Skip to content

Commit 3c8e8f1

Browse files
TG1999TG1999
authored
Merge branch 'main' into review_v2_pipelines
2 parents ff65b22 + 65d7a58 commit 3c8e8f1

24 files changed

Lines changed: 761 additions & 316 deletions

‎vulnerabilities/migrations/0115_impactedpackageaffecting_and_more.py‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# Generated by Django 5.2.11 on 2026-02-19 11:12
2+
3+
import django.db.models.deletion
4+
from django.db import migrations, models
5+
6+
7+
class Migration(migrations.Migration):
8+
9+
dependencies = [
10+
("vulnerabilities", "0114_advisoryv2_related_advisory_severities"),
11+
]
12+
13+
operations = [
14+
migrations.RemoveField(
15+
model_name="impactedpackage",
16+
name="affecting_packages",
17+
),
18+
migrations.RemoveField(
19+
model_name="impactedpackage",
20+
name="fixed_by_packages",
21+
),
22+
migrations.AlterField(
23+
model_name="advisoryv2",
24+
name="date_collected",
25+
field=models.DateTimeField(
26+
auto_now_add=True,
27+
db_index=True,
28+
help_text="UTC Date on which the advisory was collected",
29+
),
30+
),
31+
migrations.CreateModel(
32+
name="ImpactedPackageAffecting",
33+
fields=[
34+
(
35+
"id",
36+
models.AutoField(
37+
auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
38+
),
39+
),
40+
("created_at", models.DateTimeField(auto_now_add=True, db_index=True)),
41+
(
42+
"impacted_package",
43+
models.ForeignKey(
44+
on_delete=django.db.models.deletion.CASCADE,
45+
to="vulnerabilities.impactedpackage",
46+
),
47+
),
48+
(
49+
"package",
50+
models.ForeignKey(
51+
on_delete=django.db.models.deletion.CASCADE, to="vulnerabilities.packagev2"
52+
),
53+
),
54+
],
55+
options={
56+
"unique_together": {("impacted_package", "package")},
57+
},
58+
),
59+
migrations.AddField(
60+
model_name="impactedpackage",
61+
name="affecting_packages",
62+
field=models.ManyToManyField(
63+
help_text="Packages vulnerable to this impact.",
64+
related_name="affected_in_impacts",
65+
through="vulnerabilities.ImpactedPackageAffecting",
66+
to="vulnerabilities.packagev2",
67+
),
68+
),
69+
migrations.CreateModel(
70+
name="ImpactedPackageFixedBy",
71+
fields=[
72+
(
73+
"id",
74+
models.AutoField(
75+
auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
76+
),
77+
),
78+
("created_at", models.DateTimeField(auto_now_add=True, db_index=True)),
79+
(
80+
"impacted_package",
81+
models.ForeignKey(
82+
on_delete=django.db.models.deletion.CASCADE,
83+
to="vulnerabilities.impactedpackage",
84+
),
85+
),
86+
(
87+
"package",
88+
models.ForeignKey(
89+
on_delete=django.db.models.deletion.CASCADE, to="vulnerabilities.packagev2"
90+
),
91+
),
92+
],
93+
options={
94+
"unique_together": {("impacted_package", "package")},
95+
},
96+
),
97+
migrations.AddField(
98+
model_name="impactedpackage",
99+
name="fixed_by_packages",
100+
field=models.ManyToManyField(
101+
help_text="Packages fixing the vulnerable packages in this impact.",
102+
related_name="fixed_in_impacts",
103+
through="vulnerabilities.ImpactedPackageFixedBy",
104+
to="vulnerabilities.packagev2",
105+
),
106+
),
107+
]

‎vulnerabilities/models.py‎

Lines changed: 49 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2961,9 +2961,15 @@ class AdvisoryV2(models.Model):
29612961
)
29622962

