[Buildroot] [RFC PATCH 04/14] utils/generate-cyclonedx: support vulnerability details

[Thomas Perale via buildroot <buildroot@buildroot.org>]

Translate the OpenVex notation used to describe the vulnerabilities that
aren't patched in Buildroot into the CycloneDX format.

- fixed -> resolved
- not-affected-component-not-present -> false_positive
- not-affected-vulnerable-code-not-present -> not_affected &
  code_not_present
- not-affected-vulnerable-code-not-in-execute-path -> not_affected &
  code_not_reachable
- not-affected-vulnerable-code-cannot-be-controlled-by-adversary -> not_affected &
  protected_by_mitigating_control

See https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_analysis
for more information

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 utils/generate-cyclonedx | 83 +++++++++++++++++++++++++++++++++-------
 1 file changed, 69 insertions(+), 14 deletions(-)

diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
index df12ee84c0..c1aa1f980d 100755
--- a/utils/generate-cyclonedx
+++ b/utils/generate-cyclonedx
@@ -403,6 +403,43 @@ def cyclonedx_dependency(ref, depends):
         "dependsOn": sorted(depends),
     }
 
+def openvex_to_cyclonedx_analysis(state) -> dict:
+    """Convert an OpenVex vulnerability state into a CycloneDX analysis.
+
+    Supported:
+      - fixed
+      - not-affected-component-not-present
+      - not-affected-vulnerable-code-not-present
+      - not-affected-vulnerable-code-not-in-execute-path
+      - not-affected-vulnerable-code-cannot-be-controlled-by-adversary
+
+    Args:
+        state (str): OpenVex status string.
+
+    Returns:
+        dict: CycloneDX analysis dict with 'state' and optional 'justification'.
+    """
+    MAPPING = {
+        "fixed": {
+            "state": "resolved",
+        },
+        "not-affected-component-not-present": {
+            "state": "false_positive",
+        },
+        "not-affected-vulnerable-code-not-present": {
+            "state": "not_affected",
+            "justification": "code_not_present",
+        },
+        "not-affected-vulnerable-code-not-in-execute-path": {
+            "state": "not_affected",
+            "justification": "code_not_reachable",
+        },
+        "not-affected-vulnerable-code-cannot-be-controlled-by-adversary": {
+            "state": "not_affected",
+            "justification": "protected_by_mitigating_control",
+        },
+    }
+    return MAPPING.get(state, {"state": "in_triage"})
 
 def cyclonedx_vulnerabilities(show_info_dict):
     """Create a JSON list of vulnerabilities ignored by buildroot and associate
@@ -421,20 +458,38 @@ def cyclonedx_vulnerabilities(show_info_dict):
         for cve in comp.get('ignore_cves', []):
             cves.setdefault(cve, []).append(name)
 
-    return [{
-        "id": cve,
-        "source": {
-            "name": "NVD",
-            "url": "https://nvd.nist.gov/vuln/detail/" + cve
-        },
-        "analysis": {
-            "state": "resolved_with_pedigree" if cve in VULN_WITH_PEDIGREE else "in_triage",
-            "detail": f"The CVE '{cve}' has been marked as ignored by Buildroot"
-        },
-        "affects": [
-            {"ref": bomref} for bomref in components
-        ]
-    } for cve, components in cves.items()]
+    ret = []
+    for cve, components in cves.items():
+        # retrieve first occurance of the "cves_status" for this CVE.
+        cve_status = next(
+            (status for comp_name in components
+             if (status := show_info_dict.get(comp_name, {}).get("cves_status", {}).get(cve, {}))),
+            {}
+        )
+
+        if cve in VULN_WITH_PEDIGREE:
+            state = {"state": "resolved_with_pedigree"}
+        else:
+            state = openvex_to_cyclonedx_analysis(cve_status.get("status"))
+
+        detail = cve_status.get("detail", f"The CVE '{cve}' has been marked as ignored by Buildroot")
+
+        ret.append({
+            "id": cve,
+            "source": {
+                "name": "NVD",
+                "url": "https://nvd.nist.gov/vuln/detail/" + cve
+            },
+            "analysis": {
+                **state,
+                "detail": detail
+            },
+            "affects": [
+                {"ref": bomref} for bomref in components
+            ]
+        })
+
+    return ret
 
 
 def br2_virtual_is_provided_by(ref, show_info_dict) -> list:
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot