benoit@43: import utils benoit@43: benoit@43: from farolluz.parsers.cve import parse benoit@43: benoit@43: FULL_CVE = """\ benoit@43: <entry xmlns:scap-core="http://scap.nist.gov/schema/scap-core/0.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:patch="http://scap.nist.gov/schema/patch/0.1" xmlns:vuln="http://scap.nist.gov/schema/vulnerability/0.4" xmlns:cvss="http://scap.nist.gov/schema/cvss-v2/0.2" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns="http://scap.nist.gov/schema/feed/vulnerability/2.0" id="CVE-2014-7088"> benoit@43: <vuln:vulnerable-configuration id="http://nvd.nist.gov/"> benoit@43: <cpe-lang:logical-test operator="OR" negate="false"> benoit@43: <cpe-lang:fact-ref name="cpe:/a:jdm_lifestyle_project:jdm_lifestyle:6.4::~~~android~~"/> benoit@43: </cpe-lang:logical-test> benoit@43: </vuln:vulnerable-configuration> benoit@43: <vuln:vulnerable-software-list> benoit@43: <vuln:product> benoit@43: cpe:/a:jdm_lifestyle_project:jdm_lifestyle:6.4::~~~android~~ benoit@43: </vuln:product> benoit@43: </vuln:vulnerable-software-list> benoit@43: <vuln:cve-id>CVE-2014-7088</vuln:cve-id> benoit@43: <vuln:published-datetime>2014-10-18T21:55:17.027-04:00</vuln:published-datetime> benoit@43: <vuln:last-modified-datetime>2014-11-14T09:07:51.650-05:00</vuln:last-modified-datetime> benoit@43: <vuln:cvss> benoit@43: <cvss:base_metrics> benoit@43: <cvss:score>5.4</cvss:score> benoit@43: <cvss:access-vector>ADJACENT_NETWORK</cvss:access-vector> benoit@43: <cvss:access-complexity>MEDIUM</cvss:access-complexity> benoit@43: <cvss:authentication>NONE</cvss:authentication> benoit@43: <cvss:confidentiality-impact>PARTIAL</cvss:confidentiality-impact> benoit@43: <cvss:integrity-impact>PARTIAL</cvss:integrity-impact> benoit@43: <cvss:availability-impact>PARTIAL</cvss:availability-impact> benoit@43: <cvss:source>http://nvd.nist.gov</cvss:source> benoit@43: <cvss:generated-on-datetime>2014-11-14T09:07:51.290-05:00</cvss:generated-on-datetime> benoit@43: </cvss:base_metrics> benoit@43: </vuln:cvss> benoit@43: <vuln:cwe id="CWE-310"/> benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en"> benoit@43: <vuln:source>CERT-VN</vuln:source> benoit@43: <vuln:reference href="http://www.kb.cert.org/vuls/id/582497" xml:lang="en">VU#582497</vuln:reference> benoit@43: </vuln:references> benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en"> benoit@43: <vuln:source>MISC</vuln:source> benoit@43: <vuln:reference href="https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing" xml:lang="en"> benoit@43: https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing benoit@43: </vuln:reference> benoit@43: </vuln:references> benoit@43: <vuln:summary> benoit@43: The JDM Lifestyle (aka com.hondatech) application 6.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. benoit@43: </vuln:summary> benoit@43: </entry>""" benoit@43: benoit@43: CVE_NO_CVSS = """\ benoit@43: <entry xmlns:scap-core="http://scap.nist.gov/schema/scap-core/0.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:patch="http://scap.nist.gov/schema/patch/0.1" xmlns:vuln="http://scap.nist.gov/schema/vulnerability/0.4" xmlns:cvss="http://scap.nist.gov/schema/cvss-v2/0.2" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns="http://scap.nist.gov/schema/feed/vulnerability/2.0" id="CVE-2014-9388"> benoit@43: <vuln:cve-id>CVE-2014-9388</vuln:cve-id> benoit@43: <vuln:published-datetime>2014-12-17T14:59:08.587-05:00</vuln:published-datetime> benoit@43: <vuln:last-modified-datetime>2014-12-17T14:59:09.620-05:00</vuln:last-modified-datetime> benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en"> benoit@43: <vuln:source>CONFIRM</vuln:source> benoit@43: <vuln:reference href="https://www.mantisbt.org/bugs/view.php?id=17878" xml:lang="en">https://www.mantisbt.org/bugs/view.php?id=17878</vuln:reference> benoit@43: </vuln:references> benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en"> benoit@43: <vuln:source>CONFIRM</vuln:source> benoit@43: <vuln:reference href="https://www.mantisbt.org/bugs/changelog_page.php?version_id=191" xml:lang="en"> benoit@43: https://www.mantisbt.org/bugs/changelog_page.php?version_id=191 benoit@43: </vuln:reference> benoit@43: </vuln:references> benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en"> benoit@43: <vuln:source>MLIST</vuln:source> benoit@43: <vuln:reference href="http://seclists.org/oss-sec/2014/q4/955" xml:lang="en">[oss-security] 20141207 MantisBT 1.2.18 Released</vuln:reference> benoit@43: </vuln:references> benoit@43: <vuln:summary> benoit@43: bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id parameter. benoit@43: </vuln:summary> benoit@43: </entry>""" benoit@43: benoit@43: class testCVEParsing(utils.TestCase): benoit@43: benoit@43: def test_Full(self): benoit@43: self.doc = parse(FULL_CVE) benoit@43: self._validate() benoit@43: benoit@43: def test_no_CVSS(self): benoit@43: self.doc = parse(CVE_NO_CVSS) benoit@43: self._validate()