regscale-cli 6.21.0.0__py3-none-any.whl → 6.21.1.0__py3-none-any.whl

regscale/integrations/public/fedramp/fedramp_five.py

@@ -1764,7 +1764,7 @@ def update_existing_control(
 
     # Convert the model to a dict and back to a model to workaround these odd 400 errors.
     try:
-        ControlImplementation(**control.dict()).save()
+        control.save()
     except Exception as e:
         logger.warning(f"Error updating control: {control.id} - {e}")
 

regscale/integrations/public/fedramp/markdown_parser.py

@@ -7,6 +7,7 @@ import re
 import logging
 import zipfile  # Assuming you need this for other file handling
 import pypandoc
+import re
 from collections import defaultdict
 from typing import Dict, TextIO, Optional, Tuple
 from regscale.models import ProfileMapping
@@ -108,7 +109,12 @@ class MDDocParser:
         """
         # Extract control ID and clean it
         html_free_line = self.clean_html_and_newlines(line)
-        clean_line = html_free_line.replace(FULL_SUMMARY_TOKEN, "")
+        # Use regex to find "what" case-insensitively and split
+        pattern = re.compile(r"what", re.IGNORECASE)
+        if pattern.search(html_free_line):
+            clean_line = pattern.split(html_free_line)[0].strip()
+        else:
+            clean_line = html_free_line
         if not clean_line:
             return None
         clean_control_id_from_line = clean_line.strip()

regscale/integrations/scanner_integration.py

@@ -423,6 +423,9 @@ class IntegrationFinding:
     planned_milestone_changes: Optional[str] = None
     adjusted_risk_rating: Optional[str] = None
     risk_adjustment: str = "No"
+
+    # Compliance fields
+    assessment_id: Optional[int] = None
     operational_requirements: Optional[str] = None
     deviation_rationale: Optional[str] = None
     is_cwe: bool = False
@@ -456,7 +459,7 @@ class IntegrationFinding:
     source_rule_id: Optional[str] = None
     vulnerability_type: Optional[str] = None
 
-    # CoalFre POAM
+    # CoalFire POAM
     basis_for_adjustment: Optional[str] = None
     poam_id: Optional[str] = None
 
@@ -1612,6 +1615,23 @@ class ScannerIntegration(ABC):
         issue.securityPlanId = self.plan_id if not self.is_component else None
         issue.identification = finding.identification
         issue.dateFirstDetected = finding.first_seen
+        # Ensure a due date is always set using configured policy defaults (e.g., FedRAMP)
+        if not finding.due_date:
+            try:
+                base_created = finding.date_created or issue.dateCreated
+                finding.due_date = issue_due_date(
+                    severity=finding.severity,
+                    created_date=base_created,
+                    title=self.title,
+                )
+            except Exception:
+                # Final fallback to a Low severity default if anything goes wrong
+                base_created = finding.date_created or issue.dateCreated
+                finding.due_date = issue_due_date(
+                    severity=regscale_models.IssueSeverity.Low,
+                    created_date=base_created,
+                    title=self.title,
+                )
         issue.dueDate = finding.due_date
         issue.description = description
         issue.sourceReport = finding.source_report or self.title
@@ -1622,15 +1642,21 @@ class ScannerIntegration(ABC):
         issue.integrationFindingId = self.get_finding_identifier(finding)
         issue.poamComments = finding.poam_comments
         issue.cve = finding.cve
+        issue.assessmentId = finding.assessment_id
         control_id = self.get_control_implementation_id_for_cci(finding.cci_ref) if finding.cci_ref else None
         issue.controlId = control_id  # TODO REMOVE
         # Add the control implementation ids and the cci ref if it exists
         # Get control implementation ID for CCI if it exists
         # Only add CCI control ID if it exists
         cci_control_ids = [control_id] if control_id is not None else []
-        issue.affectedControls = finding.affected_controls
+        # Ensure failed control labels (e.g., AC-4(21)) are present in affectedControls
+        if finding.affected_controls:
+            issue.affectedControls = finding.affected_controls
+        elif finding.control_labels:
+            issue.affectedControls = ", ".join(sorted({cl for cl in finding.control_labels if cl}))
 
