Skip to content

Commit 7d1b603

Browse files
prabhuprabhu
authored
Upgrade to cve 5.1 schema (#196)
1 parent 9ae0755 commit 7d1b603

20 files changed

+1942
-296
lines changed

‎INTEGRATION.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ The vulnerability database comprises two SQLite database files.
1414

1515
![Index schema](./docs/vdb-index-schema.png)
1616

17-
- data.vdb6 - Full CVE source database containing normalized data in CVE 5.0 specification formation and purl prefix.
17+
- data.vdb6 - Full CVE source database containing normalized data in CVE 5.1 specification formation and purl prefix.
1818

1919
![Data schema](./docs/vdb-schema.png)
2020

‎README.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ A good vulnerability database must have the following properties:
1010
- Easy to [download](#download-pre-built-database-recommended), [integrate](./INTEGRATION.md), and use
1111
- Performance
1212

13-
Multiple upstream sources are used by vdb to improve accuracy and reduce false negatives. SQLite database containing data in CVE 5.0 schema format is precompiled and distributed as files via ghcr to simplify download. With automatic purl prefix generation even for git repos, searches on the database can be performed with purl, cpe, or even http git url string. Every row in the database uses an open specification such as CVE 5.0 or Package URL (purl and vers) thus preventing the possibility of vendor lock-in.
13+
Multiple upstream sources are used by vdb to improve accuracy and reduce false negatives. SQLite database containing data in CVE 5.1 schema format is precompiled and distributed as files via ghcr to simplify download. With automatic purl prefix generation even for git repos, searches on the database can be performed with purl, cpe, or even http git url string. Every row in the database uses an open specification such as CVE 5.0 or Package URL (purl and vers) thus preventing the possibility of vendor lock-in.
1414

1515
## Vulnerability Data sources
1616

@@ -40,7 +40,7 @@ Multiple upstream sources are used by vdb to improve accuracy and reduce false n
4040
## Installation
4141

4242
```shell
43-
pip install appthreat-vulnerability-db>=6.0.1
43+
pip install appthreat-vulnerability-db>=6.2.0
4444
```
4545

