Skip to content

Commit cff1447

Browse files
keshav-spacekeshav-space
committed
Collect ubuntu priority severity
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
1 parent a057c98 commit cff1447

5 files changed

Lines changed: 59 additions & 45 deletions

File tree

‎vulnerabilities/importers/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@
7474
from vulnerabilities.pipelines.v2_importers import pysec_importer as pysec_importer_v2
7575
from vulnerabilities.pipelines.v2_importers import redhat_importer as redhat_importer_v2
7676
from vulnerabilities.pipelines.v2_importers import ruby_importer as ruby_importer_v2
77+
from vulnerabilities.pipelines.v2_importers import ubuntu_osv_importer as ubuntu_osv_importer_v2
7778
from vulnerabilities.pipelines.v2_importers import vulnrichment_importer as vulnrichment_importer_v2
7879
from vulnerabilities.pipelines.v2_importers import xen_importer as xen_importer_v2
7980
from vulnerabilities.utils import create_registry
@@ -107,6 +108,7 @@
107108
debian_importer_v2.DebianImporterPipeline,
108109
mattermost_importer_v2.MattermostImporterPipeline,
109110
apache_tomcat_v2.ApacheTomcatImporterPipeline,
111+
ubuntu_osv_importer_v2.UbuntuOSVImporterPipeline,
110112
nvd_importer.NVDImporterPipeline,
111113
github_importer.GitHubAPIImporterPipeline,
112114
gitlab_importer.GitLabImporterPipeline,

‎vulnerabilities/migrations/0112_alter_advisoryseverity_scoring_system_and_more.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Generated by Django 4.2.25 on 2026-02-04 07:49
1+
# Generated by Django 4.2.25 on 2026-02-05 10:10
22

33
from django.db import migrations, models
44

@@ -29,9 +29,9 @@ class Migration(migrations.Migration):
2929
("epss", "Exploit Prediction Scoring System"),
3030
("ssvc", "Stakeholder-Specific Vulnerability Categorization"),
3131
("openssl", "OpenSSL Severity"),
32-
("ubuntu", "Ubuntu priority"),
32+
("ubuntu-priority", "Ubuntu Priority"),
3333
],
34-
help_text="Identifier for the scoring system used. Available choices are: cvssv2: CVSSv2 Base Score,\ncvssv3: CVSSv3 Base Score,\ncvssv3.1: CVSSv3.1 Base Score,\ncvssv4: CVSSv4 Base Score,\nrhbs: RedHat Bugzilla severity,\nrhas: RedHat Aggregate severity,\narchlinux: Archlinux Vulnerability Group Severity,\ncvssv3.1_qr: CVSSv3.1 Qualitative Severity Rating,\ngeneric_textual: Generic textual severity rating,\napache_httpd: Apache Httpd Severity,\napache_tomcat: Apache Tomcat Severity,\nepss: Exploit Prediction Scoring System,\nssvc: Stakeholder-Specific Vulnerability Categorization,\nopenssl: OpenSSL Severity,\nubuntu: Ubuntu priority ",
34+
help_text="Identifier for the scoring system used. Available choices are: cvssv2: CVSSv2 Base Score,\ncvssv3: CVSSv3 Base Score,\ncvssv3.1: CVSSv3.1 Base Score,\ncvssv4: CVSSv4 Base Score,\nrhbs: RedHat Bugzilla severity,\nrhas: RedHat Aggregate severity,\narchlinux: Archlinux Vulnerability Group Severity,\ncvssv3.1_qr: CVSSv3.1 Qualitative Severity Rating,\ngeneric_textual: Generic textual severity rating,\napache_httpd: Apache Httpd Severity,\napache_tomcat: Apache Tomcat Severity,\nepss: Exploit Prediction Scoring System,\nssvc: Stakeholder-Specific Vulnerability Categorization,\nopenssl: OpenSSL Severity,\nubuntu-priority: Ubuntu Priority ",
3535
max_length=50,
3636
),
3737
),
@@ -54,9 +54,9 @@ class Migration(migrations.Migration):
5454
("epss", "Exploit Prediction Scoring System"),
5555
("ssvc", "Stakeholder-Specific Vulnerability Categorization"),
5656
("openssl", "OpenSSL Severity"),
57-
("ubuntu", "Ubuntu priority"),
57+
("ubuntu-priority", "Ubuntu Priority"),
5858
],
59-
help_text="Identifier for the scoring system used. Available choices are: cvssv2: CVSSv2 Base Score,\ncvssv3: CVSSv3 Base Score,\ncvssv3.1: CVSSv3.1 Base Score,\ncvssv4: CVSSv4 Base Score,\nrhbs: RedHat Bugzilla severity,\nrhas: RedHat Aggregate severity,\narchlinux: Archlinux Vulnerability Group Severity,\ncvssv3.1_qr: CVSSv3.1 Qualitative Severity Rating,\ngeneric_textual: Generic textual severity rating,\napache_httpd: Apache Httpd Severity,\napache_tomcat: Apache Tomcat Severity,\nepss: Exploit Prediction Scoring System,\nssvc: Stakeholder-Specific Vulnerability Categorization,\nopenssl: OpenSSL Severity,\nubuntu: Ubuntu priority ",
59+
help_text="Identifier for the scoring system used. Available choices are: cvssv2: CVSSv2 Base Score,\ncvssv3: CVSSv3 Base Score,\ncvssv3.1: CVSSv3.1 Base Score,\ncvssv4: CVSSv4 Base Score,\nrhbs: RedHat Bugzilla severity,\nrhas: RedHat Aggregate severity,\narchlinux: Archlinux Vulnerability Group Severity,\ncvssv3.1_qr: CVSSv3.1 Qualitative Severity Rating,\ngeneric_textual: Generic textual severity rating,\napache_httpd: Apache Httpd Severity,\napache_tomcat: Apache Tomcat Severity,\nepss: Exploit Prediction Scoring System,\nssvc: Stakeholder-Specific Vulnerability Categorization,\nopenssl: OpenSSL Severity,\nubuntu-priority: Ubuntu Priority ",
6060
max_length=50,
6161
),
6262
),

