mirror of
git://git.yoctoproject.org/yocto-autobuilder-helper.git
synced 2025-07-19 20:59:02 +02:00
1591f007b3
It is often helpful to know how many CVEs are open against a given recipe. Add a summary table of this to the end of the CVE listing. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
45 lines
1.1 KiB
Python
Executable File
45 lines
1.1 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
import os, sys
|
|
import json
|
|
|
|
jsonfile = sys.argv[1]
|
|
|
|
#ignored_recipes = ("linux-yocto", "db", "db-native")
|
|
ignored_recipes = []
|
|
|
|
with open(jsonfile) as f:
|
|
cvedata = json.load(f)
|
|
|
|
cves = dict()
|
|
recipe_counts = {}
|
|
|
|
for recipe in cvedata['package']:
|
|
if recipe['name'] in ignored_recipes:
|
|
continue
|
|
if 'issue' not in recipe:
|
|
continue
|
|
for i in recipe['issue']:
|
|
if i['status'] == "Unpatched":
|
|
if i["id"] in cves:
|
|
cves[i["id"]] += ":" + recipe['name']
|
|
else:
|
|
cves[i["id"]] = recipe['name']
|
|
|
|
print("Found %d unpatched CVEs" % len(cves))
|
|
for cve in sorted(cves.keys()):
|
|
print("%s: %s https://web.nvd.nist.gov/view/vuln/detail?vulnId=%s *" % (cve, cves[cve], cve))
|
|
|
|
for cve in cves:
|
|
recipename = cves[cve]
|
|
if recipename in recipe_counts:
|
|
recipe_counts[recipename] += 1
|
|
else:
|
|
recipe_counts[recipename] = 1
|
|
|
|
|
|
print("\n")
|
|
print("Summary of CVE counts by recipes:\n")
|
|
for recipe, count in sorted(recipe_counts.items(), key=lambda x: x[1], reverse=True):
|
|
print(" %s: %s" % (recipe, count))
|