29632963
date_published = models.DateTimeField(
2964-
blank=True, null=True, help_text="UTC Date of publication of the advisory"
2964+
blank=True,
2965+
null=True,
2966+
help_text="UTC Date of publication of the advisory",
2967+
)
2968+
date_collected = models.DateTimeField(
2969+
auto_now_add=True,
2970+
db_index=True,
2971+
help_text="UTC Date on which the advisory was collected",
29652972
)
2966-
date_collected = models.DateTimeField(help_text="UTC Date on which the advisory was collected")
29672973

29682974
original_advisory_text = models.TextField(
29692975
blank=True,
@@ -3137,13 +3143,15 @@ class ImpactedPackage(models.Model):
31373143
affecting_packages = models.ManyToManyField(
31383144
"PackageV2",
31393145
related_name="affected_in_impacts",
3146+
through="ImpactedPackageAffecting",
31403147
help_text="Packages vulnerable to this impact.",
31413148
)
31423149

31433150
fixed_by_packages = models.ManyToManyField(
31443151
"PackageV2",
31453152
related_name="fixed_in_impacts",
3146-
help_text="Packages vulnerable to this impact.",
3153+
through="ImpactedPackageFixedBy",
3154+
help_text="Packages fixing the vulnerable packages in this impact.",
31473155
)
31483156

31493157
introduced_by_package_commit_patches = models.ManyToManyField(
@@ -3491,6 +3499,44 @@ def current_version(self):
34913499
return self.version_class(self.version)
34923500

34933501

3502+
class ImpactedPackageAffecting(models.Model):
3503+
impacted_package = models.ForeignKey(
3504+
ImpactedPackage,
3505+
on_delete=models.CASCADE,
3506+
)
3507+
package = models.ForeignKey(
3508+
PackageV2,
3509+
on_delete=models.CASCADE,
3510+
)
3511+
3512+
created_at = models.DateTimeField(
3513+
auto_now_add=True,
3514+
db_index=True,
3515+
)
3516+
3517+
class Meta:
3518+
unique_together = ("impacted_package", "package")
3519+
3520+
3521+
class ImpactedPackageFixedBy(models.Model):
3522+
impacted_package = models.ForeignKey(
3523+
ImpactedPackage,
3524+
on_delete=models.CASCADE,
3525+
)
3526+
package = models.ForeignKey(
3527+
PackageV2,
3528+
on_delete=models.CASCADE,
3529+
)
3530+
3531+
created_at = models.DateTimeField(
3532+
auto_now_add=True,
3533+
db_index=True,
3534+
)
3535+
3536+
class Meta:
3537+
unique_together = ("impacted_package", "package")
3538+
3539+
34943540
class AdvisoryExploit(models.Model):
34953541
"""
34963542
A vulnerability exploit is code used to

‎vulnerabilities/pipelines/enhance_with_exploitdb.py‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -78,19 +78,16 @@ def add_exploit(self):
7878

7979

8080
def add_vulnerability_exploit(row, logger):
81-
vulnerabilities = set()
82-
8381
aliases = row["codes"].split(";") if row["codes"] else []
8482

8583
if not aliases:
8684
return 0
8785

88-
for raw_alias in aliases:
89-
try:
90-
if alias := Alias.objects.get(alias=raw_alias):
91-
vulnerabilities.add(alias.vulnerability)
92-
except Alias.DoesNotExist:
93-
continue
86+
vulnerabilities = (
87+
Alias.objects.filter(alias__in=aliases, vulnerability__isnull=False)
88+
.values_list("vulnerability_id", flat=True)
89+
.distinct()
90+
)
9491

9592
if not vulnerabilities:
9693
logger(f"No vulnerability found for aliases {aliases}")
@@ -104,7 +101,7 @@ def add_vulnerability_exploit(row, logger):
104101
add_exploit_references(row["codes"], row["source_url"], row["file"], vulnerability, logger)
105102
try:
106103
Exploit.objects.update_or_create(
107-
vulnerability=vulnerability,
104+
vulnerability_id=vulnerability,
108105
data_source="Exploit-DB",
109106
defaults={
110107
"date_added": date_added,
@@ -125,7 +122,7 @@ def add_vulnerability_exploit(row, logger):
125122
return 1
126123

