advisory-parser 1.12__tar.gz → 1.14__tar.gz

{advisory-parser-1.12/advisory_parser.egg-info → advisory_parser-1.14}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: advisory-parser
-Version: 1.12
+Version: 1.14
 Summary: Security flaw parser for upstream security advisories
 Home-page: https://github.com/RedHatProductSecurity/advisory-parser
 Author: Martin Prpič, Red Hat Product Security
@@ -16,7 +16,22 @@ Classifier: Programming Language :: Python :: 3.6
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
 License-File: LICENSE
+Requires-Dist: beautifulsoup4>=4.0.0
+Requires-Dist: cvss>=2.0
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: summary
 
 Advisory Parser
 ===============
@@ -54,7 +69,7 @@ Currently available parsers include:
 
     "Google Chrome", `<https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html>`_
     "Adobe Flash", `<https://helpx.adobe.com/security/products/flash-player/apsb17-17.html>`_
-    "Jenkins", ""
+    "Jenkins", `<https://www.jenkins.io/security/advisory/2023-04-12>`_
     "MySQL", `<http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html>`_
     "phpMyAdmin", ""
     "Wireshark", ""

{advisory-parser-1.12 → advisory_parser-1.14}/README.rst

@@ -34,7 +34,7 @@ Currently available parsers include:
 
     "Google Chrome", `<https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html>`_
     "Adobe Flash", `<https://helpx.adobe.com/security/products/flash-player/apsb17-17.html>`_
-    "Jenkins", ""
+    "Jenkins", `<https://www.jenkins.io/security/advisory/2023-04-12>`_
     "MySQL", `<http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html>`_
     "phpMyAdmin", ""
     "Wireshark", ""

{advisory-parser-1.12 → advisory_parser-1.14}/advisory_parser/__init__.py

@@ -4,5 +4,4 @@
 
 from .parser import Parser
 
-
-__version__ = "1.12"
+__version__ = "1.14"

{advisory-parser-1.12 → advisory_parser-1.14}/advisory_parser/flaw.py

@@ -27,7 +27,6 @@ class Flaw:
         fixed_in=None,
         advisory_id=None,
     ):
-
         # List of CVEs relating to a single security flaw.
         self.cves = cves or []
 

{advisory-parser-1.12 → advisory_parser-1.14}/advisory_parser/parser.py

@@ -32,8 +32,8 @@ class Parser:
         elif "oracle.com" in url:
             return parse_mysql_advisory(url)
 
-        elif "jenkins-ci" in url:
-            pass
+        elif "jenkins.io" in url:
+            return parse_jenkins_advisory(url)
 
         elif "phpmyadmin" in url:
             pass

{advisory-parser-1.12 → advisory_parser-1.14}/advisory_parser/parsers/__init__.py

@@ -5,3 +5,4 @@
 from .chrome import parse_chrome_advisory
 from .flash import parse_flash_advisory
 from .mysql import parse_mysql_advisory
+from .jenkins import parse_jenkins_advisory

{advisory-parser-1.12 → advisory_parser-1.14}/advisory_parser/parsers/chrome.py

@@ -3,12 +3,15 @@
 # License: LGPLv3+
 
 import re
+import logging
 from datetime import datetime
 
 from advisory_parser.exceptions import AdvisoryParserTextException
 from advisory_parser.flaw import Flaw
 from .utils import get_text_from_url, CVE_REGEX
 
+logger = logging.getLogger(__name__)
+
 # Chromium does not publish CVSS scores with their CVEs so these values are
 # best-effort guesses based on impact.
 CVSS3_MAP = {
@@ -18,6 +21,13 @@ CVSS3_MAP = {
     "low": "4.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
 }
 
