OSV
OSV (Open Source Vulnerability) is a vulnerability database for open source projects. For each vulnerability, it perform bisects to figure out the exact commit that introduces the bug, as well the exact commit that fixes it. This is cross referenced against upstream repositories to figure out the affected tags and commit ranges.
Vulnerability Management · OpenSourceVulnerabilities
Details
| ID | OSV |
|---|---|
| Provider | |
| Category | Vulnerability Management |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.8.3296088 |
| Supported Modules | Agentix XSIAM |
README
OSV (Open Source Vulnerability) is a vulnerability database for open source projects. For each vulnerability, it perform bisects to figure out the exact commit that introduces the bug, as well the exact commit that fixes it. This is cross referenced against upstream repositories to figure out the affected tags and commit ranges
Configure OSV in Cortex
| Parameter | Required |
|---|---|
| Server URL (e.g. https://api.osv.dev) | True |
| Trust any certificate (not secure) | |
| Use system proxy settings |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
osv-get-vuln-by-id
Return a Vulnerability object for a given OSV ID. All list of vulnerabilities can be found at https://osv.dev/list
Base Command
osv-get-vuln-by-id
Input
| Argument Name | Description | Required |
|---|---|---|
| id_ | The id field is a unique identifier for the vulnerability entry. For example: OSV-2020-111. |
Required |
Context Output
| Path | Type | Description |
|---|---|---|
| OSV.Vulnerability.id | String | The `id` field is a unique identifier for the vulnerability entry |
| OSV.Vulnerability.published | String | The RFC3339 timestamp indicating when this entry was published. |
| OSV.Vulnerability.modified | String | The RFC3339 timestamp indicating when this entry was last modified. |
| OSV.Vulnerability.withdrawn | String | The RFC3339 timestamp indicating when this entry is considered to be withdrawn. |
| OSV.Vulnerability.summary | String | One line human readable summary for the vulnerability. It is recommended to keep this under 120 characters. |
| OSV.Vulnerability.details | String | Any additional human readable details for the vulnerability. |
| OSV.Vulnerability.affected.ranges.repo | String | Applicable if type is GIT. The publicly accessible URL of the repo that can be directly passed to clone commands. |
| OSV.Vulnerability.affected.ranges.events.introduced | String | The earliest version/commit where this vulnerability was introduced in. |
| OSV.Vulnerability.affected.ranges.events.fixed | String | The version/commit that this vulnerability was fixed in. |
| OSV.Vulnerability.affected.ranges.events.limit | String | The limit to apply to the range. |
| OSV.Vulnerability.references.url | String | Reference URL for more details. |
osv-query-affected-by-commit
Query vulnerabilities for a particular project at a given commit
Base Command
osv-query-affected-by-commit
Input
| Argument Name | Description | Required |
|---|---|---|
| commit | The commit hash to query for. E.g 6879efc2c1596d11a6a6ad296f80063b558d5e0f. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| OSV.VulnerabilityList.vulns.id | String | The `id` field is a unique identifier for the vulnerability entry. |
| OSV.VulnerabilityList.vulns.published | String | The RFC3339 timestamp indicating when this entry was published. |
| OSV.VulnerabilityList.vulns.modified | String | The RFC3339 timestamp indicating when this entry was last modified. |
| OSV.VulnerabilityList.vulns.withdrawn | String | The RFC3339 timestamp indicating when this entry is considered to be withdrawn. |
| OSV.VulnerabilityList.vulns.summary | String | One line human readable summary for the vulnerability. It is recommended to keep this under 120 characters. |
| OSV.VulnerabilityList.vulns.details | String | Any additional human readable details for the vulnerability. |
| OSV.VulnerabilityList.vulns.affected.ranges.repo | String | Applicable if type is GIT. The publicly accessible URL of the repo that can be directly passed to clone commands. |
| OSV.VulnerabilityList.vulns.affected.ranges.events.introduced | String | The earliest version/commit where this vulnerability was introduced in. |
| OSV.VulnerabilityList.vulns.affected.ranges.events.fixed | String | The version/commit that this vulnerability was fixed in. |
| OSV.VulnerabilityList.vulns.affected.ranges.events.limit | String | The limit to apply to the range. |
| OSV.VulnerabilityList.vulns.references.url | String | Reference URL for more details. |
osv-query-affected-by-package
Query vulnerabilities for a particular project based on package name and verion
Base Command
osv-query-affected-by-package
Input
| Argument Name | Description | Required |
|---|---|---|
| version | The version string to query for. A fuzzy match is done against upstream versions. Eg. 3.3.0. | Required |
| packageName | The name of the package/project to query for. Eg. django-tinymce. | Required |
| ecosystem | The ecosystem of the package. Eg. PyPI. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| OSV.VulnerabilityList.vulns.id | string | The `id` field is a unique identifier for the vulnerability entry. |
| OSV.VulnerabilityList.vulns.published | string | The RFC3339 timestamp indicating when this entry was published. |
| OSV.VulnerabilityList.vulns.modified | string | The RFC3339 timestamp indicating when this entry was last modified. |
| OSV.VulnerabilityList.vulns.withdrawn | string | The RFC3339 timestamp indicating when this entry is considered to be withdrawn. |
| OSV.VulnerabilityList.vulns.summary | string | One line human readable summary for the vulnerability. It is recommended to keep this under 120 characters. |
| OSV.VulnerabilityList.vulns.details | string | Any additional human readable details for the vulnerability. |
| OSV.VulnerabilityList.vulns.affected.ranges.repo | string | Applicable if type is GIT. The publicly accessible URL of the repo that can be directly passed to clone commands. |
| OSV.VulnerabilityList.vulns.affected.ranges.events.introduced | string | The earliest version/commit where this vulnerability was introduced in. |
| OSV.VulnerabilityList.vulns.affected.ranges.events.fixed | string | The version/commit that this vulnerability was fixed in. |
| OSV.VulnerabilityList.vulns.affected.ranges.events.limit | string | The limit to apply to the range. |
| OSV.VulnerabilityList.vulns.references.url | string | Reference URL for more details. |
Configuration parameters
url— Server URL (e.g. https://api.osv.dev) (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (3)
-
osv-get-vuln-by-idReturn a `Vulnerability` object for a given OSV ID. All list of vulnerabilities can be found at https://osv.dev/list
-
osv-query-affected-by-commitQuery vulnerabilities for a particular project at a given commit.
