Skip to content

Commit e43d07e

Browse files
alex-cheng-techmanalex-cheng-techman
committed
Add PE metadata extraction for Python version in checker
1 parent 019d1e0 commit e43d07e

12 files changed

+2112
-0
lines changed

‎cve_bin_tool/checkers/openssl.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ class OpensslChecker(Checker):
1818
CONTAINS_PATTERNS = [r"part of OpenSSL", r"openssl.cnf", r"-DOPENSSL_"]
1919
FILENAME_PATTERNS = [r"libssl.so.", r"libcrypto.so"]
2020
VERSION_PATTERNS = [
21+
# for general format: OpenSSL 1.0.2u¡BOpenSSL 3.0.0¡BOpenSSL 1.1.1k
22+
r"OpenSSL\s+([0-9]+\.[0-9]+\.[0-9]+[a-z]*)",
23+
2124
r"OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+\r?\n(?:%s \(Library: %s\)|[a-zA-Z0-9:,_ \.\-\r\n]*OPENSSLDIR|ssl)",
2225
r"(?:%s \(Library: %s\)\r?\n|OPENSSLDIR[a-zA-Z0-9:/ \"\-\r\n]*)OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+",
2326
]

‎cve_bin_tool/checkers/openssl.py.bak

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Copyright (C) 2021 Intel Corporation
2+
# SPDX-License-Identifier: GPL-3.0-or-later
3+
4+
5+
"""
6+
CVE checker for openssl
7+
8+
References:
9+
https://www.openssl.org/news/vulnerabilities.html
10+
http://www.cvedetails.com/vulnerability-list/vendor_id-217/product_id-383/Openssl-Openssl.html
11+
12+
RSS feed: http://www.cvedetails.com/vulnerability-feed.php?vendor_id=217&product_id=383&version_id=&orderby=3&cvssscoremin=0
13+
"""
14+
from cve_bin_tool.checkers import Checker
15+
16+
17+
class OpensslChecker(Checker):
18+
CONTAINS_PATTERNS = [r"part of OpenSSL", r"openssl.cnf", r"-DOPENSSL_"]
19+
FILENAME_PATTERNS = [r"libssl.so.", r"libcrypto.so"]
20+
VERSION_PATTERNS = [
21+
# for general format: OpenSSL 1.0.2u�BOpenSSL 3.0.0�BOpenSSL 1.1.1k
22+
r"OpenSSL\s+([0-9]+\.[0-9]+\.[0-9]+[a-z]*)",
23+
24+
r"OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+\r?\n(?:%s \(Library: %s\)|[a-zA-Z0-9:,_ \.\-\r\n]*OPENSSLDIR|ssl)",
25+
r"(?:%s \(Library: %s\)\r?\n|OPENSSLDIR[a-zA-Z0-9:/ \"\-\r\n]*)OpenSSL ([0-9]+\.[0-9]+\.[0-9]+[a-z]*) [a-zA-Z0-9 ]+",
26+
]
27+
VENDOR_PRODUCT = [("openssl", "openssl")]

‎cve_bin_tool/checkers/python.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ class PythonChecker(Checker):
1919
]
2020
FILENAME_PATTERNS = [r"python"]
2121
VERSION_PATTERNS = [
22+
# to match the data from PE file
23+
r"[Pp]ython ([0-9]+\.[0-9]+\.[0-9]+)",
24+
2225
r"src\\python[23]\\Python-([23]+\.[0-9]+\.[0-9]+)",
2326
r"python(?:[23]+\.[0-9]+)-([23]+\.[0-9]+\.[0-9]+)",
2427
r"pymalloc_debug\r?\n([23]+\.[0-9]+\.[0-9]+)",

‎cve_bin_tool/checkers/python.py.bak

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Copyright (C) 2021 Intel Corporation
2+
# SPDX-License-Identifier: GPL-3.0-or-later
3+
4+
"""
5+
CVE checker for Python
6+
References:
7+
https://www.cvedetails.com/vulnerability-list/vendor_id-10210/product_id-18230/Python-Python.html
8+
9+
10+
"""
11+
from cve_bin_tool.checkers import Checker
12+
13+
14+
class PythonChecker(Checker):
15+
CONTAINS_PATTERNS = [
16+
r"Fatal Python error: unable to decode the command line argument",
17+
r"Internal error in the Python interpreter",
18+
r"CPython",
19+
]
20+
FILENAME_PATTERNS = [r"python"]
21+
VERSION_PATTERNS = [
22+
r"src\\python[23]\\Python-([23]+\.[0-9]+\.[0-9]+)",
23+
r"python(?:[23]+\.[0-9]+)-([23]+\.[0-9]+\.[0-9]+)",
24+
r"pymalloc_debug\r?\n([23]+\.[0-9]+\.[0-9]+)",
25+
r"([23]+\.[0-9]+\.[0-9]+)\r?\nPython %s",
26+
r"([23]+\.[0-9]+\.[0-9]+)\r?\n%\.80s \(%\.80s\) %\.80s",
27+
r"tags/v([23]+\.[0-9]+\.[0-9]+)\r?\n",
28+
]
29+
VENDOR_PRODUCT = [("python_software_foundation", "python"), ("python", "python")]

