vulnrep

type Acknowledgment ¶

type Acknowledgment struct {
	Names         []string
	Organizations []string
	Description   string
	URLs          []string
}

Acknowledgment captures acknowledgments for the document.

type AggregateSeverity ¶

type AggregateSeverity struct {
	Namespace string
	Text      string
}

AggregateSeverity captures the publishers declaration of the severity of the vulnerabilities defined in the report.

type Branch ¶

type Branch struct {
	Name     string
	Type     BranchType
	Branches []Branch
	Leaves   []ProductLeaf
}

Branch associates a particular type/name data pairing with all contained product definitions.

type BranchType ¶

type BranchType int

BranchType captures the type of branch in the product tree.

const (
	BranchVendor BranchType = iota
	BranchProductFamily
	BranchProductName
	BranchProductVersion
	BranchPatchLevel
	BranchServicePack
	BranchArchitecture
	BranchLanguage
	BranchLegacy
	BranchSpecification
	BranchHostName
	BranchRealm
	BranchResource
)

type CVSSScore ¶

type CVSSScore struct {
	Version            string
	BaseScore          float64
	TemporalScore      float64
	EnvironmentalScore float64
	Vector             string
}

ScoreSet captures the XML representation of the CVSS v3 scoring.

type CWE ¶

type CWE struct {
	ID          string
	Description string
}

CWE captures the Common Weakness Enumeration (CWE) associated with a particular vulnerability.

See https://cwe.mitre.org/ for details about these values.

type ConformanceErr ¶

type ConformanceErr struct {
	Issues []string
}

ConformanceErr contains identified compliance errors detected during either loading or saving a document.

func (le *ConformanceErr) Error() string

type DocStatus ¶

type DocStatus int

DocStatus enumerates the possible states of a document.

const (
	DocStatusDraft DocStatus = iota
	DocStatusInterim
	DocStatusFinal
)

type Generator ¶

type Generator struct {
	Engine string
	Date   time.Time
}

Generator captures the optional information about the tool that generated the vulnerability report. Note that this API inserts no value for Generator by default, as this is just an API to be used.

type Group ¶

type Group struct {
	ID          GroupID
	Description string
	Products    []*Product
}

Group identifies a group of products with a group id.

type GroupID ¶

type GroupID string

GroupID is used to identify and reference a set of ProductIDs within a Report.

type Involvement ¶

type Involvement struct {
	Party       PublisherType
	Status      InvolvementStatusType
	Description string
}

Involvement captures the involvement of third parties.

type InvolvementStatusType ¶

type InvolvementStatusType int

InvolvementStatusType captures the ongoing involvement of other parties

const (
	InvolvementStatusOpen InvolvementStatusType = iota
	InvolvementStatusDisputed
	InvolvementStatusInProgress
	InvolvementStatusCompleted
	InvolvementStatusContactAttempted
	InvolvementStatusNotContacted
)

type Meta ¶

type Meta struct {
	Title             string
	Type              string
	Publisher         Publisher
	Tracking          Tracking
	Notes             []Note
	Distribution      string
	AggregateSeverity *AggregateSeverity
	References        []Reference
	Acknowledgments   []Acknowledgment
}

Meta captures the metadata about a vulnerability report.

type Note ¶

type Note struct {
	Title    string
	Audience string
	Type     NoteType
	Text     string
}

Note captures notes about either a vulnerability, or about a vulnerability report

type NoteType ¶

type NoteType int

NoteType enumerates the different types of Notes.

const (
	NoteDescription NoteType = iota
	NoteDetails
	NoteFAQ
	NoteGeneral
	NoteLegalDisclaimer
	NoteOther
	NoteSummary
)

type Product ¶

type Product struct {
	ID   ProductID
	CPE  string
	Name string
}

Product a name and product ID

type ProductID ¶

type ProductID string

ProductID is used to identify and reference a specific *Product with the scope of a Report.

type ProductLeaf ¶

type ProductLeaf struct {
	Name    string
	Type    BranchType
	Product *Product
}

ProductLeaf captures a branch for a specific product.

type ProductTree ¶

type ProductTree struct {
	// Note that a product should be identified either under Branches
	// or under Products, but not both.
	Branches []Branch

	// Branches with just a product under them, and no other branches.
	Leaves []ProductLeaf

	// List of products for which no Branch information is associated.
	Products []*Product