+# Constants for Chrome advisory parsing
+SECURITY_FIXES_HEADER = "Security Fixes"
+LABELS_FOOTER = "Labels:\nStable updates"
+DATE_FORMAT = "%A, %B %d, %Y"
+CHROME_VERSION_REGEX = r"\d{2,3}\.\d\.\d{4}\.\d{2,3}"
+CHROMIUM_ISSUE_BASE_URL = "https://code.google.com/p/chromium/issues/detail?id="
+
 
 def parse_chrome_advisory(url):
     advisory_text = get_text_from_url(url)
@@ -25,12 +35,15 @@ def parse_chrome_advisory(url):
     # Workaround for advisories that do not use <div>s for each CVE entry. E.g.:
     # https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
     advisory_text = re.sub(r"(.)\[\$", r"\1\n[$", advisory_text)
+    # 2026+ posts concatenate CVE entries on one line using [TBD][bugid],
+    # [N/A][bugid], or [$reward][bugid]. Split them into separate lines.
+    advisory_text = re.sub(r"(?<=\S)(\[(?:TBD|N/A|\$\d+)\]\[)", r"\n\1", advisory_text)
 
-    if "Security Fixes" not in advisory_text:
+    if SECURITY_FIXES_HEADER not in advisory_text:
         raise AdvisoryParserTextException("No security fixes found in {}".format(url))
 
     # Throw away parts of the text after the blog post
-    flaws_text = advisory_text.split("Labels:\nStable updates")[0].strip()
+    flaws_text = advisory_text.split(LABELS_FOOTER)[0].strip()
 
     # Parse out public date
     match = re.search("^Stable Channel Update for Desktop\n(.+)", flaws_text, re.MULTILINE)
@@ -38,7 +51,7 @@ def parse_chrome_advisory(url):
         raise AdvisoryParserTextException("Could not find public date in {}".format(url))
 
     try:
-        public_date = datetime.strptime(match.group(1), "%A, %B %d, %Y")
+        public_date = datetime.strptime(match.group(1), DATE_FORMAT)
     except ValueError:
         raise AdvisoryParserTextException(
             "Could not parse public date ({}) from {}".format(match.group(1), url)
@@ -46,8 +59,8 @@ def parse_chrome_advisory(url):
 
     # Find Chrome version, e.g. 46.0.2490.71
     try:
-        fixed_in = re.search(r"\d{2,3}\.\d\.\d{4}\.\d{2,3}", flaws_text).group(0)
-    except ValueError:
+        fixed_in = re.search(CHROME_VERSION_REGEX, flaws_text).group(0)
+    except (AttributeError, ValueError):
         raise AdvisoryParserTextException("Could not find fixed-in version in {}".format(url))
 
     # Filter out lines that contain CVEs
@@ -72,7 +85,7 @@ def parse_chrome_advisory(url):
         else:
             match = re.search(r"(Critical|High|Medium|Low)", metadata)
             if not match:
-                print("Could not find impact; skipping: {}".format(line))
+                logger.warning("Could not find impact; skipping: %s", line)
                 continue
             else:
                 impact = match.group(1)
@@ -110,7 +123,7 @@ def parse_chrome_advisory(url):
 
         description += "\n\nUpstream bug(s):\n"
         for bug in bug_ids:
-            description += "\nhttps://code.google.com/p/chromium/issues/detail?id=" + bug
+            description += "\n" + CHROMIUM_ISSUE_BASE_URL + bug
 
         com_url = (
             url if "blogspot.com" in url else re.sub(r"blogspot\.[^/]*/", "blogspot.com/", url)