‎cve_bin_tool/version_scanner.py

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,27 @@ def is_linux_kernel(self, filename: str) -> tuple[bool, str | None]:
231231

232232
return False, output
233233

234+
# used to get product name, version, vendor info PE metadata
235+
def extract_version_from_pe(self, filename: str) -> str:
236+
info = ""
237+
try:
238+
import pefile
239+
with pefile.PE(filename) as pe:
240+
#pe = pefile.PE(filename)
241+
for fileinfo in pe.FileInfo:
242+
for entry in fileinfo:
243+
if entry.Key == b'StringFileInfo':
244+
for st in entry.StringTable:
245+
entries = st.entries
246+
product_name = entries.get(b'ProductName', b'').decode(errors='ignore')
247+
product_version = entries.get(b'ProductVersion', b'').decode(errors='ignore')
248+
company_name = entries.get(b'CompanyName', b'').decode(errors='ignore')
249+
info = (f" {product_name} {product_version} {company_name}")
250+
self.logger.debug(f"peFile.PE Metadata:{info}")
251+
except Exception as e:
252+
LOGGER.debug(f"[PE Metadata] Failed to parse PE file {filename}: {e}")
253+
return info
254+
234255
def scan_file(self, filename: str) -> Iterator[ScanInfo]:
235256
"""Scans a file to see if it contains any of the target libraries,
236257
and whether any of those contain CVEs"""
@@ -261,6 +282,7 @@ def scan_file(self, filename: str) -> Iterator[ScanInfo]:
261282

262283
# parse binary file's strings
263284
lines = parse_strings(filename)
285+
lines += self.extract_version_from_pe(filename)
264286

265287
if self.no_scan:
266288
yield from self.run_checkers(filename, lines)