127124

128-
def add_exploit_references(ref_id, direct_url, path, vul, logger):
125+
def add_exploit_references(ref_id, direct_url, path, vul_id, logger):
129126
url_map = {
130127
"file_url": f"https://gitlab.com/exploit-database/exploitdb/-/blob/main/{path}",
131128
"direct_url": direct_url,
@@ -144,7 +141,7 @@ def add_exploit_references(ref_id, direct_url, path, vul, logger):
144141

145142
if created:
146143
VulnerabilityRelatedReference.objects.get_or_create(
147-
vulnerability=vul,
144+
vulnerability_id=vul_id,
148145
reference=ref,
149146
)
150147

‎vulnerabilities/pipelines/enhance_with_kev.py‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -71,26 +71,29 @@ def add_vulnerability_exploit(kev_vul, logger):
7171
if not cve_id:
7272
return 0
7373

74-
vulnerability = None
75-
try:
76-
if alias := Alias.objects.get(alias=cve_id):
77-
vulnerability = alias.vulnerability
78-
except Alias.DoesNotExist:
74+
vulnerabilities = (
75+
Alias.objects.filter(alias=cve_id, vulnerability__isnull=False)
76+
.values_list("vulnerability", flat=True)
77+
.distinct()
78+
)
79+
80+
if not vulnerabilities:
7981
logger(f"No vulnerability found for aliases {cve_id}")
8082
return 0
8183

82-
Exploit.objects.update_or_create(
83-
vulnerability=vulnerability,
84-
data_source="KEV",
85-
defaults={
86-
"description": kev_vul["shortDescription"],
87-
"date_added": kev_vul["dateAdded"],
88-
"required_action": kev_vul["requiredAction"],
89-
"due_date": kev_vul["dueDate"],
90-
"notes": kev_vul["notes"],
91-
"known_ransomware_campaign_use": True
92-
if kev_vul["knownRansomwareCampaignUse"] == "Known"
93-
else False,
94-
},
95-
)
84+
for vulnerability in vulnerabilities:
85+
Exploit.objects.update_or_create(
86+
vulnerability_id=vulnerability,
87+
data_source="KEV",
88+
defaults={
89+
"description": kev_vul["shortDescription"],
90+
"date_added": kev_vul["dateAdded"],
91+
"required_action": kev_vul["requiredAction"],
92+
"due_date": kev_vul["dueDate"],
93+
"notes": kev_vul["notes"],
94+
"known_ransomware_campaign_use": True
95+
if kev_vul["knownRansomwareCampaignUse"] == "Known"
96+
else False,
97+
},
98+
)
9699
return 1

‎vulnerabilities/pipelines/enhance_with_metasploit.py‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,6 @@ def add_vulnerability_exploits(self):
6666

6767

6868
def add_vulnerability_exploit(record, logger):
69-
vulnerabilities = set()
7069
references = record.get("references", [])
7170

7271
interesting_references = [
@@ -76,12 +75,11 @@ def add_vulnerability_exploit(record, logger):
7675
if not interesting_references:
7776
return 0
7877

79-
for ref in interesting_references:
80-
try:
81-
if alias := Alias.objects.get(alias=ref):
82-
vulnerabilities.add(alias.vulnerability)
83-
except Alias.DoesNotExist:
84-
continue
78+
vulnerabilities = (
79+
Alias.objects.filter(alias__in=interesting_references, vulnerability__isnull=False)
80+
.values_list("vulnerability", flat=True)
81+
.distinct()
82+
)
8583

8684
if not vulnerabilities:
8785
logger(f"No vulnerability found for aliases {interesting_references}")
@@ -107,7 +105,7 @@ def add_vulnerability_exploit(record, logger):
107105

108106
for vulnerability in vulnerabilities:
109107
Exploit.objects.update_or_create(
110-
vulnerability=vulnerability,
108+
vulnerability_id=vulnerability,
111109
data_source="Metasploit",
112110
defaults={
113111
"description": description,

0 commit comments

Comments
 (0)