advisory_parser-1.14/advisory_parser/parsers/jenkins.py

@@ -0,0 +1,177 @@
+# Copyright (c) 2019 Red Hat, Inc.
+# Author: Shubh Bapna
+# License: LGPLv3+
+
+import re
+from datetime import datetime
+
+from advisory_parser.exceptions import AdvisoryParserTextException
+from advisory_parser.flaw import Flaw
+from .utils import find_tag_by_text, CVE_REGEX, find_tag_by_id, get_request
+from cvss import CVSS3
+
+TO_RH_SEVERITY = {
+    "None": "low",
+    "Low": "low",
+    "Medium": "moderate",
+    "High": "important",
+    "Critical": "critical",
+}
+
+
+def parse_jenkins_advisory(url):
+    severity_to_cvss3_map = extract_severity_to_cvss3_map(url)
+    fixes = extract_fixes(url)
+
+    # extract date from the url
+    public_date_match = re.compile(r"\d{4}-\d{2}-\d{2}").search(url).group()
+    try:
+        public_date = datetime.strptime(public_date_match, "%Y-%m-%d")
+    except ValueError:
+        raise AdvisoryParserTextException(
+            "Could not parse public date ({}) from {}".format(public_date_match, url)
+        )
+
+    # split it into chunks of advisories
+    advisories = extract_advisories(url)
+    if len(advisories) == 0:
+        raise AdvisoryParserTextException("No security fixes found in {}".format(url))
+
+    flaws, warnings = [], []
+    for index, advisory in enumerate(advisories):
+        severity = re.search(r"(SECURITY-\d+(\s\(\d\))?)", advisory).group(1)
+        if severity not in severity_to_cvss3_map.keys():
+            warnings.append("Could not find impact or cvss; skipping: {}".format(severity))
+            continue
+
+        cves = list(set(CVE_REGEX.findall(advisory)))
+        if len(cves) == 0:
+            warnings.append("Could not find CVEs or bugs; skipping: {}".format(severity))
+            continue
+
+        from_url = url + "#" + severity
+        summary = advisory.strip().split("\n")[0].strip()
+        impact = severity_to_cvss3_map[severity]["impact"]
+        cvss3 = severity_to_cvss3_map[severity]["score"]
+        description = extract_description(advisory, index == len(advisories) - 1)
+        affected_plugins = extract_affected_plugins(advisory)
+        affected_plugins_fix = extract_affected_plugins_fixes(
+            affected_plugins, fixes, summary, description, severity, warnings
+        )
+
+        flaws.append(
+            Flaw(
+                from_url=from_url,
+                cves=cves,
+                summary=f"jenkins-plugin: {', '.join(affected_plugins)}: {summary}",
+                public_date=public_date,
+                cvss3=cvss3,
+                impact=impact,
+                fixed_in=affected_plugins_fix,
+                description=description,
+                advisory_id=severity,
+            )
+        )
+
+    return flaws, warnings
+
+
+def extract_description(advisory, is_last):
+    description = "\n".join(advisory.strip().split("Description:")[-1].strip().split("\n")[:-1])
+    # if it is last advisory then we have to remove more stuff from description
+    if is_last:
+        description = description.split("Severity\n")[0].strip()
+    return description
+
+
+def extract_affected_plugins(advisory):
+    return [
+        a.strip()
+        for a in re.search(r"Affected plugins?:\n((.*\n)*?.*?)\nDescription", advisory)
+        .group(1)
+        .strip()
+        .split(",")
+    ]
+
+
+def extract_affected_plugins_fixes(
+    affected_plugins, fixes, summary, description, severity, warnings
+):
+    affected_plugins_fixes = {}
+    for fix in fixes:
+        if (
+            fix.lower() in affected_plugins
+            or summary.find(fix) != -1
+            or description.find(fix) != -1
+        ):
+            affected_plugins_fixes[fix.lower()] = fixes[fix]
+
+    for affected_plugin in affected_plugins:
+        if affected_plugin not in affected_plugins_fixes:
+            warnings.append(
+                "{}: Could not find a fixed version for {} plugin".format(severity, affected_plugin)
+            )
+
+    return affected_plugins_fixes
+
+
+def extract_severity_to_cvss3_map(url):
+    severity_list = find_tag_by_text(url, "h2", re.compile(r"\s*Severity\s*")).findNext("ul")
+    severity_to_cvss3_map = {}
+
+    # jenkins marks each severity with a high, medium or low impact and links that with a url to
+    # a cvss calculator. depending on the security advisory, each high, medium or low might be
+    # different from the next high, medium or low, so we will try to extract the cvss vector to get
+    # the most accurate cvss3 score
+    for c in severity_list.findChildren("li"):
+        severity, _ = list(c.stripped_strings)
+
+        # the href url contains the cvss vector after the # example:
+        # https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+        css3_vector = c.findNext().attrs["href"].split("#")[-1]
+
+        # severity contains a colon at the end so have to remove that
+        score = CVSS3(css3_vector)
+        severity_to_cvss3_map[severity[:-1]] = {
+            "score": score.rh_vector(),
+            "impact": TO_RH_SEVERITY[score.severities()[0]],
+        }
+
+    return severity_to_cvss3_map
+
+
+def extract_fixes(url):
+    fixes_list = find_tag_by_text(url, "h2", re.compile(r"\s*Fix\s*")).findNext("ul")
+    plugins_to_fix = {}
+    # jenkins does include fixes in each advisories' description but that makes it harder to extract
+    # it also does have a list of fixes for each plugin for all the advisories at the end of the page
+    for fix in fixes_list.findChildren("li"):
+        plugin = list(fix.stripped_strings)[0].split("Plugin")[0].strip()
+        version = list(fix.stripped_strings)[1].split("version")[1].strip()
+        plugins_to_fix.setdefault(plugin, []).append(version)
+    return plugins_to_fix
+
+
+def extract_advisories(url):
+    tag_list = find_tag_by_id(url, "h3", re.compile(r"SECURITY-\d+"))
+    # append end tag
+    tag_list.append(find_tag_by_text(url, "h2", re.compile(r"\s*Severity\s*")))
+
+    start, end = 0, 1
+    all_texts = []
+
+    while end < len(tag_list):
+        curr_text = ""
+        curr_tag = tag_list[start]
+        end_tag = tag_list[end]
+
+        while curr_tag != end_tag:
+            curr_text += curr_tag.get_text()
+            curr_tag = curr_tag.next_sibling
+
+        # Filter out blank lines and leading/trailing spaces
+        all_texts.append("\n".join(line.strip() for line in curr_text.splitlines() if line))
+        start = end
+        end += 1
+
+    return all_texts