4646
To install vdb with optional dependencies such as `oras` use the `[oras]` or `[all]` dependency group.
@@ -49,10 +49,10 @@ To install vdb with optional dependencies such as `oras` use the `[oras]` or `[a
4949
pip install appthreat-vulnerability-db[all]
5050
```
5151

52-
**NOTE:** VDB v6 is a major rewrite to use SQLite database. Current users of depscan v5 must continue using version 5.6.x
52+
**NOTE:** VDB v6 is a major rewrite to use SQLite database. Current users of depscan v5 must continue using version 5.8.x
5353

5454
```shell
55-
pip install appthreat-vulnerability-db==5.6.7
55+
pip install appthreat-vulnerability-db==5.8.0
5656
```
5757

5858
## Usage
@@ -93,7 +93,7 @@ Use any sqlite browser or cli tools to load and query the two databases.
9393

9494
<img src="./docs/index-vdb6.png" alt="index" width="400">
9595

96-
**data.vdb6** - Contains source data in CVE 5.0 format stored as a jsonb blob.
96+
**data.vdb6** - Contains source data in CVE 5.1 format stored as a jsonb blob.
9797

9898
<img src="./docs/vdb6.png" alt="database" width="400">
9999

‎data/CVE_JSON_5.0_schema.json renamed to ‎data/CVE_Record_Format.json

Lines changed: 62 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
]
4747
}
4848
}
49-
}
49+
},
50+
"additionalProperties": false
5051
},
5152
"cveId": {
5253
"type": "string",
@@ -74,8 +75,7 @@
7475
},
7576
"timestamp": {
7677
"type": "string",
77-
"format": "date-time",
78-
"description": "Date/time format based on RFC3339 and ISO ISO8601, with an optional timezone in the format 'yyyy-MM-ddTHH:mm:ssZZZZ'. If timezone offset is not given, GMT (0000) is assumed.",
78+
"description": "Date/time format based on RFC3339 and ISO ISO8601, with an optional timezone in the format 'yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM'. If timezone offset is not given, GMT (+00:00) is assumed.",
7979
"pattern": "^(((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30)))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})?$"
8080
},
8181
"version": {
@@ -246,7 +246,8 @@
246246
"minLength": 1,
247247
"maxLength": 4096
248248
}
249-
}
249+
},
250+
"additionalProperties": false
250251
}
251252
},
252253
"platforms": {
@@ -284,10 +285,13 @@
284285
},
285286
{
286287
"required": ["version", "status", "versionType"],
287-
"oneOf": [
288-
{"required": ["lessThan"]},
289-
{"required": ["lessThanOrEqual"]}
290-
]
288+
"maxProperties": 3
289+
},
290+
{
291+
"required": ["version", "status", "versionType", "lessThan"]
292+
},
293+
{
294+
"required": ["version", "status", "versionType", "lessThanOrEqual"]
291295
}
292296
],
293297
"properties": {
@@ -330,6 +334,7 @@
330334
"type": "object",
331335
"description": "The start of a single status change during the range.",
332336
"required": ["at", "status"],
337+
"additionalProperties": false,
333338
"properties": {
334339
"at": {
335340
"description": "The version at which a status change occurs.",
@@ -342,7 +347,8 @@
342347
}
343348
}
344349
}
345-
}
350+
},
351+
"additionalProperties": false
346352
}
347353
}
348354
}
@@ -355,9 +361,10 @@
355361
]
356362
},
357363
"dataVersion": {
358-
"description": "The version of the schema being used. Used to support multiple versions of this format.",
364+
"description": "The version of the CVE schema used for validating this record. Used to support multiple versions of this format.",
359365
"type": "string",
360-
"enum": ["5.0"]
366+
"pattern": "^5\\.(0|[1-9][0-9]*)(\\.(0|[1-9][0-9]*))?$",
367+
"default": "5.1.0"
361368
},
362369
"cveMetadataPublished": {
363370
"description": "This is meta data about the CVE ID such as the CVE ID, who requested it, who assigned it, when it was requested, the current state (PUBLISHED, REJECTED, etc.) and so on. These fields are controlled by the CVE Services.",
@@ -477,7 +484,8 @@
477484
"description": "Timestamp to be set by the system of record at time of submission. If dateUpdated is provided to the system of record it will be replaced by the current timestamp at the time of submission."
478485
}
479486
},
480-
"required": ["orgId"]
487+
"required": ["orgId"],
488+
"additionalProperties": false
481489
},
482490
"cnaPublishedContainer": {
483491