‎vulnerabilities/pipes/osv_v2.py‎

Lines changed: 29 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,12 @@
5151
"crates.io": "cargo",
5252
}
5353

54+
OSV_TO_VCIO_SEVERITY_MAP = {
55+
"cvss_v3": "cvssv3.1",
56+
"cvss_v4": "cvssv4",
57+
"ubuntu": "ubuntu-priority",
58+
}
59+
5460

5561
def parse_advisory_data_v3(
5662
raw_data: dict, supported_ecosystems, advisory_url: str, advisory_text: str
@@ -242,27 +248,33 @@ def get_severities(raw_data, url) -> Iterable[VulnerabilitySeverity]:
242248
try:
243249
for severity in raw_data.get("severity") or []:
244250
severity_type = severity.get("type")
245-
score = severity.get("score")
251+
value = severity.get("score")
252+
severity_type = severity_type.lower()
253+
scoring_element = None
254+
255+
if (
256+
severity_type not in SCORING_SYSTEMS
257+
and severity_type not in OSV_TO_VCIO_SEVERITY_MAP
258+
):
259+
logger.error(
260+
f"Unsupported severity type: {severity!r} for OSV id: {raw_data.get('id')!r}"
261+
)
262+
continue
246263

247-
if severity_type == "CVSS_V3":
248-
system = SCORING_SYSTEMS["cvssv3.1"]
249-
valid_vector = score[:-1] if score and score.endswith("/") else score
250-
value = system.compute(valid_vector)
251-
yield VulnerabilitySeverity(system=system, value=value, scoring_elements=score)
264+
severity_type = OSV_TO_VCIO_SEVERITY_MAP.get(severity_type, severity_type)
265+
system = SCORING_SYSTEMS[severity_type]
252266

253-
elif severity_type == "CVSS_V4":
254-
system = SCORING_SYSTEMS["cvssv4"]
255-
valid_vector = score[:-1] if score and score.endswith("/") else score
267+
if severity_type in ["cvssv3.1", "cvssv4"]:
268+
scoring_element = value
269+
valid_vector = value[:-1] if value and value.endswith("/") else value
256270
value = system.compute(valid_vector)
257-
yield VulnerabilitySeverity(system=system, value=value, scoring_elements=score)
258-
elif severity_type.lower() in SCORING_SYSTEMS:
259-
system = SCORING_SYSTEMS[severity_type.lower()]
260-
yield VulnerabilitySeverity(system=system, value=score, url=url)
261271