{advisory-parser-1.12 → advisory_parser-1.14}/advisory_parser/parsers/mysql.py

@@ -2,6 +2,7 @@
 # Author: Martin Prpič, Red Hat Product Security
 # License: LGPLv3+
 
+import calendar
 import re
 from datetime import datetime, timedelta
 
@@ -14,6 +15,21 @@ from .utils import get_request, get_text_from_url, CVE_REGEX
 MARIADB_VULN_PAGE = "https://mariadb.com/kb/en/security/"
 VERSION_REGEX = re.compile(r"(\d\d?\.\d\.\d\d?)")
 
+month_to_num = {
+    "jan": 1,
+    "feb": 2,
+    "mar": 3,
+    "apr": 4,
+    "may": 5,
+    "jun": 6,
+    "jul": 7,
+    "aug": 8,
+    "sep": 9,
+    "oct": 10,
+    "nov": 11,
+    "dec": 12,
+}
+
 
 def _nearest_tuesday(year, month, day=17):
     """For a given year and month, return nearest Tuesday to the 17th of that month
@@ -24,25 +40,8 @@ def _nearest_tuesday(year, month, day=17):
     July and October."
     [https://www.oracle.com/security-alerts/]
     """
-    month_to_num = {
-        "jan": 1,
-        "feb": 2,
-        "mar": 3,
-        "apr": 4,
-        "may": 5,
-        "jun": 6,
-        "jul": 7,
-        "aug": 8,
-        "sep": 9,
-        "oct": 10,
-        "nov": 11,
-        "dec": 12,
-    }
-
-    if month.lower() not in month_to_num:
-        raise AdvisoryParserTextException("Invalid month parsed from advisory URL:", str(month))
 
-    base_date = datetime(year, month_to_num[month.lower()], day)
+    base_date = datetime(year, month, day)
 
     previous_tuesday = base_date - timedelta(days=((base_date.weekday() + 6) % 7))
     next_tuesday = base_date + timedelta(days=((1 - base_date.weekday()) % 7))
@@ -54,8 +53,35 @@ def _nearest_tuesday(year, month, day=17):
     )
 
