oval

Documentation

Index

• func ExtractVulnerabilities(defs *OVALDefinitions, cfg VendorConfig) []schema.OSVulnerability
• type OVALAdvisory
• type OVALArch
• type OVALCVE
• type OVALCriteria
• type OVALCriterion
• type OVALDate
• type OVALDefinition
• type OVALDefinitions
  • func ParseOVAL(r io.Reader) (*OVALDefinitions, error)
• type OVALEVR
• type OVALMetadata
• type OVALObject
• type OVALObjectRef
• type OVALReference
• type OVALState
• type OVALStateRef
• type OVALTest
• type VendorConfig
• type VendorMode

Functions

func ExtractVulnerabilities

func ExtractVulnerabilities(defs *OVALDefinitions, cfg VendorConfig) []schema.OSVulnerability

ExtractVulnerabilities transforms OVAL definitions into OS vulnerability records.

Types

type OVALAdvisory

type OVALAdvisory struct {
	Severity     string    `xml:"severity,attr"` // Mariner uses attribute
	SeverityElem string    `xml:"severity"`      // Oracle/SLES use element
	Issued       OVALDate  `xml:"issued"`
	CVEs         []OVALCVE `xml:"cve"`
}

OVALAdvisory contains advisory details.

type OVALArch

type OVALArch struct {
	Value     string `xml:",chardata"`
	Operation string `xml:"operation,attr"`
}

OVALArch is an architecture constraint.

type OVALCVE

type OVALCVE struct {
	ID     string `xml:",chardata"`
	Href   string `xml:"href,attr"`
	CVSS3  string `xml:"cvss3,attr"`
	Impact string `xml:"impact,attr"`
}

OVALCVE is a CVE reference in an advisory.

type OVALCriteria

type OVALCriteria struct {
	Operator    string          `xml:"operator,attr"`
	Criterions  []OVALCriterion `xml:"criterion"`
	SubCriteria []OVALCriteria  `xml:"criteria"`
}

OVALCriteria is a criteria tree node.

type OVALCriterion

type OVALCriterion struct {
	TestRef string `xml:"test_ref,attr"`
	Comment string `xml:"comment,attr"`
}

OVALCriterion is a leaf test reference.

type OVALDate

type OVALDate struct {
	Date string `xml:"date,attr"`
}

OVALDate holds a date attribute.

type OVALDefinition

type OVALDefinition struct {
	ID       string        `xml:"id,attr"`
	Class    string        `xml:"class,attr"`
	Metadata OVALMetadata  `xml:"metadata"`
	Criteria *OVALCriteria `xml:"criteria"`
}

OVALDefinition represents a single vulnerability definition.

type OVALDefinitions

type OVALDefinitions struct {
	XMLName     xml.Name         `xml:"oval_definitions"`
	Definitions []OVALDefinition `xml:"definitions>definition"`
	Tests       []OVALTest       `xml:"tests>rpminfo_test"`
	Objects     []OVALObject     `xml:"objects>rpminfo_object"`
	States      []OVALState      `xml:"states>rpminfo_state"`
}

OVALDefinitions is the root OVAL XML element.

func ParseOVAL

func ParseOVAL(r io.Reader) (*OVALDefinitions, error)

ParseOVAL parses OVAL XML from a reader.

type OVALEVR

type OVALEVR struct {
	Value     string `xml:",chardata"`
	Operation string `xml:"operation,attr"`
	Datatype  string `xml:"datatype,attr"`
}

OVALEVR is an epoch:version-release comparison.

type OVALMetadata

type OVALMetadata struct {
	Title       string          `xml:"title"`
	Description string          `xml:"description"`
	Advisory    *OVALAdvisory   `xml:"advisory"`
	References  []OVALReference `xml:"reference"`
}

OVALMetadata contains advisory metadata.

type OVALObject

type OVALObject struct {
	ID   string `xml:"id,attr"`
	Name string `xml:"name"`
}

OVALObject describes a package name.

type OVALObjectRef

type OVALObjectRef struct {
	ObjectRef string `xml:"object_ref,attr"`
}

OVALObjectRef references an object by ID.

type OVALReference

type OVALReference struct {
	RefID  string `xml:"ref_id,attr"`
	RefURL string `xml:"ref_url,attr"`
	Source string `xml:"source,attr"`
}

OVALReference is a reference link.

type OVALState

type OVALState struct {
	ID   string    `xml:"id,attr"`
	EVR  *OVALEVR  `xml:"evr"`
	Arch *OVALArch `xml:"arch"`
}

OVALState describes a version comparison.

type OVALStateRef

type OVALStateRef struct {
	StateRef string `xml:"state_ref,attr"`
}

OVALStateRef references a state by ID.

type OVALTest

type OVALTest struct {
	ID     string        `xml:"id,attr"`
	Object OVALObjectRef `xml:"object"`
	State  *OVALStateRef `xml:"state"`
}

OVALTest references an object and state.

type VendorConfig

type VendorConfig struct {
	Namespace     string     // e.g., "ol:5"
	VersionFormat string     // e.g., "rpm"
	LinkTemplate  string     // e.g., "http://linux.oracle.com/errata/%s.html"
	Mode          VendorMode // how to group vulnerabilities
	ExtractCVSS   bool       // whether to parse cvss3 attributes from CVE elements
	// IncludeModule controls whether FixedIn entries include the Module field (empty string).
	IncludeModule bool
	// IncludeVendorAdvisory controls whether FixedIn entries include VendorAdvisory.
	IncludeVendorAdvisory bool
}

VendorConfig parameterizes OVAL parsing per vendor.

type VendorMode

type VendorMode int

VendorMode controls how OVAL definitions are transformed into vulnerability records.

const (
	// ModeCVE produces one vulnerability per CVE (SLES, Mariner default).
	ModeCVE VendorMode = iota
	// ModeAdvisory produces one vulnerability per advisory with CVEs in Metadata (Oracle).
	ModeAdvisory
)