Mercurial > farol > farolluz
comparison tests/testParseCVE.py @ 43:b87f2a6e613a
Add CVE parsing (from OpenVAS GSA)
| author | Benoît Allard <benoit.allard@greenbone.net> |
|---|---|
| date | Mon, 29 Dec 2014 16:33:34 +0100 |
| parents | |
| children | 6c320c3f3176 |
comparison
equal
deleted
inserted
replaced
| 42:9ed24f48df01 | 43:b87f2a6e613a |
|---|---|
| 1 import utils | |
| 2 | |
| 3 from farolluz.parsers.cve import parse | |
| 4 | |
| 5 FULL_CVE = """\ | |
| 6 <entry xmlns:scap-core="http://scap.nist.gov/schema/scap-core/0.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:patch="http://scap.nist.gov/schema/patch/0.1" xmlns:vuln="http://scap.nist.gov/schema/vulnerability/0.4" xmlns:cvss="http://scap.nist.gov/schema/cvss-v2/0.2" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns="http://scap.nist.gov/schema/feed/vulnerability/2.0" id="CVE-2014-7088"> | |
| 7 <vuln:vulnerable-configuration id="http://nvd.nist.gov/"> | |
| 8 <cpe-lang:logical-test operator="OR" negate="false"> | |
| 9 <cpe-lang:fact-ref name="cpe:/a:jdm_lifestyle_project:jdm_lifestyle:6.4::~~~android~~"/> | |
| 10 </cpe-lang:logical-test> | |
| 11 </vuln:vulnerable-configuration> | |
| 12 <vuln:vulnerable-software-list> | |
| 13 <vuln:product> | |
| 14 cpe:/a:jdm_lifestyle_project:jdm_lifestyle:6.4::~~~android~~ | |
| 15 </vuln:product> | |
| 16 </vuln:vulnerable-software-list> | |
| 17 <vuln:cve-id>CVE-2014-7088</vuln:cve-id> | |
| 18 <vuln:published-datetime>2014-10-18T21:55:17.027-04:00</vuln:published-datetime> | |
| 19 <vuln:last-modified-datetime>2014-11-14T09:07:51.650-05:00</vuln:last-modified-datetime> | |
| 20 <vuln:cvss> | |
| 21 <cvss:base_metrics> | |
| 22 <cvss:score>5.4</cvss:score> | |
| 23 <cvss:access-vector>ADJACENT_NETWORK</cvss:access-vector> | |
| 24 <cvss:access-complexity>MEDIUM</cvss:access-complexity> | |
| 25 <cvss:authentication>NONE</cvss:authentication> | |
| 26 <cvss:confidentiality-impact>PARTIAL</cvss:confidentiality-impact> | |
| 27 <cvss:integrity-impact>PARTIAL</cvss:integrity-impact> | |
| 28 <cvss:availability-impact>PARTIAL</cvss:availability-impact> | |
| 29 <cvss:source>http://nvd.nist.gov</cvss:source> | |
| 30 <cvss:generated-on-datetime>2014-11-14T09:07:51.290-05:00</cvss:generated-on-datetime> | |
| 31 </cvss:base_metrics> | |
| 32 </vuln:cvss> | |
| 33 <vuln:cwe id="CWE-310"/> | |
| 34 <vuln:references reference_type="UNKNOWN" xml:lang="en"> | |
| 35 <vuln:source>CERT-VN</vuln:source> | |
| 36 <vuln:reference href="http://www.kb.cert.org/vuls/id/582497" xml:lang="en">VU#582497</vuln:reference> | |
| 37 </vuln:references> | |
| 38 <vuln:references reference_type="UNKNOWN" xml:lang="en"> | |
| 39 <vuln:source>MISC</vuln:source> | |
| 40 <vuln:reference href="https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing" xml:lang="en"> | |
| 41 https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing | |
| 42 </vuln:reference> | |
| 43 </vuln:references> | |
| 44 <vuln:summary> | |
| 45 The JDM Lifestyle (aka com.hondatech) application 6.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | |
| 46 </vuln:summary> | |
| 47 </entry>""" | |
| 48 | |
| 49 CVE_NO_CVSS = """\ | |
| 50 <entry xmlns:scap-core="http://scap.nist.gov/schema/scap-core/0.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:patch="http://scap.nist.gov/schema/patch/0.1" xmlns:vuln="http://scap.nist.gov/schema/vulnerability/0.4" xmlns:cvss="http://scap.nist.gov/schema/cvss-v2/0.2" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns="http://scap.nist.gov/schema/feed/vulnerability/2.0" id="CVE-2014-9388"> | |
| 51 <vuln:cve-id>CVE-2014-9388</vuln:cve-id> | |
| 52 <vuln:published-datetime>2014-12-17T14:59:08.587-05:00</vuln:published-datetime> | |
| 53 <vuln:last-modified-datetime>2014-12-17T14:59:09.620-05:00</vuln:last-modified-datetime> | |
| 54 <vuln:references reference_type="UNKNOWN" xml:lang="en"> | |
| 55 <vuln:source>CONFIRM</vuln:source> | |
| 56 <vuln:reference href="https://www.mantisbt.org/bugs/view.php?id=17878" xml:lang="en">https://www.mantisbt.org/bugs/view.php?id=17878</vuln:reference> | |
| 57 </vuln:references> | |
| 58 <vuln:references reference_type="UNKNOWN" xml:lang="en"> | |
| 59 <vuln:source>CONFIRM</vuln:source> | |
| 60 <vuln:reference href="https://www.mantisbt.org/bugs/changelog_page.php?version_id=191" xml:lang="en"> | |
| 61 https://www.mantisbt.org/bugs/changelog_page.php?version_id=191 | |
| 62 </vuln:reference> | |
| 63 </vuln:references> | |
| 64 <vuln:references reference_type="UNKNOWN" xml:lang="en"> | |
| 65 <vuln:source>MLIST</vuln:source> | |
| 66 <vuln:reference href="http://seclists.org/oss-sec/2014/q4/955" xml:lang="en">[oss-security] 20141207 MantisBT 1.2.18 Released</vuln:reference> | |
| 67 </vuln:references> | |
| 68 <vuln:summary> | |
| 69 bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id parameter. | |
| 70 </vuln:summary> | |
| 71 </entry>""" | |
| 72 | |
| 73 class testCVEParsing(utils.TestCase): | |
| 74 | |
| 75 def test_Full(self): | |
| 76 self.doc = parse(FULL_CVE) | |
| 77 self._validate() | |
| 78 | |
| 79 def test_no_CVSS(self): | |
| 80 self.doc = parse(CVE_NO_CVSS) | |
| 81 self._validate() |