"description": "An object containing the vulnerability information provided by a CVE Numbering Authority (CNA) for a published CVE ID. There can only be one CNA container per CVE record since there can only be one assigning CNA. The CNA container must include the required information defined in the CVE Rules, which includes a product, version, problem type, prose description, and a reference.",
@@ -555,6 +563,7 @@
555563
"patternProperties": {
556564
"^x_[^.]*$": {}
557565
},
566+
"$comment": "The character . is restricted in names allowed by patternProperties to work-around naming limitations in some common implementations.",
558567
"additionalProperties": false
559568
},
560569
"cnaRejectedContainer": {
@@ -585,6 +594,7 @@
585594
"patternProperties": {
586595
"^x_[^.]*$": {}
587596
},
597+
"$comment": "The character . is restricted in names allowed by patternProperties to work-around naming limitations in some common implementations.",
588598
"additionalProperties": false
589599
},
590600
"adpContainer": {
@@ -657,6 +667,7 @@
657667
"patternProperties": {
658668
"^x_[^.]*$": {}
659669
},
670+
"$comment": "The character . is restricted in names allowed by patternProperties to work-around naming limitations in some common implementations.",
660671
"additionalProperties": false
661672
},
662673
"affected": {
@@ -715,7 +726,8 @@
715726
"required": [
716727
"type",
717728
"value"
718-
]
729+
],
730+
"additionalProperties": false
719731
}
720732
}
721733
},
@@ -729,7 +741,8 @@
729741
"type": "object",
730742
"description": "A description with lang set to an English language (en, en_US, en_UK, and so on).",
731743
"properties": {"lang": {"$ref": "#/definitions/englishLanguage"}},
732-
"required": ["lang"]
744+
"required": ["lang"],
745+
"$comment": "Cannot use additionalProperties: false here, as this prevents the other properties used by /definitions/description."
733746
},
734747
"descriptions": {
735748
"type": "array",
@@ -780,12 +793,14 @@
780793
"maxLength": 128
781794
},
782795
"references": {"$ref": "#/definitions/references"}
783-
}
796+
},
797+
"additionalProperties": false
784798
},
785799
"minItems": 1,
786800
"uniqueItems": true
787801
}
788-
}
802+
},
803+
"additionalProperties": false
789804
},
790805
"minItems": 1,
791806
"uniqueItems": true
@@ -819,7 +834,8 @@
819834
"description": "Prose description of the impact scenario. At a minimum provide the description given by CAPEC.",
820835
"$ref": "#/definitions/descriptions"
821836
}
822-
}
837+
},
838+
"additionalProperties": false
823839
}
824840
},
825841
"metrics": {
@@ -829,8 +845,11 @@
829845
"uniqueItems": true,
830846
"items": {
831847
"type": "object",
832-
"description": "This is impact type information (e.g. a text description, CVSSv2, CVSSv3, etc.). Must contain: At least one entry, can be text, CVSSv2, CVSSv3, others may be added.",
848+
"description": "This is impact type information (e.g. a text description, CVSSv2, CVSSv3, CVSSV4, etc.). Must contain: At least one entry, can be text, CVSSv2, CVSSv3, others may be added.",
833849
"anyOf": [
850+
{
851+
"required": ["cvssV4_0"]
852+
},
834853
{
835854
"required": ["cvssV3_1"]
836855
},
@@ -871,9 +890,11 @@
871890
"required": [
872891
"lang",
873892
"value"
874-
]
893+
],
894+
"additionalProperties": false
875895
}
876896
},
897+
"cvssV4_0": {"$ref": "imports/cvss/cvss-v4.0.json"},
877898
"cvssV3_1": {"$ref": "imports/cvss/cvss-v3.1.json"},
878899
"cvssV3_0": {"$ref": "imports/cvss/cvss-v3.0.json"},
879900
"cvssV2_0": {"$ref": "imports/cvss/cvss-v2.0.json"},
@@ -893,12 +914,15 @@
893914
},
894915
"content": {
895916
"type": "object",
917+
"$comment": "additionalProperties are allowed here, since this construct supports arbitrary JSON.",
896918
"description": "JSON object not covered by another metrics format.",
897919
"minProperties": 1
898920
}
899-
}
921+
},
922+
"additionalProperties": false
900923
}
901-
}
924+
},
925+
"additionalProperties": false
902926
}
903927
},
904928
"configurations": {
@@ -951,7 +975,7 @@
951975
],
952976
"properties": {
953977
"time": {
954-
"description": "Timestamp representing when the event in the timeline occurred. The timestamp format is based on RFC3339 and ISO ISO8601, with an optional timezone. yyyy-MM-ddTHH:mm:ssZZZZ - if the timezone offset is not given, GMT (0000) is assumed.",
