Fix debian importer.
Ignores a the invalid version "3.8.20-4."
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
import dataclasses
+import json
from dateutil import parser as dateparser
from typing import Any
from typing import List
@@ -107,6 +108,7 @@ class DebianDataSource(DataSource):
def _parse(self, pkg_name: str, records: Mapping[str, Any]) -> List[Advisory]:
advisories = []
+ ignored_versions = {"3.8.20-4."}
for cve_id, record in records.items():
impacted_purls, resolved_purls = [], []
@@ -114,18 +116,23 @@ class DebianDataSource(DataSource):
continue
# vulnerabilities starting with something else may not be public yet
- # see for instance https://web.archive.org/web/20201215213725/https://security-tracker.debian.org/tracker/TEMP-0000000-A2EB44 # nopep8
- # TODO: this would need to be revisited though to ensure we are not missing out on anything # nopep8
+ # see for instance https://web.archive.org/web/20201215213725/https://security-tracker.debian.org/tracker/TEMP-0000000-A2EB44
+ # TODO: this would need to be revisited though to ensure we are not missing out on anything
for release_name, release_record in record["releases"].items():
if not release_record.get("repositories", {}).get(release_name):
continue
+ version = release_record["repositories"][release_name]
+
+ if version in ignored_versions:
+ continue
+
purl = PackageURL(
name=pkg_name,
type="deb",
namespace="debian",
- version=release_record["repositories"][release_name],
+ version=version,
qualifiers={"distro": release_name},
)
@@ -134,7 +141,10 @@ class DebianDataSource(DataSource):
else:
impacted_purls.append(purl)
- if "fixed_version" in release_record:
+ if (
+ "fixed_version" in release_record
+ and release_record["fixed_version"] not in ignored_versions
+ ):
resolved_purls.append(
PackageURL(
name=pkg_name,
@@ -150,7 +160,6 @@ class DebianDataSource(DataSource):
if debianbug:
bug_url = f"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug={debianbug}"
references.append(Reference(url=bug_url, reference_id=debianbug))
- # print(nearest_patched_package(impacted_purls, resolved_purls))
advisories.append(
Advisory(
vulnerability_id=cve_id,
