vulsのjsonを、pythonで処理する

概要

vulsが出力するjsonについて、pythonに取り込む。

やってみる

対話的に。

対話コンソール

>>> import json
>>> jsonData = json.load(open('finename.json','r'))
>>> len(jsonData["KnownCves"])
12
>>> len(jsonData["UnknownCves"])
5
>>>
>>> jsonData.keys()
[u'Container', u'IgnoredCves', u'Family', u'ScannedAt', u'KnownCves', u'Platform', u'Release', u'Optional', u'ServerName', u'UnknownCves']
>>>
>>> hoge = jsonData["KnownCves"][0]["CveDetail"]["Nvd"]
>>> for x in hoge.keys():
...   print "%s: %s" % (x ,hoge[x])
...
CweID: CWE-20
PublishedDate: 2016-09-28T06:59:00.157-04:00
LastModifiedDate: 2016-11-28T15:04:33.89-05:00
AccessComplexity: LOW
Summary: buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
AvailabilityImpact: COMPLETE
Authentication: NONE
Score: 7.8
References: [{u'Source': u'CONFIRM', u'Link': u'http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html'}, {u'Source': u'CONFIRM', u'Link': u'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html'}, {u'Source': u'CONFIRM', u'Link': u'http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html'}, {u'Source': u'BID', u'Link': u'http://www.securityfocus.com/bid/93188'}, {u'Source': u'CONFIRM', u'Link': u'https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05321107'}, {u'Source': u'CONFIRM', u'Link': u'https://kb.isc.org/article/AA-01419/0'}]
IntegrityImpact: NONE
ConfidentialityImpact: NONE
Cpes: None
AccessVector: NETWORK
>>> jsonData["KnownCves"][0]["Packages"][0]["Name"]
u'bind-libs'
>>>

日常的にjson弄っているpythonプログラマなら、簡単に操作できるんじゃないでしょうか。

• 私は違うので、なんだか無駄なfor文で色々取り出してます。

で、これがどうした？

vulsスキャン後の、results/currentに対して処理をするスクリプトを書く事で、ZabbixやPandoraFMSとの連携が可能かな。

• [NVD][Score]で集計したり、[Packages]で[KnownCves]の数を集計集計したり。
• Python使うかは分からないけど、PandoraFMS用のPluginとして、そのうちなんか出しますわ。

vulsのjson構造

だいたい、以下のような構造。

項目| | | | |型| |
:----|:----|:---- |:---- |:---- |:---- |:----|:----
ROOT| | | | |DICT | |
|Container| | | | |DICT|
| |ContainerID| | | |Values|
| |Name| | | |Values|
|IgnoredCves| | | | | |
|Family| | | | |Value|centos
|ScannedAt| | | | |Value|
|KnownCves| | | | |DICT|
| |DistroAdvisories| | | |Value|
| |CveDetail| | | |DICT|
| | |CveID| | |Value|CVE-2016-7032
| | |Nvd| | |DICT|
| | | |CweID| |Value|CWE-20
| | | |PublishedDate| |Value|2016-09-28T06:59:00.157-04:00
| | | |LastModifiedDate| |Value|2016-11-28T15:04:33.89-05:00
| | | |AccessComplexity| |Value|LOW
| | | |Summary| |Value|buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x …
| | | |AvailabilityImpact| |Value|COMPLETE
| | | |Authentication| |Value|NONE
| | | |Score| |Value|7.8
| | | |References| |DICT|
| | | | |Source|Value|CONFIRM
| | | | |Link|Value|http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
| | | |IntegrityImpact| |Value|NONE
| | | |ConfidentialityImpact| |Value|NONE
| | | |Cpes| |Value|NONE
| | | |AccessVector| |Value|NETWORK
| | |Jvn| | |DICT|
| | | |JvnID| |Value|JVNDB-2016-004926
| | | |Severity| |Value|High
| | | |Vector| |Value|(AV:N/AC:L/Au:N/C:N/I:N/A:C)
| | | |Title| |Value|ISC BIND 9 にサービス運用妨害 (DoS) の脆弱性
| | | |LastModifiedDate| |Value|2016-09-29T16:42:00+09:00
| | | |PublishedDate| |Value|2016-09-29T16:42:00+09:00
| | | |Summary| |Value|ISC BIND 9 には、サービス運用妨害 (DoS) の脆弱性が存在します。
| | | |Score| |Value|7.8
| | | |References| |DICT|
| | | | |Source|Value|JVN
| | | | |Link|Value|http://jvn.jp/cert/JVNVU90255292
| | | |JvnLink| |Value|http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004926.html
| | | |Cpes| |Value|None
| |Packages| | | |DICT|
| | |Name| | |Value|bind-libs
| | |Repository| | |Value|updates
| | |Version| | |Value|9.8.2
| | |NewRelease| | |Value|0.47.rc1.el6_8.3
| | |Release| | |Value|0.47.rc1.el6
| | |NewVersion| | |Value|9.8.2
| |CpeNames| | | | |
|Platform| | | | |DICT|
| |InstanceID| | | |Value|
| |Name| | | |Value|other
|Release| | | | |Value|6.8
|Optional| | | | | |
|ServerName| | | | |Value|vuls-server
|UnknownCves| | | | |DICT|実質、KnownCvesと同じ。
| |DistroAdvisories| | | |Value|
| |CveDetail| | | |DICT|
| | |CveID| | |Value|
| | |Nvd| | |DICT|
| | | |CweID| |Value|
| | | |PublishedDate| |Value|
| | | |LastModifiedDate| |Value|
| | | |AccessComplexity| |Value|
| | | |Summary| |Value|
| | | |AvailabilityImpact| |Value|
| | | |Authentication| |Value|
| | | |Score| |Value|
| | | |References| |Value|
| | | |IntegrityImpact| |Value|
| | | |ConfidentialityImpact| |Value|
| | | |Cpes| |Value|
| | | |AccessVector| |Value|
| | |Jvn| | |DICT|
| | | |JvnID| |Value|
| | | |Severity| |Value|
| | | |Vector| |Value|
| | | |Title| |Value|
| | | |LastModifiedDate| |Value|
| | | |PublishedDate| |Value|
| | | |Summary| |Value|
| | | |Score| |Value|
| | | |References| |Value|
| | | |JvnLink| |Value|
| | | |Cpes| |Value|
| |Packages| | | |DICT|
| | |Name| | |Value|
| | |Repository| | |Value|
| | |Version| | |Value|
| | |NewRelease| | |Value|
| | |Release| | |Value|
| | |NewVersion| | |Value|
| |CpeNames| | | | |