Skip to content

Commit 87be21f

Browse files
valentijnscholtenvalentijnscholten
authored
anchore grype: parse epss better (#12825)
1 parent 6ac90e1 commit 87be21f

4 files changed

Lines changed: 250 additions & 4 deletions

File tree

‎dojo/templatetags/display_tags.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,10 +185,13 @@ def percentage(fraction, value):
185185

186186
@register.filter
187187
def format_epss(value):
188+
if value is None:
189+
return "N.A."
190+
188191
try:
189192
return f"{value:.2%}"
190193
except (ValueError, TypeError):
191-
return "N.A."
194+
return "error"
192195

193196

194197
def asvs_calc_level(benchmark_score):

‎dojo/tools/anchore_grype/parser.py‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11
import json
2+
import logging
23

34
from cvss import parser as cvss_parser
45
from cvss.cvss3 import CVSS3
56

67
from dojo.models import Finding
78

9+
logger = logging.getLogger(__name__)
10+
811

912
class AnchoreGrypeParser:
1013

@@ -27,7 +30,9 @@ def get_description_for_scan_types(self, scan_type):
2730
)
2831

2932
def get_findings(self, file, test):
33+
logger.debug(f"file: {file}")
3034
data = json.load(file)
35+
logger.debug(f"data: {data}")
3136
dupes = {}
3237
for item in data.get("matches", []):
3338
vulnerability = item["vulnerability"]
@@ -57,6 +62,7 @@ def get_findings(self, file, test):
5762
rel_description = related_vulnerability.get("description")
5863
rel_cvss = related_vulnerability.get("cvss")
5964
rel_epss = related_vulnerability.get("epss")
65+
rel_vuln_id = related_vulnerability.get("id")
6066
vulnerability_ids = self.get_vulnerability_ids(
6167
vuln_id, related_vulnerabilities,
6268
)
@@ -162,10 +168,15 @@ def get_findings(self, file, test):
162168
finding_cvss3 = self.get_cvss(vuln_cvss)
163169
if not finding_cvss3 and rel_cvss:
164170
finding_cvss3 = self.get_cvss(rel_cvss)
165-
171+
# https://github.com/DefectDojo/django-DefectDojo/issues/12819
172+
# the parser seems focues on only parsing the first related vulnerability
173+
# this fixes the mentioned github issue, but a more thorough rewrite might be needed
174+
# if the problem persists / we get more real world sample reports.
166175
finding_epss_score, finding_epss_percentile = self.get_epss_values(vuln_id, vuln_epss)
167176
if finding_epss_score is None and rel_epss:
168-
finding_epss_score, finding_epss_percentile = self.get_epss_values(vuln_id, rel_epss)
177+
finding_epss_score, finding_epss_percentile = self.get_epss_values(rel_vuln_id, rel_epss)
178+
if finding_epss_score is None and rel_vuln_id:
179+
finding_epss_score, finding_epss_percentile = self.get_epss_values(vuln_id, vuln_epss)
169180

170181
dupe_key = finding_title
171182
if dupe_key in dupes:
@@ -211,17 +222,23 @@ def get_cvss(self, cvss):
211222
return None
212223

213224
def get_epss_values(self, vuln_id, epss_list):
225+
if not isinstance(epss_list, list):
226+
logger.debug(f"epss_list is not a list: {epss_list}")
227+
return None, None
228+
214229
if isinstance(epss_list, list):
230+
logger.debug(f"epss_list: {epss_list}")
215231
for epss_data in epss_list:
216232
if epss_data.get("cve") != vuln_id:
217233
continue
218234
try:
219235
epss_score = float(epss_data.get("epss"))
220236
epss_percentile = float(epss_data.get("percentile"))
221237
except (TypeError, ValueError):
222-
pass
238+
logger.debug(f"epss_data is not a float: {epss_data}")
223239
else:
224240
return epss_score, epss_percentile
241+
logger.debug(f"epss not found for vuln_id: {vuln_id} in epss_list: {epss_list}")
225242
return None, None
226243

227244
def get_vulnerability_ids(self, vuln_id, related_vulnerabilities):

