MIRRORS/yocto-autobuilder-helper
1
0
Fork 0
mirror of git://git.yoctoproject.org/yocto-autobuilder-helper.git synced 2025-07-19 12:49:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

cve-report: Reformat txt recipe list per branch

Browse Source 
Yocto gathers the amount of CVEs per branch at the top of their metrics view.
However, the presentation of this information is not descriptive enough and it’s spread across several files.
This change adds collapsible, nested lists to show all cve information.

Show current CVE count per release,
parse txt files with CVE lists to group them by project and display their total CVE count.
Inline this data on the matrics-page in details elements so there’s no need to navigate away.

The current output includes the count of cve's and the cve-urls. No data is lost here, it looks like:

CVE counts by recipes:

linux-yocto: 134
  https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0524
  https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0656
  ...

bluez5: 2
  https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3563
  https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3637
...

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Ninette Adhikari 2024-04-18 11:49:11 +02:00 committed by Richard Purdie
parent c2ab478d5d
commit 7fe66f781e
1 changed files with 16 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
scripts/cve-report.py
View File

@ -12,7 +12,6 @@ with open(jsonfile) as f:
cvedata = json.load(f)
cves = dict()
recipe_counts = {}
for recipe in cvedata['package']:
if recipe['name'] in ignored_recipes:
@ -24,21 +23,24 @@ for recipe in cvedata['package']:
if i["id"] in cves:
cves[i["id"]] += ":" + recipe['name']
else:
cves[i["id"]] = recipe['name']
cves[i["id"]] = recipe['name']
print("Found %d unpatched CVEs" % len(cves))
for cve in sorted(cves.keys()):
print("%s: %s https://web.nvd.nist.gov/view/vuln/detail?vulnId=%s *" % (cve, cves[cve], cve))
recipe_counts = {}
for cve in cves:
recipename = cves[cve]
if recipename in recipe_counts:
recipe_counts[recipename] += 1
for cve, name in cves.items():
if name not in recipe_counts:
recipe_counts[name] = {'count': 1, 'cves': [f"https://web.nvd.nist.gov/view/vuln/detail?vulnId={cve}"]}
else:
recipe_counts[recipename] = 1
recipe_counts[name]['count'] += 1
recipe_counts[name]['cves'].append(f"https://web.nvd.nist.gov/view/vuln/detail?vulnId={cve}")
formatted_data = {}
for name, info in sorted(recipe_counts.items(), key=lambda x:x[1]['count'], reverse= True):
formatted_data[f"{name}: {info['count']}"] = info['cves']
print("\n")
print("Summary of CVE counts by recipes:\n")
for recipe, count in sorted(recipe_counts.items(), key=lambda x: x[1], reverse=True):
print(" %s: %s" % (recipe, count))
print("CVE counts by recipes:")
for name, cves in formatted_data.items():
print("")
print(name)
for cve in cves:
print(f" {cve}")