 
-def create_mariadb_cve_map():
+def _third_tuesday(year, month):
+    """For a given year and month, return the 3rd Tuesday of that month
+
+    "Critical Patch Updates provide security patches for supported Oracle on-premises products.
+    They are available to customers with valid support contracts. Starting in April 2022,
+    Critical Patch Updates are released on the third Tuesday of January, April, July, and October
+    (They were previously published on the Tuesday closest to the 17th day of January, April, July,
+     and October). The next four dates are:
+
+    16 July 2024
+    15 October 2024
+    21 January 2025
+    15 April 2025
+    "
+    [https://www.oracle.com/security-alerts/]
+    """
+
+    c = calendar.Calendar()
+    monthcal = c.monthdatescalendar(year, month)
+    third_tuesday = [
+        day
+        for week in monthcal
+        for day in week
+        if day.weekday() == calendar.TUESDAY and day.month == month
+    ][2]
+    return third_tuesday
+
 
+def create_mariadb_cve_map():
     # Pull plain text of the MariaDB page since the HTML is invalid: it
     # doesn't define </li> ending tags for list elements. The HTML would
     # have to be parsed with a more lenient parser (html5lib), which is an
@@ -99,7 +125,20 @@ def parse_mysql_advisory(url):
     # Extract the CPU's month and year from the URL since the verbose page has
     # no dates on it
     month, year = url_match.groups()
-    cpu_date = _nearest_tuesday(int(year), month)
+    if month.lower() not in month_to_num:
+        raise AdvisoryParserTextException("Invalid month parsed from advisory URL:", str(month))
+    month_num = month_to_num[month.lower()]
+    year_int = int(year)
+    # Starting in April 2022, Critical Patch Updates are released on the third Tuesday of January,
+    # April, July, and October (They were previously published on the Tuesday closest to the 17th
+    # day of January, April, July, and October).
+    # [https://www.oracle.com/security-alerts/]
+    if year_int < 2022:
+        cpu_date = _nearest_tuesday(year_int, month_num)
+    elif year_int == 2022 and month_num < 4:
+        cpu_date = _nearest_tuesday(year_int, month_num)
+    else:
+        cpu_date = _third_tuesday(year_int, month_num)
     advisory_id = "CPU {} {}".format(month.capitalize(), year)
 
     # Fetch the CPU verbose page

{advisory-parser-1.12 → advisory_parser-1.14}/advisory_parser/parsers/utils.py

@@ -3,6 +3,8 @@
 # License: LGPLv3+
 
 import re
+import gzip
+import logging
 from urllib.error import HTTPError, URLError
 from urllib.request import urlopen, Request
 
@@ -10,27 +12,35 @@ from bs4 import BeautifulSoup
 
 from advisory_parser.exceptions import AdvisoryParserGetContentException
 
+logger = logging.getLogger(__name__)
+
 CVE_REGEX = re.compile(r"CVE-\d{4}-\d{4,}")
 
 
 def get_request(url):
-    user_agent = (
-        "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7"
-    )
-    headers = {"User-Agent": user_agent}
+    headers = {
+        "User-Agent": "Advisory-Parser/1.0",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+        "Accept-Encoding": "gzip, deflate",
+    }
     request = Request(url, None, headers)
     try:
-        res = urlopen(request)
+        res = urlopen(request, timeout=30)
+        data = res.read()
+
+        # Handle gzip-compressed responses
+        if res.headers.get("Content-Encoding") == "gzip":
+            data = gzip.decompress(data)
     except HTTPError as e:
-        error_msg = "Failed to GET with status code: {}".format(e.code)
+        error_msg = "Failed to GET {} with status code: {}".format(url, e.code)
         raise AdvisoryParserGetContentException(error_msg)
     except URLError as e:
-        error_msg = "Failed to establish connection: {}".format(e.reason)
+        error_msg = "Failed to establish connection to {}: {}".format(url, e.reason)
         raise AdvisoryParserGetContentException(error_msg)
     except ValueError:
-        raise AdvisoryParserGetContentException("Invalid URL specified.")
+        raise AdvisoryParserGetContentException("Invalid URL specified: {}".format(url))
     else:
-        return res.read()
+        return data
 
