Week 2: Merging Intermediate Reports using cli

imsahil007
Published: 06/17/2021

What did you do this week?
I worked on saving intermediate reports along with some metadata and later merge them. This will improve the triage and tracking of reports from different end-users. The strucutre of these new intermediate reports look like this:
{
    "metadata": {
        "timestamp": "2021-06-17.00-00-30",
        "tag": "backend",
        "scanned_dir": "/home/path/",
        "products_with_cve": 139,
        "products_without_cve": 2,
        "total_files": 49
    },
    "report": [
        {
            "vendor": "gnu",
            "product": "gcc",
            "version": "9.0.1",
            "cve_number": "CVE-2019-15847",
            "severity": "HIGH",
            "score": "7.5",
            "cvss_version": "3",
            "paths": "/home/path/glib.tar.gz,/home/path/gcc.tar.gz",
            "remarks": "NewFound",
            "comments": ""
        },
    ]
}
I have added 3 parameters in cve-bin-tool cli for same:
  • -a INTERMEDIATE_PATH, --append INTERMEDIATE_PATH : This will create intermediate reports on current scans and save them in `INTERMEDIATE_PATH`
  • -t TAG, --tag TAG : This will add a unique tag in intermediate reports so that users can differentiate between mulitple intermediate reports.
  • -m INTERMEDIATE_REPORTS, --merge INTERMEDIATE_REPORTS : This will take a list of comma-separated paths and merge them. Users can use this along with `-f --format` and `-o --output-file` to get output in other formats


  • What is coming up next?
    I am going to work on the documentation and testing of above-added features in the upcoming weeks.
    Possible addition of some filters while using `-m --merge` argument.
    A wepage based utitlity to merge these intermediate reports rather than using `-m --merge`.

    Did you get stuck anywhere?
    No