Package: cvrf2csaf
CVRF-CSAF-ConverterIntroductionGetting startedHow to use CVRF-CSAF-converterUsage as CLI toolConfigSpecificationsDeveloping CVRF-CSAF-converterDeveloper Guide, Architecture and Technical DesignSecurity ConsiderationsContributingProjectIntroductionCVRF-CSAF-converter is a Python tool for convertingCSAF CVRF 1.2 documentsinCSAF 2.0 documents. It fulfills the conformance targetCVRF CSAF converter.Note: The project is currently still under development. Not all features have been implemented and therefore the conformance goal is not yet fulfilled.Getting startedEnsure that you have installedpython3(version >= 3.6),python3-pipandpython3-venv.Assume your current directory is also avaliable at the environment variable$ROOT_DIR.Check out the repository and navigate to the working directory.gitclonehttps://github.com/csaf-tools/CVRF-CSAF-Converter.gitcdCVRF-CSAF-ConverterAfterwards, create a virtual environment and install the package there:python3-mvenvvenv.venv/bin/activatepipinstall.Hint: If you would like to get the debugger running, try to install the code as follows:pip install -e .How to use CVRF-CSAF-converterUsage as CLI toolTo convert the CVRF CSAF 1.2 document$ROOT_DIR/CVRF-CSAF-Converter/examples/1.2/cvrf_example_a.xmluse the following command:cvrf2csaf--input-file$ROOT_DIR/CVRF-CSAF-Converter/examples/1.2/cvrf_example_a.xmlThe default output directory is./, it can be set using--output-dir.The output filename is derived from the CSAF field/document/tracking/id.If there is an ERROR during conversion, the output file will not be written unless--forceoption is used.The rest of the options can be shown with:cvrf2csaf-hConfigTheconfig fileis installed inside the Python package.
For the installation usingvenv, the config file is located in$PATH_TO_THE_VENV/lib/python3.X/site-packages/cvrf2csaf/config/config.yaml.
When installing the PyPI package with pip (--user), the config file is located in$HOME/.local/lib/python3.X/site-packages/cvrf2csaf/config/config.yamlConverter options can be changed there, or overridden by command line arguments/options.SpecificationsWe follow the official OASIS specifications in order to provide as much acceptance on the user base as possible.Specification CVRF 1.2xsd commonxsd cvrfxsd prodxsd vulnSpecification CSAF 2.0JSON specDeveloping CVRF-CSAF-converterDeveloper Guide, Architecture and Technical DesignThe converter uses lxml.objectify to parse the whole input document.Parsing and conversion of the followingCSAF CVRF 1.2XML elements are handled by separate section handlers. These section handlers process the elements recursively (converting also all their sub-elements). These elements are the direct children of the root XML element (<cvrfdoc>).DocumentTitle, DocumentType, DocumentDistribution, AggregateSeverity ->DocumentLeafElementshandlerDocumentPublisher ->DocumentPublisherhandlerDocumentTracking ->DocumentTrackinghandlerDocumentNotes ->NoteshandlerDocumentReferences ->ReferenceshandlerAcknowledgments ->AcknowledgmentshandlerProductTree ->ProductTreehandlerVulnerability ->VulnerabilityhandlerVulnerabilityhandler is reusingAcknowledgments,ReferencesandNoteshandlers for its child elements.Each of these section handlers is implemented by own class inheriting fromSectionHandlerclass.
This base class contains_process_mandatory_elementsand_process_optional_elementsmethods
which are parsing and converting mandatory/optional elements/attributes. Each subclass must implement these methods.SectionHandlerclass holdserror_occurredclass variable. This variable is overwritten by any children class in case
some error resulting in invalid output json happened. Depending on--forcecommandline parameter, the program
either quits with error log message without producing output or produce invalid output and warning log message.Complete conversion together with input and output validation against schemata is handled by theDocumentHandlerclass.Security ConsiderationsThese are the TOP OWASP categories of vulnerabilities which potentially affect the CVRF-CSAF-Converter.
We are omitting those which do not apply (most of them), since it's a plain command-line tool (e.g. authentication failures)A03:2021 – InjectionThe XML input for the converter is strictly validated forCSAF CVRF 1.2. The converter rejects invalid inputs.However, there is a known issue for inserting HTML with code/script, which could be executed by a CSAF consumer:Encode HTML in JSON outputA06:2021 - Vulnerable and Outdated ComponentsACodeQL actionis set in this project to spot vulnerabilities in 3rd party libraries.
Especially thelxmllibrary can be susceptible.A4:2017 - XML External Entities (XXE)XXE vulnerability present in releases <1.0.0rc2 was fixed inthis commitCVE report:https://nvd.nist.gov/vuln/detail/CVE-2022-27193ContributingPlease refer toCONTRIBUTING.mdfor details about how to contribute to the development ofCVRF-CSAF-converter.ProjectCVRF-CSAF-Converter is a project between Deutsche Telekom Security GmbH and the Federal Office for Information Security. It aims to provide a CVRF 1.x to CSAF 2.0 converter.Realization is taking place 100% Open Source. The final delivery will be in Q1/2022.