	// Relationships amongst products
	Relationships []Relationship

	// Groups of products
	Groups []*Group
}

ProductTree captures the representation of the product tree

type Publisher ¶

type Publisher struct {
	Type             PublisherType
	VendorID         string
	ContactDetails   string
	IssuingAuthority string
}

Publisher captures information about who published the document

type PublisherType ¶

type PublisherType int

PublisherType enumerates the different publishers of vulnerabilities.

const (
	PubTypeVendor PublisherType = iota
	PubTypeDiscoverer
	PubTypeCoordinator
	PubTypeUser
	PubTypeOther
)

type Reference ¶

type Reference struct {
	Type        ReferenceType
	URL         string
	Description string
}

Reference captures reference information

type ReferenceType ¶

type ReferenceType int

ReferenceType enumerates whether a reference is self or external.

const (
	ReferenceExternal ReferenceType = iota
	ReferenceSelf
)

type Relationship ¶

type Relationship struct {
	Type               RelationshipType
	Reference          *Product
	RelatesToReference *Product
	Products           []*Product
}

Relationship captures relationships between products.

type RelationshipType ¶

type RelationshipType int

RelationshipType defines possible relations between components.

const (
	RelationshipDefaultComponentOf RelationshipType = iota
	RelationshipOptionalComponentOf
	RelationshipExternalComponentOf
	RelationshipInstalledOn
	RelationshipInstalledWith
)

type Remediation ¶

type Remediation struct {
	Type        RemedyType
	Date        time.Time
	Description string
	Entitlement []string
	Products    []*Product
	Groups      []*Group
	URL         string
}

Remediation captures a remediation of a vulnerability

type RemedyType ¶

type RemedyType int

RemedyType enumerates the types of remedies for a vulnerability.

const (
	RemedyWorkaround RemedyType = iota
	RemedyMitigation
	RemedyVendorFix
	RemedyNoneAvailable
	RemedyWillNotFix
)

type Report ¶

type Report struct {
	Meta            Meta
	ProductTree     ProductTree
	Vulnerabilities []Vulnerability
}

Report captures the contents of a vulnerability report

func ParseJSON(r io.Reader) (Report, error)

func ParseXML(r io.Reader) (Report, error)

func (r Report) ToCSAF(w io.Writer) error

func (r Report) ToCVRF(w io.Writer) error

type Revision ¶

type Revision struct {
	Number      RevisionStr
	Date        time.Time
	Description string
}

Revision captures the xml representation of document revisions.

type RevisionStr ¶

type RevisionStr string

RevisionStr represents a revision in the model.

type Score ¶

type Score struct {
	Products   []*Product
	CVSSScores []CVSSScore
}

Scoring captures V2 & V3 scores.

type Status ¶

type Status struct {
	Fixed            []*Product
	FirstAffected    []*Product
	KnownAffected    []*Product
	KnownNotAffected []*Product
	FirstFixed       []*Product
	Recommended      []*Product
	LastAffected     []*Product
}

Status captures the different ways that a vulnerability applies to various products.

type Threat ¶

type Threat struct {
	Type        ThreatType
	Description string
	Date        time.Time
	Products    []*Product
	Groups      []*Group
}

Threat captures the XML representation of the threat types

type ThreatType ¶

type ThreatType int

ThreatType captures the type of threat.

const (
	ThreatImpact ThreatType = iota
	ThreatExploitStatus
	ThreatTargetSet
)

type Tracking ¶

type Tracking struct {
	ID                 string
	Aliases            []string
	Status             DocStatus
	Version            RevisionStr
	Revisions          []Revision
	InitialReleaseDate time.Time
	CurrentReleaseDate time.Time
	Generator          *Generator
}

Tracking captures the tracking data for a CVRF document

type VulnID ¶

type VulnID struct {
	SystemName string
	ID         string
}

VulnID captures the identifier for a vulnerability in a vendor-specific system name.

type Vulnerability ¶

type Vulnerability struct {
	Title           string
	ID              *VulnID
	Notes           []Note
	DiscoveryDate   time.Time
	ReleaseDate     time.Time
	Involvements    []Involvement
	CVE             string
	CWE             *CWE
	Statuses        Status
	Threats         []Threat
	Scores          []Score
	Remediations    []Remediation
	References      []Reference
	Acknowledgments []Acknowledgment
}

Vulnerability captures the vulnerabilities in the report.