978+
"description": "Timestamp representing when the event in the timeline occurred. The timestamp format is based on RFC3339 and ISO ISO8601, with an optional timezone. yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM - if the timezone offset is not given, GMT (+00:00) is assumed.",
955979
"$ref": "#/definitions/timestamp"
956980
},
957981
"lang": {
@@ -964,7 +988,8 @@
964988
"minLength": 1,
965989
"maxLength": 4096
966990
}
967-
}
991+
},
992+
"additionalProperties": false
968993
}
969994
},
970995
"credits": {
@@ -1006,6 +1031,7 @@
10061031
]
10071032
}
10081033
},
1034+
"additionalProperties": false,
10091035
"required": [
10101036
"lang",
10111037
"value"
@@ -1035,15 +1061,15 @@
10351061
"uniqueItems": true,
10361062
"items": {
10371063
"type": "object",
1038-
"description": "",
1064+
"description": "A taxonomy mapping object identifies the taxonomy by a name and version (eg., ATT&CK v13.1, CVSS 3.1, CWE 4.12) along with a list of relations relevant to this CVE.",
10391065
"required": [
10401066
"taxonomyName",
10411067
"taxonomyRelations"
10421068
],
10431069
"properties": {
10441070
"taxonomyName": {
10451071
"type": "string",
1046-
"description": "The name of the taxonomy.",
1072+
"description": "The name of the taxonomy, eg., ATT&CK, D3FEND, CWE, CVSS",
10471073
"minLength": 1,
10481074
"maxLength": 128
10491075
},
@@ -1055,12 +1081,12 @@
10551081
},
10561082
"taxonomyRelations": {
10571083
"type": "array",
1058-
"description": "",
1084+
"description": "List of relationships to the taxonomy for the vulnerability.",
10591085
"minItems": 1,
10601086
"uniqueItems": true,
10611087
"items": {
10621088
"type": "object",
1063-
"description": "List of relationships to the taxonomy for the vulnerability. Relationships can be between the taxonomy and the CVE or two taxonomy items.",
1089+
"description": "A relationship between the taxonomy and the CVE or two taxonomy items.",
10641090
"required": [
10651091
"taxonomyId",
10661092
"relationshipName",
@@ -1085,17 +1111,20 @@
10851111
"minLength": 1,
10861112
"maxLength": 2048
10871113
}
1088-
}
1114+
},
1115+
"additionalProperties": false
10891116
}
10901117
}
1091-
}
1118+
},
1119+
"additionalProperties": false
10921120
}
10931121
},
10941122
"tagExtension": {
10951123
"type": "string",
10961124
"minLength": 2,
10971125
"maxLength": 128,
1098-
"pattern": "^x_.*$"
1126+
"pattern": "^x_.*$",
1127+
"$comment": "These values are not used as JSON property names, so there is not a need to work-around property naming limitations in some common implementations."
10991128
},
11001129
"cnaTags": {
11011130
"type": "array",
@@ -1134,6 +1163,7 @@
11341163
{
11351164
"title": "Published",
11361165
"description": "When a CNA populates the data associated with a CVE ID as a CVE Record, the state of the CVE Record is Published.",
1166+
"type": "object",
11371167
"properties": {
11381168
"dataType": {
11391169
"$ref": "#/definitions/dataType"
@@ -1171,6 +1201,7 @@
11711201
{
11721202
"title": "Rejected",
11731203
"description": "If the CVE ID and associated CVE Record should no longer be used, the CVE Record is placed in the Rejected state. A Rejected CVE Record remains on the CVE List so that users can know when it is invalid.",
1204+
"type": "object",
11741205
"properties": {
11751206
"dataType": {
11761207
"$ref": "#/definitions/dataType"
@@ -1200,4 +1231,4 @@
12001231
"additionalProperties": false
12011232
}
12021233
]
1203-
}
1234+
}

‎data/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,5 @@ Modify the jsonschema to make it compatible with datamodel-code-generator which
77

88
```shell
99
pip install datamodel-code-generator
10-
datamodel-codegen --input data/CVE_JSON_5.0_schema.json --input-file-type jsonschema --output vdb/lib/cve_model --output-model-type pydantic_v2.BaseModel --target-python-version 3.10 --use-annotated --class-name CVE
10+
datamodel-codegen --input data/CVE_Record_Format.json --input-file-type jsonschema --output vdb/lib/cve_model --output-model-type pydantic_v2.BaseModel --target-python-version 3.10 --use-annotated --class-name CVE
1111
```

0 commit comments

Comments
 (0)