 
 def get_text_from_url(url):
@@ -47,3 +57,15 @@ def get_text_from_url(url):
     text = "\n".join(line.strip() for line in text.splitlines() if line)
 
     return text
+
+
+def find_tag_by_text(url, tag, text):
+    html = get_request(url)
+    soup = BeautifulSoup(html, "html.parser")
+    return soup.find(tag, text=text)
+
+
+def find_tag_by_id(url, tag, tag_id):
+    html = get_request(url)
+    soup = BeautifulSoup(html, "html.parser")
+    return soup.findAll(tag, id=tag_id)

{advisory-parser-1.12 → advisory_parser-1.14/advisory_parser.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: advisory-parser
-Version: 1.12
+Version: 1.14
 Summary: Security flaw parser for upstream security advisories
 Home-page: https://github.com/RedHatProductSecurity/advisory-parser
 Author: Martin Prpič, Red Hat Product Security
@@ -16,7 +16,22 @@ Classifier: Programming Language :: Python :: 3.6
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
 License-File: LICENSE
+Requires-Dist: beautifulsoup4>=4.0.0
+Requires-Dist: cvss>=2.0
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: summary
 
 Advisory Parser
 ===============
@@ -54,7 +69,7 @@ Currently available parsers include:
 
     "Google Chrome", `<https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html>`_
     "Adobe Flash", `<https://helpx.adobe.com/security/products/flash-player/apsb17-17.html>`_
-    "Jenkins", ""
+    "Jenkins", `<https://www.jenkins.io/security/advisory/2023-04-12>`_
     "MySQL", `<http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html>`_
     "phpMyAdmin", ""
     "Wireshark", ""

{advisory-parser-1.12 → advisory_parser-1.14}/advisory_parser.egg-info/SOURCES.txt

@@ -18,14 +18,17 @@ advisory_parser.egg-info/top_level.txt
 advisory_parser/parsers/__init__.py
 advisory_parser/parsers/chrome.py
 advisory_parser/parsers/flash.py
+advisory_parser/parsers/jenkins.py
 advisory_parser/parsers/mysql.py
 advisory_parser/parsers/utils.py
 tests/test_chrome_parser.py
 tests/test_flash_parser.py
+tests/test_jenkins_parser.py
 tests/test_mysql_parser.py
 tests/test_data/chrome_2017-06-15.txt
 tests/test_data/chrome_2020-02-04.txt
 tests/test_data/flash_apsb17-21.html
 tests/test_data/flash_apsb17-23.html
 tests/test_data/flash_apsb17-33.html
+tests/test_data/jenkins_2023-04-12.html
 tests/test_data/mysql_cpu-apr-2019.html

{advisory-parser-1.12 → advisory_parser-1.14}/advisory_parser.egg-info/requires.txt

@@ -1 +1,2 @@
 beautifulsoup4>=4.0.0
+cvss>=2.0

{advisory-parser-1.12 → advisory_parser-1.14}/setup.py

@@ -4,15 +4,14 @@
 
 from setuptools import setup
 
-
 with open("README.rst", "r") as f:
     description = f.read()
 
-requires = ["beautifulsoup4>=4.0.0"]
+requires = ["beautifulsoup4>=4.0.0", "cvss>=2.0"]
 
 setup(
     name="advisory-parser",
-    version="1.12",
+    version="1.14",
     description="Security flaw parser for upstream security advisories",
     long_description=description,
     url="https://github.com/RedHatProductSecurity/advisory-parser",
@@ -29,6 +28,9 @@ setup(
         "Programming Language :: Python :: 3.7",
         "Programming Language :: Python :: 3.8",
         "Programming Language :: Python :: 3.9",
+        "Programming Language :: Python :: 3.10",
+        "Programming Language :: Python :: 3.11",
+        "Programming Language :: Python :: 3.12",
     ],
     keywords="security advisory parser scraper",
     packages=["advisory_parser", "advisory_parser.parsers"],