Skip to content

Commit ac25ef3

Browse files
ffontaineffontaine
authored
Merge branch 'main' into add-sbom-evidence-to-all-components
2 parents 50c871c + 2ed6280 commit ac25ef3

16 files changed

+237
-224
lines changed

‎cve_bin_tool/data_sources/nvd_source.py‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
DISK_LOCATION_BACKUP,
2525
DISK_LOCATION_DEFAULT,
2626
NVD_FILENAME_TEMPLATE,
27+
NVD_VERSION,
2728
)
2829
from cve_bin_tool.error_handler import (
2930
AttemptedToWriteOutsideCachedir,
@@ -49,11 +50,13 @@ class NVD_Source(Data_Source):
4950
CACHEDIR = DISK_LOCATION_DEFAULT
5051
BACKUPCACHEDIR = DISK_LOCATION_BACKUP
5152
FEED_NVD = "https://nvd.nist.gov/vuln/data-feeds"
52-
FEED_MIRROR = "https://v4.mirror.cveb.in/nvd/json/cve/1.1"
53+
FEED_MIRROR = f"https://v4.mirror.cveb.in/nvd/json/cve/{NVD_VERSION}"
5354
LOGGER = LOGGER.getChild("CVEDB")
5455
NVDCVE_FILENAME_TEMPLATE = NVD_FILENAME_TEMPLATE
56+
NVDCVE_VERSION = NVD_VERSION
57+
NVDCVE_TOP_LIST_TAG = "CVE_Items" if NVD_VERSION == "1.1" else "vulnerabilities"
5558
META_LINK_NVD = "https://nvd.nist.gov"
56-
META_LINK_MIRROR = "https://v4.mirror.cveb.in/nvd/json/cve/1.1"
59+
META_LINK_MIRROR = f"https://v4.mirror.cveb.in/nvd/json/cve/{NVD_VERSION}"
5760
META_REGEX_NVD = re.compile(r"feeds\/json\/.*-[0-9]*\.[0-9]*-[0-9]*\.meta")
5861
META_REGEX_MIRROR = re.compile(r"nvdcve-[0-9]*\.[0-9]*-[0-9]*\.meta")
5962
RANGE_UNSET = ""
@@ -107,9 +110,14 @@ async def get_cve_data(self):
107110
severity_data = []
108111
affected_data = []
109112
years = self.nvd_years()
113+
formatter = (
114+
self.format_data
115+
if self.NVDCVE_VERSION == "1.1"
116+
else self.format_data_api2
117+
)
110118
for year in years:
111-
severity, affected = self.format_data(
112-
self.load_nvd_year(year)["CVE_Items"]
119+
severity, affected = formatter(
120+
self.load_nvd_year(year)[self.NVDCVE_TOP_LIST_TAG]
113121
)
114122
severity_data.extend(severity)
115123
affected_data.extend(affected)
@@ -239,6 +247,10 @@ def format_data_api2(self, all_cve_entries):
239247

240248
cve_item = cve_element["cve"]
241249

250+
if cve_item["vulnStatus"] == "Rejected":
251+
# Skip this CVE if it's marked as 'REJECT'
252+
continue
253+
242254
cve = {
243255
"ID": cve_item["id"],
244256
"description": cve_item["descriptions"][0]["value"],
@@ -252,9 +264,6 @@ def format_data_api2(self, all_cve_entries):
252264
else cve_item["published"]
253265
),
254266
}
255-
if cve["description"].startswith("** REJECT **"):
256-
# Skip this CVE if it's marked as 'REJECT'
257-
continue
258267

259268
# Multiple ways of including CVSS metrics.
260269
# Newer data uses "impact" -- we may wish to delete the old below
@@ -612,17 +621,18 @@ def load_nvd_year(self, year: int) -> dict[str, str | object]:
612621
with gzip.open(filename, "rb") as fileobj:
613622
cves_for_year = json.load(fileobj)
614623
self.LOGGER.debug(
615-
f'Year {year} has {len(cves_for_year["CVE_Items"])} CVEs in dataset'
624+
f"Year {year} has {len(cves_for_year[self.NVDCVE_TOP_LIST_TAG])} CVEs in dataset"
616625
)
617626
return cves_for_year
618627

619628
def nvd_years(self) -> list[int]:
620629
"""
621630
Return the years we have NVD data for.
622631
"""
632+
any_year_file = self.NVDCVE_FILENAME_TEMPLATE.format("*")
623633
return sorted(
624634
int(filename.split(".")[-3].split("-")[-1])
625-
for filename in glob.glob(str(Path(self.cachedir) / "nvdcve-1.1-*.json.gz"))
635+
for filename in glob.glob(str(Path(self.cachedir) / any_year_file))
626636
)
627637
# FIXME: temporary workaround so we don't try to load bad year data
628638
# return list(range(2020, 2025))

