Product Security
@@ -16,7 +16,12 @@ Classifier: Programming Language :: Python :: 3.6
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
 License-File: LICENSE
+Requires-Dist: beautifulsoup4>=4.0.0
+Requires-Dist: cvss>=2.0
 
 Advisory Parser
 ===============
@@ -54,7 +59,7 @@ Currently available parsers include:
 
     "Google Chrome", `<https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html>`_
     "Adobe Flash", `<https://helpx.adobe.com/security/products/flash-player/apsb17-17.html>`_
-    "Jenkins", ""
+    "Jenkins", `<https://www.jenkins.io/security/advisory/2023-04-12>`_
     "MySQL", `<http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html>`_
     "phpMyAdmin", ""
     "Wireshark", ""

{advisory-parser-1.12 → advisory_parser-1.13}/advisory_parser.egg-info/SOURCES.txt

@@ -18,14 +18,17 @@ advisory_parser.egg-info/top_level.txt
 advisory_parser/parsers/__init__.py
 advisory_parser/parsers/chrome.py
 advisory_parser/parsers/flash.py
+advisory_parser/parsers/jenkins.py
 advisory_parser/parsers/mysql.py
 advisory_parser/parsers/utils.py
 tests/test_chrome_parser.py
 tests/test_flash_parser.py
+tests/test_jenkins_parser.py
 tests/test_mysql_parser.py
 tests/test_data/chrome_2017-06-15.txt
 tests/test_data/chrome_2020-02-04.txt
 tests/test_data/flash_apsb17-21.html
 tests/test_data/flash_apsb17-23.html
 tests/test_data/flash_apsb17-33.html
+tests/test_data/jenkins_2023-04-12.html
 tests/test_data/mysql_cpu-apr-2019.html

{advisory-parser-1.12 → advisory_parser-1.13}/advisory_parser.egg-info/requires.txt

@@ -1 +1,2 @@
 beautifulsoup4>=4.0.0
+cvss>=2.0

{advisory-parser-1.12 → advisory_parser-1.13}/setup.py

@@ -8,11 +8,11 @@ from setuptools import setup
 with open("README.rst", "r") as f:
     description = f.read()
 
-requires = ["beautifulsoup4>=4.0.0"]
+requires = ["beautifulsoup4>=4.0.0", "cvss>=2.0"]
 
 setup(
     name="advisory-parser",
-    version="1.12",
+    version="1.13",
     description="Security flaw parser for upstream security advisories",
     long_description=description,
     url="https://github.com/RedHatProductSecurity/advisory-parser",
@@ -29,6 +29,9 @@ setup(
         "Programming Language :: Python :: 3.7",
         "Programming Language :: Python :: 3.8",
         "Programming Language :: Python :: 3.9",
+        "Programming Language :: Python :: 3.10",
+        "Programming Language :: Python :: 3.11",
+        "Programming Language :: Python :: 3.12",
     ],
     keywords="security advisory parser scraper",
     packages=["advisory_parser", "advisory_parser.parsers"],