diff --git a/cve-vulner-manager/conf/app.conf b/cve-vulner-manager/conf/app.conf index a55be143d9580e3a00d54f251f49271ac6c4757b..7e68e843b55e9263a683a36bb145cfd540e43dc9 100644 --- a/cve-vulner-manager/conf/app.conf +++ b/cve-vulner-manager/conf/app.conf @@ -285,4 +285,33 @@ git_openlookeng_token = "${GITEE_OPENLOOKENG_TOKEN||xxx}" openlookeng_version = "master" [majun] -token = "${GITEE_MAJUN_TOKEN||xxx}" \ No newline at end of file +token = "${GITEE_MAJUN_TOKEN||xxx}" + +[metrics] +AVN = 0.85 +AVA = 0.62 +AVL = 0.55 +AVP = 0.20 +ACL = 0.77 +ACH = 0.44 +UIN = 0.85 +UIR = 0.62 +CN = 0 +CL = 0.22 +CH = 0.56 +IN = 0 +IL = 0.22 +IH = 0.56 +AN = 0 +AL = 0.22 +AH = 0.56 + +[changedpr] +PRN = 0.85 +PRL = 0.68 +PRH = 0.50 + +[unchangedpr] +PRN = 0.85 +PRL = 0.62 +PRH = 0.27 \ No newline at end of file diff --git a/cve-vulner-manager/conf/product_app.conf b/cve-vulner-manager/conf/product_app.conf index 52dfc21b3370f0949c1286a2bab5b407d34d8145..c3cf125a3de74ca5f0775326cc777f60741517d3 100644 --- a/cve-vulner-manager/conf/product_app.conf +++ b/cve-vulner-manager/conf/product_app.conf @@ -282,4 +282,33 @@ openlookeng_version = "master" token = "${GITEE_MAJUN_TOKEN||xxx}" api_token = "${MAJUN_API_TOKEN||xxx}" app_id = "${MAJUN_APP_ID||xxx}" -secret_key = "${MAJUN_SECRET_KEY||xxx}" \ No newline at end of file +secret_key = "${MAJUN_SECRET_KEY||xxx}" + +[metrics] +AVN = 0.85 +AVA = 0.62 +AVL = 0.55 +AVP = 0.20 +ACL = 0.77 +ACH = 0.44 +UIN = 0.85 +UIR = 0.62 +CN = 0 +CL = 0.22 +CH = 0.56 +IN = 0 +IL = 0.22 +IH = 0.56 +AN = 0 +AL = 0.22 +AH = 0.56 + +[changedpr] +PRN = 0.85 +PRL = 0.68 +PRH = 0.50 + +[unchangedpr] +PRN = 0.85 +PRL = 0.62 +PRH = 0.27 \ No newline at end of file diff --git a/cve-vulner-manager/controllers/file.go b/cve-vulner-manager/controllers/file.go index 5558bfdf255e28a6da516ecba31c39f7c6fab29f..3b977d4ddf0693c96ad0230166408b928d33b81a 100644 --- a/cve-vulner-manager/controllers/file.go +++ b/cve-vulner-manager/controllers/file.go @@ -14,7 +14,6 @@ import ( "time" "cvevulner/common" - "cvevulner/cve-ddd/adapter" "cvevulner/cve-ddd/infrastructure/obsimpl" "cvevulner/models" "cvevulner/taskhandler" @@ -199,8 +198,6 @@ func (f *FileController) TriggerCveData() { // Return the result first, continue processing the data UpdateLimitTriggerSa(nameStr, 1) GenUpdateInfoXmlFile(updateInfoSlice, dir, cves) - // process hot patch - adapter.NewHotPatchAdapter().Process() } // Generate updateinfo xml file diff --git a/cve-vulner-manager/controllers/hook.go b/cve-vulner-manager/controllers/hook.go index fce3df266f4257a9b4002ecb320201c26a58354a..2b7d1ca98cd8b1bab99518058784e7405040b786 100644 --- a/cve-vulner-manager/controllers/hook.go +++ b/cve-vulner-manager/controllers/hook.go @@ -1764,9 +1764,9 @@ func analysisComment(owner, accessToken, path string, cuAccount string, cBody st cols = append(cols, "op_audit_flag") } issueTmp.OpenEulerScore = fv - cols = append(cols, k) // Dominated by openeuler score, update cve level issueTmp.CveLevel = models.OpenEulerScoreProc(fv) + cols = append(cols, k, "cve_level") } case "openeuler_vector": if v != "" && len(v) > 1 { @@ -1863,6 +1863,13 @@ func analysisComment(owner, accessToken, path string, cuAccount string, cBody st issueTmp.IssueStatus = 3 //2. Are the cvsScore and openEuler score equal .If not equal, notify the auditor to review . var na string + + if util.CalculateCVSSV3BaseScore(issueTmp.OpenEulerVector) != issueTmp.OpenEulerScore { + cc := fmt.Sprintf("@%v CVSS评分和矢量值不一致，请修改至矢量值和CVSS评分一致！", issueTmp.Assignee) + taskhandler.AddCommentToIssue(cc, issueTmp.IssueNum, owner, path, accessToken) + return + } + if issueTmp.OpenEulerScore != issueTmp.NVDScore && issueTmp.OpenEulerScore > 0 && issueTmp.NVDScore > 0 && issueTmp.OpAuditFlag == 0 { na = "\n**因OpenEulerScore与NvdScore不一致,分析内容需审核,请等待安全组审核!