‎dummy_vex_output

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
{
2+
"document": {
3+
"category": "csaf_vex",
4+
"csaf_version": "2.0",
5+
"notes": [
6+
{
7+
"category": "summary",
8+
"title": "Technical Summary",
9+
"text": "Auto generated CSAF document"
10+
}
11+
],
12+
"publisher": {
13+
"category": "vendor",
14+
"name": "TestVendor",
15+
"namespace": "https://www.example.com",
16+
"contact_details": "TestVendor"
17+
},
18+
"title": "",
19+
"tracking": {
20+
"current_release_date": "2025-06-19T06:59:24Z",
21+
"generator": {
22+
"date": "2025-06-19T06:59:24Z",
23+
"engine": {
24+
"name": "csaf-tool",
25+
"version": "0.3.2"
26+
}
27+
},
28+
"id": "TESTPRODUCT-1.0-VEX",
29+
"initial_release_date": "2025-06-19T06:59:24Z",
30+
"revision_history": [
31+
{
32+
"date": "2025-06-19T06:59:24Z",
33+
"number": "1",
34+
"summary": "None"
35+
}
36+
],
37+
"status": "final",
38+
"version": "1"
39+
}
40+
},
41+
"product_tree": {
42+
"branches": [
43+
{
44+
"category": "vendor",
45+
"name": "TestVendor",
46+
"branches": [
47+
{
48+
"category": "product_name",
49+
"name": "TestProduct",
50+
"branches": [
51+
{
52+
"category": "product_version",
53+
"name": "1.0",
54+
"product": {
55+
"name": "TestVendor TestProduct 1.0",
56+
"product_id": "CSAFPID_0001",
57+
"product_identification_helper": {
58+
"sbom_urls": [
59+
"file:///D:/PythonEnv/dev/cve-bin-tool"
60+
]
61+
}
62+
}
63+
}
64+
]
65+
}
66+
]
67+
}
68+
]
69+
},
70+
"vulnerabilities": [
71+
{
72+
"cve": "CVE-1234-1004",
73+
"notes": [
74+
{
75+
"category": "description",
76+
"title": "CVE description",
77+
"text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1004"
78+
}
79+
],
80+
"product_status": {
81+
"under_investigation": [
82+
"CSAFPID_0001"
83+
]
84+
},
85+
"threats": [
86+
{
87+
"category": "impact",
88+
"details": "",
89+
"date": "2025-06-19T06:59:24Z",
90+
"product_ids": [
91+
"CSAFPID_0001"
92+
]
93+
}
94+
]
95+
},
96+
{
97+
"cve": "CVE-1234-1005",
98+
"notes": [
99+
{
100+
"category": "description",
101+
"title": "CVE description",
102+
"text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1005"
103+
}
104+
],
105+
"product_status": {
106+
"known_not_affected": [
107+
"CSAFPID_0001"
108+
]
109+
},
110+
"flags": [
111+
{
112+
"date": "2025-06-19T06:59:24Z",
113+
"label": "component_not_present",
114+
"product_ids": [
115+
"CSAFPID_0001"
116+
]
117+
}
118+
],
119+
"threats": [
120+
{
121+
"category": "impact",
122+
"details": "Detail field populated.",
123+
"date": "2025-06-19T06:59:24Z",
124+
"product_ids": [
125+
"CSAFPID_0001"
126+
]
127+
}
128+
]
129+
},
130+
{
131+
"cve": "CVE-1234-1006",
132+
"notes": [
133+
{
134+
"category": "description",
135+
"title": "CVE description",
136+
"text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1006"
137+
}
138+
],
139+
"product_status": {
140+
"under_investigation": [
141+
"CSAFPID_0001"
142+
]
143+
},
144+
"threats": [
145+
{
146+
"category": "impact",
147+
"details": "Data field populated.",
148+
"date": "2025-06-19T06:59:24Z",
149+
"product_ids": [
150+
"CSAFPID_0001"
151+
]
152+
}
153+
]
154+
},
155+
{
156+
"cve": "CVE-1234-1007",
157+
"notes": [
158+
{
159+
"category": "description",
160+
"title": "CVE description",
161+
"text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1007"
162+
}
163+
],
164+
"product_status": {
165+
"fixed": [
166+
"CSAFPID_0001"
167+
]
168+
},
169+
"threats": [
170+
{
171+
"category": "impact",
172+
"details": "Data field populated.",
173+
"date": "2025-06-19T06:59:24Z",
174+
"product_ids": [
175+
"CSAFPID_0001"
176+
]
177+
}
178+
]
179+
},
180+
{
181+
"cve": "CVE-1234-1008",
182+
"notes": [
183+
{
184+
"category": "description",
185+
"title": "CVE description",
186+
"text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1008"
187+
}
188+
],
189+
"product_status": {
190+
"under_investigation": [
191+
"CSAFPID_0001"
192+
]
193+
},
194+
"threats": [
195+
{
196+
"category": "impact",
197+
"details": "",
198+
"date": "2025-06-19T06:59:24Z",
199+
"product_ids": [
200+
"CSAFPID_0001"
201+
]
202+
}
203+
]
204+
},
205+
{
206+
"cve": "CVE-1234-1009",
207+
"notes": [
208+
{
209+
"category": "description",
210+
"title": "CVE description",
211+
"text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1009"
212+
}
213+
],
214+
"product_status": {
215+
"under_investigation": [
216+
"CSAFPID_0001"
217+
]
218+
},
219+
"threats": [
220+
{
221+
"category": "impact",
222+
"details": "",
223+
"date": "2025-06-19T06:59:24Z",
224+
"product_ids": [
225+
"CSAFPID_0001"
226+
]
227+
}
228+
]
229+
},
230+
{
231+
"cve": "CVE-1234-1010",
232+
"notes": [
233+
{
234+
"category": "description",
235+
"title": "CVE description",
236+
"text": "https://nvd.nist.gov/vuln/detail/CVE-1234-1010"
237+
}
238+
],
239+
"product_status": {
240+
"under_investigation": [
241+
"CSAFPID_0001"
242+
]
243+
},
244+
"threats": [
245+
{
246+
"category": "impact",
247+
"details": "",
248+
"date": "2025-06-19T06:59:24Z",
249+
"product_ids": [
250+
"CSAFPID_0001"
251+
]
252+
}
253+
]
254+
}
255+
]
256+
}

‎output.cve-bin-tool.2025-06-19.14-59-23.csv

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
vendor,product,version,cve_number,severity,score,source,cvss_version,cvss_vector,paths,remarks,comments
2+
vendor0,product0,1.0,CVE-1234-1004,CRITICAL,4.2,NVD,2,C:H,,NewFound,
3+
vendor0,product0,1.0,CVE-1234-1005,MEDIUM,4.2,NVD,2,C:H,,NotAffected,Detail field populated.
4+
vendor0,product0,1.0,CVE-1234-1006,LOW,1.2,NVD,2,CVSS2.0/C:H,,NewFound,Data field populated.
5+
vendor0,product0,2.8.6,CVE-1234-1007,LOW,2.5,NVD,3,CVSS3.0/C:H/I:L/A:M,,Mitigated,Data field populated.
6+
vendor0,product0,2.8.6,CVE-1234-1008,UNKNOWN,2.5,NVD,3,CVSS3.0/C:H/I:L/A:M,,NewFound,
7+
vendor0,product0,2.8.6,CVE-1234-1009,MEDIUM,2.5,NVD,3,CVSS3.0/C:H/I:L/A:M,,NewFound,
8+
vendor1,product1,3.2.1.0,CVE-1234-1010,HIGH,7.5,OSV,2,C:H/I:L/A:M,,NewFound,

0 commit comments

Comments
 (0)