262-
else:
263-
logger.error(
264-
f"Unsupported severity type: {severity!r} for OSV id: {raw_data.get('id')!r}"
265-
)
272+
yield VulnerabilitySeverity(
273+
system=system,
274+
value=value,
275+
scoring_elements=scoring_element,
276+
url=url,
277+
)
266278
except (CVSS3MalformedError, CVSS4MalformedError) as e:
267279
logger.error(f"Invalid severity {e}")
268280

‎vulnerabilities/severity_systems.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -196,12 +196,12 @@ def get(self, scoring_elements: str) -> dict:
196196
"Low",
197197
]
198198

199-
UBUNTU = ScoringSystem(
200-
identifier="ubuntu",
201-
name="Ubuntu priority",
199+
UBUNTU_PRIORITY = ScoringSystem(
200+
identifier="ubuntu-priority",
201+
name="Ubuntu Priority",
202202
url="https://ubuntu.com/security/cves/about#priority",
203203
)
204-
UBUNTU.choices = [
204+
UBUNTU_PRIORITY.choices = [
205205
"Critical",
206206
"High",
207207
"Medium",
@@ -252,6 +252,6 @@ def get(self, scoring_elements: str):
252252
EPSS,
253253
SSVC,
254254
OPENSSL,
255-
UBUNTU,
255+
UBUNTU_PRIORITY,
256256
)
257257
}

‎vulnerabilities/tests/test_data/ubuntu/ubuntu_osv_advisoryv2-expected.json‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,9 @@
3636
"patches": [],
3737
"severities": [
3838
{
39-
"system": "ubuntu",
39+
"system": "ubuntu-priority",
4040
"value": "low",
41-
"scoring_elements": ""
41+
"scoring_elements": null
4242
}
4343
],
4444
"date_published": "2014-04-05T21:55:00+00:00",
@@ -139,9 +139,9 @@
139139
"patches": [],
140140
"severities": [
141141
{
142-
"system": "ubuntu",
142+
"system": "ubuntu-priority",
143143
"value": "medium",
144-
"scoring_elements": ""
144+
"scoring_elements": null
145145
}
146146
],
147147
"date_published": "2020-05-24T00:00:00+00:00",
@@ -199,9 +199,9 @@
199199
"patches": [],
200200
"severities": [
201201
{
202-
"system": "ubuntu",
202+
"system": "ubuntu-priority",
203203
"value": "low",
204-
"scoring_elements": ""
204+
"scoring_elements": null
205205
}
206206
],
207207
"date_published": "2010-04-06T16:30:00+00:00",
@@ -250,9 +250,9 @@
250250
"patches": [],
251251
"severities": [
252252
{
253-
"system": "ubuntu",
253+
"system": "ubuntu-priority",
254254
"value": "low",
255-
"scoring_elements": ""
255+
"scoring_elements": null
256256
}
257257
],
258258
"date_published": "2015-03-17T00:00:00+00:00",
@@ -342,15 +342,15 @@
342342
],
343343
"patches": [],
344344
"severities": [
345-
{
346-
"system": "ubuntu",
347-
"value": "medium",
348-
"scoring_elements": ""
349-
},
350345
{
351346
"system": "cvssv3.1",
352347
"value": "9.8",
353348
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
349+
},
350+
{
351+
"system": "ubuntu-priority",
352+
"value": "medium",
353+
"scoring_elements": null
354354
}
355355
],
356356
"date_published": "2020-03-23T22:15:00+00:00",
@@ -440,11 +440,6 @@
440440
],
441441
"patches": [],
442442
"severities": [
443-
{
444-
"system": "ubuntu",
445-
"value": "medium",
446-
"scoring_elements": ""
447-
},
448443
{
449444
"system": "cvssv3.1",
450445
"value": "4.2",
@@ -459,6 +454,11 @@
459454
"system": "cvssv4",
460455
"value": "2.3",
461456
"scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
457+
},
458+
{
459+
"system": "ubuntu-priority",
460+
"value": "medium",
461+
"scoring_elements": null
462462
}
463463
],
464464
"date_published": "2025-12-09T16:17:00+00:00",

0 commit comments

Comments
 (0)