**" diff --git a/cve-vulner-manager/util/calculator.go b/cve-vulner-manager/util/calculator.go new file mode 100644 index 0000000000000000000000000000000000000000..8a92e8a71256d33f14c7f2c9fbd8ea6b0e184a2f --- /dev/null +++ b/cve-vulner-manager/util/calculator.go @@ -0,0 +1,100 @@ +package util + +import ( + "fmt" + "math" + "strings" + + "github.com/astaxie/beego" +) + +const ( + defaultBaseScore = 0 + vectorLength = 8 + unChangedScope = "SU" + changedScope = "SC" + maxScore = 10 + baseFactor = 1.08 + unchangeImpactFactor = 6.42 + changeImpactFactor1 = 7.52 + changeImpactFactor2 = 0.029 + changeImpactFactor3 = 3.25 + changeImpactFactor4 = 0.02 + changeImpactFactor5 = 15 + iscFactor = 1 + exFactor = 8.22 +) + +// Calculate CVSS v3 basescore based on vector +func CalculateCVSSV3BaseScore(vector string) float64 { + vectors := strings.Split(vector, "/") + if len(vectors) != vectorLength { + return defaultBaseScore + } + + var dealVectors []string + for _, v := range vectors { + dv := strings.ReplaceAll(v, ":", "") + dealVectors = append(dealVectors, dv) + } + + scope := dealVectors[4] + + avScore := beego.AppConfig.DefaultFloat(fmt.Sprintf("metrics::%s", dealVectors[0]), defaultBaseScore) + + acScore := beego.AppConfig.DefaultFloat(fmt.Sprintf("metrics::%s", dealVectors[1]), defaultBaseScore) + + uiScore := beego.AppConfig.DefaultFloat(fmt.Sprintf("metrics::%s", dealVectors[3]), defaultBaseScore) + + cScore := beego.AppConfig.DefaultFloat(fmt.Sprintf("metrics::%s", dealVectors[5]), defaultBaseScore) + + iScore := beego.AppConfig.DefaultFloat(fmt.Sprintf("metrics::%s", dealVectors[6]), defaultBaseScore) + + aScore := beego.AppConfig.DefaultFloat(fmt.Sprintf("metrics::%s", dealVectors[7]), defaultBaseScore) + + iscBase := iscFactor - ((iscFactor - cScore) * (1 - iScore) * (1 - aScore)) + + if scope == unChangedScope { + prScore := beego.AppConfig.DefaultFloat(fmt.Sprintf("unchangedpr::%s", dealVectors[2]), defaultBaseScore) + exploitabilitySubScore := exFactor * avScore * acScore * prScore * uiScore + impactSubScore := unchangeImpactFactor * iscBase + if impactSubScore <= 0 { + return defaultBaseScore + } + + miniNum := Minimum(exploitabilitySubScore+impactSubScore, maxScore) + + baseScore := Roundup(miniNum) + + return baseScore + } else if scope == changedScope { + prScore := beego.AppConfig.DefaultFloat(fmt.Sprintf("changedpr::%s", dealVectors[2]), defaultBaseScore) + exploitabilitySubScore := exFactor * avScore * acScore * prScore * uiScore + + res := math.Pow(iscBase-changeImpactFactor4, float64(changeImpactFactor5)) + imapctSubScore := changeImpactFactor1*(iscBase-changeImpactFactor2) - changeImpactFactor3*res + if imapctSubScore <= 0 { + return defaultBaseScore + } + + miniNum := Minimum(baseFactor*(exploitabilitySubScore+imapctSubScore), maxScore) + + baseScore := Roundup(miniNum) + + return baseScore + } + + return defaultBaseScore +} + +func Roundup(value float64) float64 { + roundedValue := math.Ceil(value*10) / 10 + return roundedValue +} + +func Minimum(a, b float64) float64 { + if a < b { + return a + } + return b +}