allen/Tips-Tricks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update PatchReportExtractor.py

Browse Source
This commit is contained in:
allen
2026-02-05 10:25:51 -08:00
parent f4127fb3f1
commit 9adb12991c
1 changed files with 60 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
PatchReportExtractor.py
View File

@@ -186,61 +186,84 @@ class PatchReportParser:
# Match vulnerabilities to this action based on:
# 1. KB number in action matches KB in vulnerability
# 2. Software name in action matches software in vulnerability plugin name
# 3. CVEs mentioned in patch report
# 2. Specific package name for RHEL (e.g., "java-1.8.0-openjdk", "firefox")
# 3. Software name and version for general software
# 4. CVEs mentioned in patch report
matched_vulns = []
action_text_lower = action.action.lower()
software_name_lower = action.software.lower()
for vuln in host_vulns:
plugin_name = vuln['plugin_name'].lower()
action_text = action.action.lower()
software_name = action.software.lower()
# Match KB patches
if 'kb' in action_text:
kb_match = re.search(r'kb(\d+)', action_text)
# PRIORITY 1: Match KB patches by KB number
if 'kb' in action_text_lower:
kb_match = re.search(r'kb(\d+)', action_text_lower)
if kb_match:
kb_num = kb_match.group(1)
if f'kb{kb_num}' in plugin_name or kb_num in plugin_name:
if f'kb{kb_num}' in plugin_name or f'kb {kb_num}' in plugin_name:
matched_vulns.append(vuln)
continue
# Match software name
if software_name and software_name in plugin_name:
# PRIORITY 2: Match RHEL packages by specific package name
# Extract package name from action like "Update the RHEL firefox package..."
if 'rhel' in action_text_lower or 'rhsa' in action_text_lower:
# Extract package name from patterns like:
# "Update the RHEL firefox package based on..."
# "Update the RHEL java-1.8.0-openjdk package..."
package_match = re.search(r'rhel\s+([a-z0-9\-._]+)\s+package', action_text_lower)
if package_match:
package_name = package_match.group(1)
# Match if the package name appears in the vulnerability plugin name
if package_name in plugin_name:
matched_vulns.append(vuln)
continue
# Also try to extract RHSA number for exact matching
rhsa_match = re.search(r'rhsa[-:](\d{4}:\d+)', action_text_lower)
if rhsa_match:
rhsa_num = rhsa_match.group(1)
if rhsa_num in plugin_name or rhsa_num.replace(':', '-') in plugin_name:
matched_vulns.append(vuln)
continue
# If no specific package found, skip broad RHEL matching
# This prevents matching all RHEL vulns to every RHEL action
continue
# PRIORITY 3: Match by specific software name with version validation
if software_name_lower and software_name_lower in plugin_name:
# Further validate by checking version if available
if action.version_needed:
# If version is mentioned, check if this vuln relates to older versions
if '<' in plugin_name or 'unsupported' in plugin_name or 'outdated' in plugin_name:
if '<' in plugin_name or '<=' in plugin_name or 'unsupported' in plugin_name or 'outdated' in plugin_name:
matched_vulns.append(vuln)
continue
else:
# No version requirement, but software name matches
matched_vulns.append(vuln)
continue
continue
# Match common software patterns
software_keywords = {
'7-zip': ['7-zip', '7zip'],
'apache': ['apache'],
'log4j': ['log4j'],
'openssh': ['openssh', 'ssh'],
'dell': ['dell'],
'microsoft': ['microsoft', 'windows', r'ms\d{2}-'],
'adobe': ['adobe'],
'air': ['adobe air', 'air'],
'curl': ['curl'],
'edge': ['edge', 'chromium'],
'oracle': ['oracle'],
'java': ['java', 'openjdk', 'jre', 'jdk'],
'rhel': ['rhel', 'red hat'],
'networkmanager': ['networkmanager'],
'bcc': ['bcc'],
}
for key, patterns in software_keywords.items():
if key in software_name or key in action_text:
for pattern in patterns:
if re.search(pattern, plugin_name, re.IGNORECASE):
matched_vulns.append(vuln)
break
# PRIORITY 4: Match common software patterns (only for non-RHEL)
# This should be specific, not catch-all
if 'rhel' not in action_text_lower and 'rhsa' not in action_text_lower:
software_keywords = {
'7-zip': ['7-zip', '7zip'],
'adobe air': ['adobe air', 'adobe.*air'],
'curl': [r'\bcurl\b'],
'edge': ['microsoft edge', 'edge.*chromium'],
'log4j': ['log4j'],
'java': [r'java se\b', r'oracle java\b', r'openjdk\b'],
}
for key, patterns in software_keywords.items():
if key in software_name_lower or key in action_text_lower:
for pattern in patterns:
if re.search(pattern, plugin_name, re.IGNORECASE):
matched_vulns.append(vuln)
break
# Calculate severity counts from matched vulnerabilities
critical = sum(1 for v in matched_vulns if v['severity'] == 4)