         issue.controlImplementationIds = list(set(finding._control_implementation_ids + cci_control_ids))  # noqa
+        # Always ensure isPoam reflects current settings, even when updating existing issues
         issue.isPoam = is_poam
         issue.basisForAdjustment = (
             finding.basis_for_adjustment if finding.basis_for_adjustment else f"{self.title} import"
@@ -1647,6 +1673,8 @@ class ScannerIntegration(ABC):
         issue.operationalRequirement = finding.operational_requirements
         issue.deviationRationale = finding.deviation_rationale
         issue.dateLastUpdated = get_current_datetime()
+        ## set affected controls if they exist
+        issue.affectedControls = finding.affected_controls
 
         if finding.cve:
             issue = self.lookup_kev_and_update_issue(cve=finding.cve, issue=issue, cisa_kevs=self._kev_data)

regscale/models/app_models/__init__.py

@@ -3,3 +3,4 @@
 from .mapping import Mapping
 from .import_validater import ImportValidater
 from .datetime_encoder import DateTimeEncoder
+from .click import NotRequiredIf, regscale_id, regscale_module

regscale/models/integration_models/cisa_kev_data.json

@@ -1,9 +1,78 @@
 {
     "title": "CISA Catalog of Known Exploited Vulnerabilities",
-    "catalogVersion": "2025.08.05",
-    "dateReleased": "2025-08-05T18:03:16.7522Z",
-    "count": 1394,
+    "catalogVersion": "2025.08.14",
+    "dateReleased": "2025-08-14T18:46:32.7331Z",
+    "count": 1399,
     "vulnerabilities": [
+        {
+            "cveID": "CVE-2025-8876",
+            "vendorProject": "N-able",
+            "product": "N-Central",
+            "vulnerabilityName": "N-able N-Central Command Injection Vulnerability",
+            "dateAdded": "2025-08-13",
+            "shortDescription": "N-able N-Central contains a command injection vulnerability via improper sanitization of user input.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-08-20",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/status.n-able.com\/2025\/08\/13\/announcing-the-ga-of-n-central-2025-3-1\/ ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-8876",
+            "cwes": []
+        },
+        {
+            "cveID": "CVE-2025-8875",
+            "vendorProject": "N-able",
+            "product": "N-Central",
+            "vulnerabilityName": "N-able N-Central Insecure Deserialization Vulnerability",
+            "dateAdded": "2025-08-13",
+            "shortDescription": "N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-08-20",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/status.n-able.com\/2025\/08\/13\/announcing-the-ga-of-n-central-2025-3-1\/ ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-8875",
+            "cwes": []
+        },
+        {
+            "cveID": "CVE-2025-8088",
+            "vendorProject": "RARLAB",
+            "product": "WinRAR",
+            "vulnerabilityName": "RARLAB WinRAR Path Traversal Vulnerability",
+            "dateAdded": "2025-08-12",
+            "shortDescription": "RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-09-02",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/www.win-rar.com\/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-8088",
+            "cwes": [
+                "CWE-35"
+            ]
+        },
+        {
+            "cveID": "CVE-2007-0671",
+            "vendorProject": "Microsoft",
+            "product": "Office",
+            "vulnerabilityName": "Microsoft Office Excel Remote Code Execution Vulnerability",
+            "dateAdded": "2025-08-12",
+            "shortDescription": "Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-09-02",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/learn.microsoft.com\/en-us\/security-updates\/securitybulletins\/2007\/ms07-015 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2007-0671",
+            "cwes": []
+        },
+        {
+            "cveID": "CVE-2013-3893",
+            "vendorProject": "Microsoft",
+            "product": "Internet Explorer",
+            "vulnerabilityName": "Microsoft Internet Explorer Resource Management Errors Vulnerability",
+            "dateAdded": "2025-08-12",
+            "shortDescription": "Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and\/or end-of-service (EoS). Users should discontinue product utilization.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-09-02",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/learn.microsoft.com\/en-us\/security-updates\/securitybulletins\/2013\/ms13-080 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2013-3893",
+            "cwes": [
+                "CWE-399"
+            ]
+        },
         {
             "cveID": "CVE-2020-25078",
             "vendorProject": "D-Link",
@@ -236,7 +305,7 @@
             "shortDescription": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
             "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
             "dueDate": "2025-07-11",
-            "knownRansomwareCampaignUse": "Unknown",
+            "knownRansomwareCampaignUse": "Known",
             "notes": "https:\/\/support.citrix.com\/support-home\/kbsearch\/article?articleNumber=CTX693420 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-5777",
             "cwes": [
                 "CWE-125"