Bug 12996 - NIST import not working
Summary: NIST import not working
Status: RESOLVED FIXED
Alias: None
Product: Security Response Tool
Classification: Yocto Project Subprojects
Component: General (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Medium normal
Target Milestone: ---
Assignee: David Reyna
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2018-11-09 12:48 UTC by Ross Burton
Modified: 2018-11-13 09:54 UTC (History)
0 users

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ross Burton 2018-11-09 12:48:42 UTC 
Daylight saving has resulted in the NIST parsing being too strict:

$ ./bin/srtool_nist.py -n --source="NIST 2018"
--file=data/nvdcve-1.0-2018.json --url-file=nvdcve-1.0-2018.json.gz
--url-meta=nvdcve-1.0-2018.meta
BEGINNING NIST UPDATES PLEASE WAIT ... this can take some time
DATABASE UPDATED FAILED ... time data
'lastModifiedDate:2018-11-08T03:06:21-05:00\r\n' does not match format
'lastModifiedDate:%Y-%m-%dT%H:%M:%S-04:00\r\n'
Comment 1 David Reyna 2018-11-09 20:59:25 UTC 
Remove UTC offset to avoid timezone/day light savings errors.
Comment 2 Ross Burton 2018-11-12 11:29:36 UTC 
$ ./bin/srtool_nist.py -n --source="NIST 2018" --file=data/nvdcve-1.0-2018.json --url-file=nvdcve-1.0-2018.json.gz --url-meta=nvdcve-1.0-2018.meta
BEGINNING NIST UPDATES PLEASE WAIT ... this can take some time
[  99]                 CVE-2018-9999
DATABASE UPDATE FINISHED
Comment 3 Ross Burton 2018-11-12 15:57:03 UTC 
Just discovered this in the NIST description field for new CVEs:

ERROR(1):b'Traceback (most recent call last):
File "bin/srtool_nist.py", line 695, in <module>
    main(sys.argv[1:])
  File "bin/srtool_nist.py", line 643, in main
    fetch_cve(args.cve_detail,args.cve_file)
  File "bin/srtool_nist.py", line 594, in fetch_cve
    summary[\'cpe_list\'] += nist_scan_configuration_or(config, cve_name, 0)\n  File "bin/srtool_nist.py", line 606, in nist_scan_configuration_or
    for cpe in cpe_or_node[\'cpe\']:\nKeyError: \'cpe\''
Comment 4 David Reyna 2018-11-12 22:54:16 UTC 
NIST is its wisdom has added or replaced the "cpe" sub-table with "cpe-match" in the 2018 tables. The 2015 sub-table still uses "cpe".

The updated code now accepts both table names when scanning CPE entries.
Comment 5 Ross Burton 2018-11-13 09:54:10 UTC 
Confirmed fixed.