Skip to content

Commit f17ed8f

Browse files
valentijnscholtenvalentijnscholten
authored
trivy: map status field (#12686)
* trivy: map status field * docs update * docs update * do not set false_p
1 parent 2297812 commit f17ed8f

File tree

4 files changed

+774
-1
lines changed

4 files changed

+774
-1
lines changed

‎docs/content/en/connecting_your_tools/parsers/file/trivy.md

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,22 @@ toc_hide: true
44
---
55
JSON report of [trivy scanner](https://github.com/aquasecurity/trivy).
66

7+
The [status](https://trivy.dev/latest/docs/configuration/filtering/) field in Trivy is mapped to the Defect Dojo status flags in the following way:
8+
9+
| Trivy Status | Active | Verified | Mitigated | Remarks |
10+
|----------------------|--------|----------|-----------|-----------------------------------------------------------------------------------------------------------------|
11+
| unknown | True | False | False | use default value for active which is usually True |
12+
| not_affected | False | True | True | false positive is the most appropriate status for not affected as out of scope might be interpreted as something else |
13+
| affected | True | True | False | standard case |
14+
| fixed | True | True | False | fixed in this context means that there is a fix available by patching/updating/upgrading the package but it's still active and verified |
15+
| under_investigation | True | False | False | no status flag in Defect Dojo to capture this, but verified is False |
16+
| will_not_fix | True | True | False | no different from affected as Defect Dojo doesn't have a flag to capture will_not_fix by OS/Package Vendor; we can't set active to False as the user needs to risk accept this finding |
17+
| fix_deferred | True | True | False | no different from affected as Defect Dojo doesn't have a flag to capture will_not_fix by OS/Package Vendor; we can't set active to False as the user needs to (temporarily) risk accept this finding |
18+
| end_of_life | True | True | False | no different from affected as Defect Dojo doesn't have a flag to capture will_not_fix by OS/Package Vendor; we can't set active to False as the user needs to (temporarily) risk accept
19+
20+
The status field contains the status as assigned by the OS/Package vendor such as Red Hat, Debian, etc.
21+
It is recommended to assess the appropriate action in your Product's context.
22+
If you want to exclude certain status from being imported into Defect Dojo, please [filter them in the export from Trivy](https://trivy.dev/latest/docs/configuration/filtering/)
23+
724
### Sample Scan Data
8-
Sample Trivy scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/trivy).
25+
Sample Trivy scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/trivy)

‎dojo/tools/trivy/parser.py

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,85 @@ def convert_cvss_score(self, raw_value):
6666
return "High"
6767
return "Critical"
6868

69+
def convert_trivy_status(self, trivy_status: str) -> dict:
70+
"""
71+
Determine status fields based on Trivy status
72+
73+
From: https://trivy.dev/v0.54/docs/configuration/filtering/
74+
75+
Trivy has a Status field based on VEX vulnerability statuses. Please not these are statuses based on the vulnerability advisories by OS vendors such as Debian, RHEL, etc.
76+
77+
- `unknown`
78+
- `not_affected`: this package is not affected by this vulnerability on this platform
79+
- `affected`: this package is affected by this vulnerability on this platform, but there is no patch released yet
80+
- `fixed`: this vulnerability is fixed on this platform
81+
- `under_investigation`: it is currently unknown whether or not this vulnerability affects this package on this platform, and it is under investigation
82+
- `will_not_fix`: this package is affected by this vulnerability on this platform, but there is currently no intention to fix it (this would primarily be for flaws that are of Low or Moderate impact that pose no significant risk to customers)
83+
- `fix_deferred`: this package is affected by this vulnerability on this platform, and may be fixed in the future
84+
- `end_of_life`: this package has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed
85+
86+
87+
Note that vulnerabilities with the `unknown`, `not_affected` or `under_investigation` status are not detected.
88+
These are only defined for comprehensiveness, and you will not have the opportunity to specify these statuses.
89+
90+
Some statuses are supported in limited distributions.
91+
92+
| OS | Fixed | Affected | Under Investigation | Will Not Fix | Fix Deferred | End of Life |
93+
|:----------:|:-----:|:--------:|:-------------------:|:------------:|:------------:|:-----------:|
94+
| Debian | ✓ | ✓ | | | ✓ | ✓ |
95+
| RHEL | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
96+
| Other OSes | ✓ | ✓ | | | | |
97+
"""
98+
status_mapping = {
99+
"unknown": {
100+
# use default value for active which is usually True
101+
"verified": False,
102+
},
103+
"not_affected": {
104+
# false positive is the most appropriate status for not affected as out of scope might be interpreted as something else
105+
"active": False,
106+
"verified": True,
107+
"is_mitigated": True,
108+
},
109+
"affected": {
110+
# standard case
111+
"active": True,
112+
"verified": True,
113+
},
114+
"fixed": {
115+
# fixed in this context means that there is a fix available by patching/updating/upgrading the package
116+
# but it's still active and verified
117+
"active": True,
118+
"verified": True,
119+
},
120+
"under_investigation": {
121+
# no status flag in Defect Dojo to capture this, but verified is False
122+
"active": True,
123+
"verified": False,
124+
},
125+
"will_not_fix": {
126+
# no different from affected as Defect Dojo doesn't have a flag to capture will_not_fix by OS/Package Vendor
127+
# we can't set active to False as the user needs to risk accept this finding
128+
"active": True,
129+
"verified": True,
130+
},
131+
"fix_deferred": {
132+
# no different from affected as Defect Dojo doesn't have a flag to capture will_not_fix by OS/Package Vendor
133+
# we can't set active to False as the user needs to (temporarily) risk accept this finding
134+
"active": True,
135+
"verified": True,
136+
},
137+
"end_of_life": {
138+
# no different from affected as Defect Dojo doesn't have a flag to capture will_not_fix by OS/Package Vendor
139+
# we can't set active to False as the user needs to (temporarily) risk accept this finding
140+
"active": True,
141+
"verified": True,
142+
},
143+
}
144+
145+
# default is to fallback to default Defect Dojo behaviour which takes scan parameters into account
146+
return status_mapping.get(trivy_status, {})
147+
69148
def get_findings(self, scan_file, test):
70149
scan_data = scan_file.read()
71150

@@ -194,6 +273,8 @@ def get_result_items(self, test, results, service_name=None, artifact_name=""):
194273
package_version = vuln.get("InstalledVersion", "")
195274
references = "\n".join(vuln.get("References", []))
196275
mitigation = vuln.get("FixedVersion", "")
276+
impact = vuln.get("Status", "")
277+
status_fields = self.convert_trivy_status(vuln.get("Status", ""))
197278
cwe = int(vuln["CweIDs"][0].split("-")[1]) if len(vuln.get("CweIDs", [])) > 0 else 0
198279
vul_type = target_data.get("Type", "")
199280
title = f"{vuln_id} {package_name} {package_version}"
@@ -212,6 +293,7 @@ def get_result_items(self, test, results, service_name=None, artifact_name=""):
212293
file_path=file_path,
213294
references=references,
214295
description=description,
296+
impact=impact,
215297
mitigation=mitigation,
216298
component_name=package_name,
217299
component_version=package_version,
@@ -220,6 +302,7 @@ def get_result_items(self, test, results, service_name=None, artifact_name=""):
220302
dynamic_finding=False,
221303
tags=[vul_type, target_class],
222304
service=service_name,
305+
**status_fields,
223306
)
224307

225308
if vuln_id:

0 commit comments

Comments
 (0)