‎cve_bin_tool/database_defaults.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,5 @@
99
DISK_LOCATION_BACKUP = CACHE_DIR / "cve-bin-tool-backup"
1010
OLD_CACHE_DIR = Path.home() / ".cache" / "cvedb"
1111
DBNAME = "cve.db"
12-
NVD_FILENAME_TEMPLATE = "nvdcve-1.1-{}.json.gz"
12+
NVD_VERSION = "2.0"
13+
NVD_FILENAME_TEMPLATE = "nvdcve-" + NVD_VERSION + "-{}.json.gz"

‎sbom/cve-bin-tool-py3.10.json‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.7",
5-
"serialNumber": "urn:uuid:c3cb32d7-0079-445e-9940-dcc3953bbff2",
5+
"serialNumber": "urn:uuid:3afa9eb1-4948-472a-bffc-204138519a06",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2025-11-03T00:42:18Z",
8+
"timestamp": "2025-11-10T00:43:04Z",
99
"lifecycles": [
1010
{
1111
"phase": "build"
@@ -4145,7 +4145,7 @@
41454145
"type": "library",
41464146
"bom-ref": "64-plotly",
41474147
"name": "plotly",
4148-
"version": "6.3.1",
4148+
"version": "6.4.0",
41494149
"supplier": {
41504150
"name": "Chris P",
41514151
"contact": [
@@ -4154,12 +4154,12 @@
41544154
}
41554155
]
41564156
},
4157-
"cpe": "cpe:2.3:a:chris_p:plotly:6.3.1:*:*:*:*:*:*:*",
4157+
"cpe": "cpe:2.3:a:chris_p:plotly:6.4.0:*:*:*:*:*:*:*",
41584158
"description": "An open-source interactive data visualization library for Python",
41594159
"hashes": [
41604160
{
41614161
"alg": "SHA-256",
4162-
"content": "8b4420d1dcf2b040f5983eed433f95732ed24930e496d36eb70d211923532e64"
4162+
"content": "a1062eafbdc657976c2eedd276c90e184ccd6c21282a5e9ee8f20efca9c9a4c5"
41634163
}
41644164
],
41654165
"externalReferences": [
@@ -4169,7 +4169,7 @@
41694169
"comment": "Home page for project"
41704170
},
41714171
{
4172-
"url": "https://pypi.org/project/plotly/6.3.1/#files",
4172+
"url": "https://pypi.org/project/plotly/6.4.0/#files",
41734173
"type": "distribution",
41744174
"comment": "Download location for component"
41754175
},
@@ -4186,11 +4186,11 @@
41864186
"type": "log"
41874187
}
41884188
],
4189-
"purl": "pkg:pypi/plotly@6.3.1",
4189+
"purl": "pkg:pypi/plotly@6.4.0",
41904190
"properties": [
41914191
{
41924192
"name": "release_date",
4193-
"value": "2025-10-02T16:10:22Z"
4193+
"value": "2025-11-04T17:59:22Z"
41944194
},
41954195
{
41964196
"name": "language",
@@ -4210,7 +4210,7 @@
42104210
"type": "library",
42114211
"bom-ref": "65-narwhals",
42124212
"name": "narwhals",
4213-
"version": "2.10.1",
4213+
"version": "2.10.2",
42144214
"supplier": {
42154215
"name": "Marco Gorelli",
42164216
"contact": [
@@ -4219,7 +4219,7 @@
42194219
}
42204220
]
42214221
},
4222-
"cpe": "cpe:2.3:a:marco_gorelli:narwhals:2.10.1:*:*:*:*:*:*:*",
4222+
"cpe": "cpe:2.3:a:marco_gorelli:narwhals:2.10.2:*:*:*:*:*:*:*",
42234223
"description": "Extremely lightweight compatibility layer between dataframe libraries",
42244224
"licenses": [
42254225
{
@@ -4237,7 +4237,7 @@
42374237
"comment": "Home page for project"
42384238
},
42394239
{
4240-
"url": "https://pypi.org/project/narwhals/2.10.1/#files",
4240+
"url": "https://pypi.org/project/narwhals/2.10.2/#files",
42414241
"type": "distribution",
42424242
"comment": "Download location for component"
42434243
},
@@ -4254,11 +4254,11 @@
42544254
"type": "issue-tracker"
42554255
}
42564256
],
4257-
"purl": "pkg:pypi/[email protected].1",
4257+
"purl": "pkg:pypi/[email protected].2",
42584258
"properties": [
42594259
{
42604260
"name": "release_date",
4261-
"value": "2025-10-02T16:10:22Z"
4261+
"value": "2025-11-04T17:59:22Z"
42624262
},
42634263
{
42644264
"name": "language",

‎sbom/cve-bin-tool-py3.10.spdx‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-a231666f-6120-44f7-91b3-d92943ac4331
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-c37a6b38-02c7-4b17-a90d-c51629ac5075
66
LicenseListVersion: 3.26
77
Creator: Tool: sbom4python-0.12.4
8-
Created: 2025-11-03T00:42:03Z
8+
Created: 2025-11-10T00:42:54Z
99
CreatorComment: <text>SBOM Type: Build - This document has been automatically generated.</text>
1010
#####
1111

@@ -1303,13 +1303,13 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:donald_stufft:packaging:25.0:*:*:*:*:*
13031303

13041304
PackageName: plotly
13051305
SPDXID: SPDXRef-64-plotly
1306-
PackageVersion: 6.3.1
1306+
PackageVersion: 6.4.0
13071307
PrimaryPackagePurpose: LIBRARY
13081308
PackageSupplier: Person: Chris P ([email protected])
1309-
PackageDownloadLocation: https://pypi.org/project/plotly/6.3.1/#files
1309+
PackageDownloadLocation: https://pypi.org/project/plotly/6.4.0/#files
13101310
FilesAnalyzed: false
13111311
PackageHomePage: https://plotly.com/python/
1312-
PackageChecksum: SHA256: 8b4420d1dcf2b040f5983eed433f95732ed24930e496d36eb70d211923532e64
1312+
PackageChecksum: SHA256: a1062eafbdc657976c2eedd276c90e184ccd6c21282a5e9ee8f20efca9c9a4c5
13131313
PackageLicenseDeclared: NOASSERTION
13141314
PackageLicenseConcluded: NOASSERTION
13151315
PackageLicenseComments: <text>plotly declares MIT License
@@ -1336,33 +1336,33 @@ THE SOFTWARE.
13361336
which is not currently a valid SPDX License identifier or expression.</text>
13371337
PackageCopyrightText: NOASSERTION
13381338
PackageSummary: <text>An open-source interactive data visualization library for Python</text>
1339-
ReleaseDate: 2025-10-02T16:10:22Z
1339+
ReleaseDate: 2025-11-04T17:59:22Z
13401340
ExternalRef: OTHER documentation https://plotly.com/python/
13411341
ExternalRef: OTHER vcs https://github.com/plotly/plotly.py
13421342
ExternalRef: OTHER log https://github.com/plotly/plotly.py/blob/main/CHANGELOG.md
1343-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/plotly@6.3.1
1344-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:6.3.1:*:*:*:*:*:*:*
1343+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/plotly@6.4.0
1344+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:6.4.0:*:*:*:*:*:*:*
13451345
#####
13461346

13471347
PackageName: narwhals
13481348
SPDXID: SPDXRef-65-narwhals
1349-
PackageVersion: 2.10.1
1349+
PackageVersion: 2.10.2
13501350
PrimaryPackagePurpose: LIBRARY
13511351
PackageSupplier: Person: Marco Gorelli ([email protected])
1352-
PackageDownloadLocation: https://pypi.org/project/narwhals/2.10.1/#files
1352+
PackageDownloadLocation: https://pypi.org/project/narwhals/2.10.2/#files
13531353
FilesAnalyzed: false
13541354
PackageHomePage: https://github.com/narwhals-dev/narwhals
13551355
PackageLicenseDeclared: NOASSERTION
13561356
PackageLicenseConcluded: MIT
13571357
PackageLicenseComments: <text>narwhals declares MIT License which is not currently a valid SPDX License identifier or expression.</text>
13581358
PackageCopyrightText: NOASSERTION
13591359
PackageSummary: <text>Extremely lightweight compatibility layer between dataframe libraries</text>
1360-
ReleaseDate: 2025-10-02T16:10:22Z
1360+
ReleaseDate: 2025-11-04T17:59:22Z
13611361
ExternalRef: OTHER documentation https://narwhals-dev.github.io/narwhals/
13621362
ExternalRef: OTHER vcs https://github.com/narwhals-dev/narwhals
13631363
ExternalRef: OTHER issue-tracker https://github.com/narwhals-dev/narwhals/issues
1364-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].1
1365-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:marco_gorelli:narwhals:2.10.1:*:*:*:*:*:*:*
1364+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].2
1365+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:marco_gorelli:narwhals:2.10.2:*:*:*:*:*:*:*
13661366
#####
13671367

