diff --git a/cve_bin_tool/cve_scanner.py b/cve_bin_tool/cve_scanner.py index 0ea093a3cb..479a31c5c8 100644 --- a/cve_bin_tool/cve_scanner.py +++ b/cve_bin_tool/cve_scanner.py @@ -136,6 +136,17 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData): cve_list = list(map(lambda x: x[0], self.cursor.fetchall())) + for cve_number in cve_list: + query = """ + SELECT version FROM cve_range + WHERE CVE_number=? AND versionStartIncluding='' AND versionStartExcluding='' AND versionEndIncluding='' AND versionEndExcluding='' + """ + self.cursor.execute(query, [cve_number]) + affected_versions = list(set(map(lambda x: x[0], self.cursor.fetchall()))) + self.all_cve_version_info[cve_number] = VersionInfo( + "", "", "", "", affected_versions + ) + # Check for any ranges query = """ SELECT @@ -208,6 +219,7 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData): start_excluding=version_start_excluding, end_including=version_end_including, end_excluding=version_end_excluding, + version_list=[], ) product_info_data: CVEData | None = self.all_cve_data.get(product_info) diff --git a/cve_bin_tool/output_engine/__init__.py b/cve_bin_tool/output_engine/__init__.py index eeccc3ba75..5ddd82480d 100644 --- a/cve_bin_tool/output_engine/__init__.py +++ b/cve_bin_tool/output_engine/__init__.py @@ -354,7 +354,7 @@ def output_pdf( except ( KeyError ): # TODO: handle 'UNKNOWN' and some cves more cleanly - version_info = VersionInfo("", "", "", "") + version_info = VersionInfo("", "", "", "", []) cve_by_remarks[cve.remarks][-1].update( {"affected_versions": format_version_range(version_info)} ) diff --git a/cve_bin_tool/output_engine/console.py b/cve_bin_tool/output_engine/console.py index fc28153d96..c95daac0dd 100644 --- a/cve_bin_tool/output_engine/console.py +++ b/cve_bin_tool/output_engine/console.py @@ -203,7 +203,7 @@ def _output_console_nowrap( try: version_info = all_cve_version_info[cve.cve_number] except KeyError: # TODO: handle 'UNKNOWN' and some cves more cleanly - version_info = VersionInfo("", "", "", "") + version_info = VersionInfo("", "", "", "", []) cve_by_remarks[cve.remarks][-1].update( {"affected_versions": format_version_range(version_info)} ) diff --git a/cve_bin_tool/output_engine/util.py b/cve_bin_tool/output_engine/util.py index 3ded2d86fc..22ca1e884c 100644 --- a/cve_bin_tool/output_engine/util.py +++ b/cve_bin_tool/output_engine/util.py @@ -123,7 +123,9 @@ def format_version_range(version_info: VersionInfo) -> str: Reference for Interval terminologies: https://en.wikipedia.org/wiki/Interval_(mathematics) """ - (start_including, start_excluding, end_including, end_excluding) = version_info + (start_including, start_excluding, end_including, end_excluding, version_list) = ( + version_info + ) if start_including and end_including: return f"[{start_including} - {end_including}]" if start_including and end_excluding: @@ -140,6 +142,8 @@ def format_version_range(version_info: VersionInfo) -> str: return f"<= {end_including}" if end_excluding: return f"< {end_excluding}" + if version_list: + return "list: " + ", ".join(version_list) return "-" @@ -225,7 +229,7 @@ def format_output( ): version_info = all_cve_version_info[cve.cve_number] else: # TODO: handle 'UNKNOWN' and some cves more cleanly - version_info = VersionInfo("", "", "", "") + version_info = VersionInfo("", "", "", "", []) details["affected_versions"] = format_version_range(version_info) formatted_output.append(details) diff --git a/cve_bin_tool/util.py b/cve_bin_tool/util.py index 11ee0533f4..c491f8b2ef 100644 --- a/cve_bin_tool/util.py +++ b/cve_bin_tool/util.py @@ -246,6 +246,7 @@ class VersionInfo(NamedTuple): start_excluding: str end_including: str end_excluding: str + version_list: list[str] class CVEData(DefaultDict[str, Union[List[CVE], Set[str]]]): diff --git a/test/test_output_engine.py b/test/test_output_engine.py index 74b7861a31..92ff3c8472 100644 --- a/test/test_output_engine.py +++ b/test/test_output_engine.py @@ -454,15 +454,15 @@ class TestOutputEngine(unittest.TestCase): } MOCK_ALL_CVE_VERSION_INFO = { - "UNKNOWN": VersionInfo("", "", "", ""), - "CVE-9999-0001": VersionInfo("0.9.0", "", "1.2.0", ""), - "CVE-9999-0002": VersionInfo("0.9.0", "", "", "1.2.0"), - "CVE-9999-0003": VersionInfo("", "0.9.0", "1.2.0", ""), - "CVE-9999-0004": VersionInfo("", "0.9.0", "", "1.2.0"), - "CVE-9999-0005": VersionInfo("0.9.0", "", "", ""), - "CVE-9999-0006": VersionInfo("", "0.9.0", "", ""), - "CVE-9999-0007": VersionInfo("", "", "1.2.0", ""), - "CVE-9999-0008": VersionInfo("", "", "", "1.2.0"), + "UNKNOWN": VersionInfo("", "", "", "", []), + "CVE-9999-0001": VersionInfo("0.9.0", "", "1.2.0", "", []), + "CVE-9999-0002": VersionInfo("0.9.0", "", "", "1.2.0", []), + "CVE-9999-0003": VersionInfo("", "0.9.0", "1.2.0", "", []), + "CVE-9999-0004": VersionInfo("", "0.9.0", "", "1.2.0", []), + "CVE-9999-0005": VersionInfo("0.9.0", "", "", "", []), + "CVE-9999-0006": VersionInfo("", "0.9.0", "", "", []), + "CVE-9999-0007": VersionInfo("", "", "1.2.0", "", []), + "CVE-9999-0008": VersionInfo("", "", "", "1.2.0", []), } MOCK_ORGANIZED_PARAMETERS = {