Repository navigation
Add Apache Log4j security advisories importer - #2213
Open
xovishnukosuri wants to merge 2 commits into
Open
xovishnukosuri wants to merge 2 commits into
xovishnukosuri wants to merge 2 commits into
Conversation
Implements a V2 pipeline importer for Liferay Portal and DXP security advisories published at liferay.dev. Collects data from the Atom RSS feed, then fetches each individual advisory page to extract CVE ID, CVSS score and vector, affected and fixed version lists, and publication date. Registers LiferayImporterPipeline in the importers registry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reads the CycloneDX VDR XML file at https://logging.apache.org/cyclonedx/vdr.xml, which is the authoritative machine-readable source for Log4j security advisories. Each <vulnerability> element contains a CVE ID, CVSS ratings (v3/v4), CWE IDs, description, published date, and VERS-format version ranges per affected artifact (currently log4j-core maven coordinates). VERS ranges are parsed directly via univers VersionRange.from_string; PURLs come from the <ref> element verbatim. Adds ApacheLog4jImporterPipeline registered in IMPORTERS_REGISTRY. Adds 20 unit tests covering all parsing helpers and mocked HTTP calls. Signed-off-by: Vishnu Kosuri <xovishnukosuri@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #586
What this does
Adds a V2 pipeline importer (
ApacheLog4jImporterPipeline) for Apache Log4j security advisories from the authoritative CycloneDX Vulnerability Disclosure Report (VDR) at https://logging.apache.org/cyclonedx/vdr.xml.This was pointed out in the issue comments: the VDR file is the machine-readable source maintained by the Apache Logging team. It covers all Log4j subprojects (log4j-core, log4cxx, etc.) and is updated as new CVEs are disclosed.
How it works
http://cyclonedx.org/schema/bom/1.6)<vulnerability>element for: CVE ID, description, published date, CVSS ratings (v3/v3.1/v4), CWE IDs, VERS-format version ranges, and referencesvers:maven/>=2.0-beta9|<2.15.0) are parsed directly viaunivers.VersionRange.from_string<ref>element verbatim (e.g.pkg:maven/org.apache.logging.log4j/log4j-core?type=jar)AffectedPackageV2AdvisoryDataV2objects with CVE alias, summary, CVSS severity, affected version ranges, weaknesses, and referencesData source notes
Tests
Added
test_apache_log4j_importer_v2.pywith 20 tests covering:parse_date(valid, empty, invalid)parse_weaknesses(multiple CWEs, none, non-numeric ignored)parse_severities(CVSSv3, CVSSv4, unknown method skipped, no ratings)parse_affected_packages(single range, multiple ranges, no affects)parse_references(NVD only, with issue tracker)parse_advisory(full CVE-2021-44228, no ID returns None)collect_advisoriesandadvisories_count(mocked HTTP)All 20 tests pass. Pipeline ID uniqueness test also passes.
Checklist
IMPORTERS_REGISTRYinvulnerabilities/importers/__init__.py