-
osv-query-affected-by-packageQuery vulnerabilities for a particular project based on package name and verion.
import demistomock as demisto # noqa: F401 import urllib3 from CommonServerPython import * # noqa: F401 class Client(BaseClient): def __init__(self, server_url, verify, proxy, headers, auth): super().__init__(base_url=server_url, verify=verify, proxy=proxy, headers=headers, auth=auth) def osv_get_vuln_by_id_request(self, id_): headers = self._headers response = self._http_request("get", f"v1new/vulns/{id_}", headers=headers) return response def osv_query_affected_by_commit_request(self, v1query_commit): data = assign_params(commit=v1query_commit) headers = self._headers response = self._http_request("post", "v1new/query", json_data=data, headers=headers) return response def osv_query_affected_by_package_request(self, v1query_version, v1query_package, v1query_ecosystem): data = assign_params(version=v1query_version, package={"name": v1query_package, "ecosystem": v1query_ecosystem}) headers = self._headers response = self._http_request("post", "v1new/query", json_data=data, headers=headers) return response def osv_get_vuln_by_id_command(client: Client, args: Dict[str, Any]) -> CommandResults: id_ = str(args.get("id_", "")) response = client.osv_get_vuln_by_id_request(id_) command_results = CommandResults( outputs_prefix="OSV.Vulnerability", outputs_key_field="", outputs=response, raw_response=response ) return command_results def osv_query_affected_by_commit_command(client: Client, args: Dict[str, Any]) -> CommandResults: command_results = CommandResults() v1query_commit = str(args.get("commit", "")) response = client.osv_query_affected_by_commit_request(v1query_commit) if response: command_results = CommandResults( outputs_prefix="OSV.VulnerabilityList", outputs_key_field="", outputs=response["vulns"], raw_response=response ) else: return_error("Please check if the value provided is correct") return command_results def osv_query_affected_by_package_command(client: Client, args: Dict[str, Any]) -> CommandResults: command_results = CommandResults() v1query_version = str(args.get("version", "")) v1query_package = str(args.get("packageName", "")) v1query_ecosystem = str(args.get("ecosystem", "")) response = client.osv_query_affected_by_package_request(v1query_version, v1query_package, v1query_ecosystem) if response: command_results = CommandResults( outputs_prefix="OSV.VulnerabilityList", outputs_key_field="", outputs=response["vulns"], raw_response=response ) else: return_error("Please check if the value provided is correct") return command_results def test_module(client: Client) -> None: try: client.osv_get_vuln_by_id_request("OSV-2020-111") except Exception as e: if "Bug not found" in str(e): return_error("Please check if the vulnerability OSV-2020-111 still exists") else: raise e return_results("ok") def main() -> None: params: Dict[str, Any] = demisto.params() args: Dict[str, Any] = demisto.args() url = params.get("url") verify_certificate: bool = not params.get("insecure", False) proxy = params.get("proxy", False) headers: Dict[str, Any] = {} command = demisto.command() demisto.debug(f"Command being called is {command}") try: urllib3.disable_warnings() client: Client = Client(urljoin(url, ""), verify_certificate, proxy, headers=headers, auth=None) commands = { "osv-get-vuln-by-id": osv_get_vuln_by_id_command, "osv-query-affected-by-commit": osv_query_affected_by_commit_command, "osv-query-affected-by-package": osv_query_affected_by_package_command, } if command == "test-module": test_module(client) elif command in commands: return_results(commands[command](client, args)) else: raise NotImplementedError(f"{command} command is not implemented.") except Exception as e: return_error(str(e)) if __name__ in ["__main__", "builtin", "builtins"]: main()