13681368
PackageName: python-gnupg

‎sbom/cve-bin-tool-py3.11.json‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.7",
5-
"serialNumber": "urn:uuid:7028081c-321c-4f41-83d9-e4fb54855c7b",
5+
"serialNumber": "urn:uuid:4a902649-ff6d-4934-be86-2eb8dd79be62",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2025-11-03T00:42:32Z",
8+
"timestamp": "2025-11-10T00:41:52Z",
99
"lifecycles": [
1010
{
1111
"phase": "build"
@@ -4063,7 +4063,7 @@
40634063
"type": "library",
40644064
"bom-ref": "63-plotly",
40654065
"name": "plotly",
4066-
"version": "6.3.1",
4066+
"version": "6.4.0",
40674067
"supplier": {
40684068
"name": "Chris P",
40694069
"contact": [
@@ -4072,12 +4072,12 @@
40724072
}
40734073
]
40744074
},
4075-
"cpe": "cpe:2.3:a:chris_p:plotly:6.3.1:*:*:*:*:*:*:*",
4075+
"cpe": "cpe:2.3:a:chris_p:plotly:6.4.0:*:*:*:*:*:*:*",
40764076
"description": "An open-source interactive data visualization library for Python",
40774077
"hashes": [
40784078
{
40794079
"alg": "SHA-256",
4080-
"content": "8b4420d1dcf2b040f5983eed433f95732ed24930e496d36eb70d211923532e64"
4080+
"content": "a1062eafbdc657976c2eedd276c90e184ccd6c21282a5e9ee8f20efca9c9a4c5"
40814081
}
40824082
],
40834083
"externalReferences": [
@@ -4087,7 +4087,7 @@
40874087
"comment": "Home page for project"
40884088
},
40894089
{
4090-
"url": "https://pypi.org/project/plotly/6.3.1/#files",
4090+
"url": "https://pypi.org/project/plotly/6.4.0/#files",
40914091
"type": "distribution",
40924092
"comment": "Download location for component"
40934093
},
@@ -4104,11 +4104,11 @@
41044104
"type": "log"
41054105
}
41064106
],
4107-
"purl": "pkg:pypi/plotly@6.3.1",
4107+
"purl": "pkg:pypi/plotly@6.4.0",
41084108
"properties": [
41094109
{
41104110
"name": "release_date",
4111-
"value": "2025-10-02T16:10:22Z"
4111+
"value": "2025-11-04T17:59:22Z"
41124112
},
41134113
{
41144114
"name": "language",
@@ -4128,7 +4128,7 @@
41284128
"type": "library",
41294129
"bom-ref": "64-narwhals",
41304130
"name": "narwhals",
4131-
"version": "2.10.1",
4131+
"version": "2.10.2",
41324132
"supplier": {
41334133
"name": "Marco Gorelli",
41344134
"contact": [
@@ -4137,7 +4137,7 @@
41374137
}
41384138
]
41394139
},
4140-
"cpe": "cpe:2.3:a:marco_gorelli:narwhals:2.10.1:*:*:*:*:*:*:*",
4140+
"cpe": "cpe:2.3:a:marco_gorelli:narwhals:2.10.2:*:*:*:*:*:*:*",
41414141
"description": "Extremely lightweight compatibility layer between dataframe libraries",
41424142
"licenses": [
41434143
{
@@ -4155,7 +4155,7 @@
41554155
"comment": "Home page for project"
41564156
},
41574157
{
4158-
"url": "https://pypi.org/project/narwhals/2.10.1/#files",
4158+
"url": "https://pypi.org/project/narwhals/2.10.2/#files",
41594159
"type": "distribution",
41604160
"comment": "Download location for component"
41614161
},
@@ -4172,11 +4172,11 @@
41724172
"type": "issue-tracker"
41734173
}
41744174
],
4175-
"purl": "pkg:pypi/[email protected].1",
4175+
"purl": "pkg:pypi/[email protected].2",
41764176
"properties": [
41774177
{
41784178
"name": "release_date",
4179-
"value": "2025-10-02T16:10:22Z"
4179+
"value": "2025-11-04T17:59:22Z"
41804180
},
41814181
{
41824182
"name": "language",

0 commit comments

Comments
 (0)