‎unittests/scans/anchore_grype/anchore_grype_epss_problem.json‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
{
2+
"matches": [
3+
{
4+
"vulnerability": {
5+
"id": "GHSA-4374-p667-p6c8",
6+
"dataSource": "https://github.com/advisories/GHSA-4374-p667-p6c8",
7+
"namespace": "github:language:go",
8+
"severity": "High",
9+
"urls": [],
10+
"description": "HTTP/2 rapid reset can cause excessive work in net/http",
11+
"cvss": [
12+
{
13+
"type": "Secondary",
14+
"version": "3.1",
15+
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
16+
"metrics": {
17+
"baseScore": 7.5,
18+
"exploitabilityScore": 3.9,
19+
"impactScore": 3.6
20+
},
21+
"vendorMetadata": {}
22+
}
23+
],
24+
"epss": [
25+
{
26+
"cve": "CVE-2023-39325",
27+
"epss": 0.00163,
28+
"percentile": 0.37957,
29+
"date": "2025-07-20"
30+
}
31+
],
32+
"fix": {
33+
"versions": [
34+
"0.17.0"
35+
],
36+
"state": "fixed"
37+
},
38+
"advisories": [],
39+
"risk": 0.12225000000000001
40+
},
41+
"relatedVulnerabilities": [
42+
{
43+
"id": "CVE-2023-39325",
44+
"dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2023-39325",
45+
"namespace": "nvd:cpe",
46+
"severity": "High",
47+
"urls": [
48+
"https://go.dev/cl/534215",
49+
"https://go.dev/cl/534235",
50+
"https://go.dev/issue/63417",
51+
"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ",
52+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/",
53+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/",
54+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/",
55+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/",
56+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/",
57+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/",
58+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/",
59+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
60+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/",
61+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/",
62+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/",
63+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/",
64+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/",
65+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/",
66+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/",
67+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
68+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/",
69+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/",
70+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/",
71+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/",
72+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/",
73+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/",
74+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/",
75+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/",
76+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/",
77+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/",
78+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/",
79+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/",
80+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/",
81+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/",
82+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/",
83+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
84+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/",
85+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/",
86+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/",
87+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/",
88+
"https://pkg.go.dev/vuln/GO-2023-2102",
89+
"https://security.gentoo.org/glsa/202311-09",
90+
"https://security.netapp.com/advisory/ntap-20231110-0008/",
91+
"https://go.dev/cl/534215",
92+
"https://go.dev/cl/534235",
93+
"https://go.dev/issue/63417",
94+
"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ",
95+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/",
96+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/",
97+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/",
98+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/",
99+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/",
100+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/",
101+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/",
102+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
103+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/",
104+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/",
105+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/",
106+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/",
107+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/",
108+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/",
109+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/",
110+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
111+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/",
112+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/",
113+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/",
114+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/",
115+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/",
116+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/",
117+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/",
118+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/",
119+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/",
120+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/",
121+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/",
122+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/",
123+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/",
124+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/",
125+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/",
126+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
127+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/",
128+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/",
129+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/",
130+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/",
131+
"https://pkg.go.dev/vuln/GO-2023-2102",
132+
"https://security.gentoo.org/glsa/202311-09",
133+
"https://security.netapp.com/advisory/ntap-20231110-0008/"
134+
],
135+
"description": "A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.",
136+
"cvss": [
137+
{
138+
"source": "nvd@nist.gov",
139+
"type": "Primary",
140+
"version": "3.1",
141+
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
142+
"metrics": {
143+
"baseScore": 7.5,
144+
"exploitabilityScore": 3.9,
145+
"impactScore": 3.6
146+
},
147+
"vendorMetadata": {}
148+
}
149+
],
150+
"epss": [
151+
{
152+
"cve": "CVE-2023-39325",
153+
"epss": 0.00163,
154+
"percentile": 0.37957,
155+
"date": "2025-07-20"
156+
}
157+
]
158+
}
159+
],
160+
"matchDetails": [
161+
{
162+
"type": "exact-direct-match",
163+
"matcher": "go-module-matcher",
164+
"searchedBy": {
165+
"language": "go",
166+
"namespace": "github:language:go",
167+
"package": {
168+
"name": "golang.org/x/net",
169+
"version": "v0.9.0"
170+
}
171+
},
172+
"found": {
173+
"vulnerabilityID": "GHSA-4374-p667-p6c8",
174+
"versionConstraint": "<0.17.0 (go)"
175+
},
176+
"fix": {
177+
"suggestedVersion": "0.17.0"
178+
}
179+
}
180+
],
181+
"artifact": {
182+
"id": "pkg:golang/golang.org/x/net@v0.9.0?package-id=85c8f93776f11582",
183+
"name": "golang.org/x/net",
184+
"version": "v0.9.0",
185+
"type": "go-module",
186+
"locations": [
187+
{
188+
"path": "/samples/go.mod",
189+
"accessPath": ""
190+
}
191+
],
192+
"language": "go",
193+
"licenses": [],
194+
"cpes": [
195+
"cpe:2.3:a:golang:networking:v0.9.0:*:*:*:*:go:*:*"
196+
],
197+
"purl": "pkg:golang/golang.org/x/net@v0.9.0",
198+
"upstreams": [],
199+
"metadataType": "GolangModMetadata",
200+
"metadata": {}
201+
}
202+
}
203+
]
204+
}

0 commit comments

Comments
 (0)