mirror of
git://git.yoctoproject.org/yocto-autobuilder-helper.git
synced 2025-07-19 12:49:02 +02:00
7fe66f781e
Yocto gathers the amount of CVEs per branch at the top of their metrics view. However, the presentation of this information is not descriptive enough and it’s spread across several files. This change adds collapsible, nested lists to show all cve information. Show current CVE count per release, parse txt files with CVE lists to group them by project and display their total CVE count. Inline this data on the matrics-page in details elements so there’s no need to navigate away. The current output includes the count of cve's and the cve-urls. No data is lost here, it looks like: CVE counts by recipes: linux-yocto: 134 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0524 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0656 ... bluez5: 2 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3563 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3637 ... Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
47 lines
1.2 KiB
Python
Executable File
47 lines
1.2 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
import os, sys
|
|
import json
|
|
|
|
jsonfile = sys.argv[1]
|
|
|
|
#ignored_recipes = ("linux-yocto", "db", "db-native")
|
|
ignored_recipes = []
|
|
|
|
with open(jsonfile) as f:
|
|
cvedata = json.load(f)
|
|
|
|
cves = dict()
|
|
|
|
for recipe in cvedata['package']:
|
|
if recipe['name'] in ignored_recipes:
|
|
continue
|
|
if 'issue' not in recipe:
|
|
continue
|
|
for i in recipe['issue']:
|
|
if i['status'] == "Unpatched":
|
|
if i["id"] in cves:
|
|
cves[i["id"]] += ":" + recipe['name']
|
|
else:
|
|
cves[i["id"]] = recipe['name']
|
|
|
|
recipe_counts = {}
|
|
|
|
for cve, name in cves.items():
|
|
if name not in recipe_counts:
|
|
recipe_counts[name] = {'count': 1, 'cves': [f"https://web.nvd.nist.gov/view/vuln/detail?vulnId={cve}"]}
|
|
else:
|
|
recipe_counts[name]['count'] += 1
|
|
recipe_counts[name]['cves'].append(f"https://web.nvd.nist.gov/view/vuln/detail?vulnId={cve}")
|
|
|
|
formatted_data = {}
|
|
for name, info in sorted(recipe_counts.items(), key=lambda x:x[1]['count'], reverse= True):
|
|
formatted_data[f"{name}: {info['count']}"] = info['cves']
|
|
|
|
print("CVE counts by recipes:")
|
|
for name, cves in formatted_data.items():
|
|
print("")
|
|
print(name)
|
|
for cve in cves:
|
|
print(f" {cve}")
|