CheckPanosVersionAffected

Details

ID	`CheckPanosVersionAffected`
Language	python
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Checks if the given PAN-OS version number is affected by the given list of vulnerabilities from the pan-advisories-get-advisories command.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	5.5.0

Inputs

Argument Name	Description
version	The PAN-OS version - ex 9.1.0
advisories	The list of advisories, produced by pan-advisories-get-advisories

Outputs

Path	Description	Type
MatchingSecurityAdvisory.data_type	The type of advisory this is	String
MatchingSecurityAdvisory.data_format	The format of the advisory, such as MITRE	String
MatchingSecurityAdvisory.cve_id	The ID of the CVE described by this advisory	String
MatchingSecurityAdvisory.cve_date_public	The date this CVE was released	String
MatchingSecurityAdvisory.cve_title	The name of this CVE	String
MatchingSecurityAdvisory.affects_vendor_name	The name of the product this affects, such as PAN-OS	String
MatchingSecurityAdvisory.description	Human readable description of Advisory	String
MatchingSecurityAdvisory.affected_version_list	List of PAN-OS affected versions exactly	String
MatchingSecurityAdvisory.cvss_score	CVSS Score of matched vulnerability	Unknown
MatchingSecurityAdvisory.cvss_severity	CVSS Severity of matched vulnerability	Unknown

Source

CheckPanosVersionAffected.py CheckPanosVersionAffected_test.py CheckPanosVersionAffected.yml command_examples.txt

Download History Raw

import json
import os.path

import pytest
import demistomock as demisto


@pytest.fixture()
def advisories_list():
    from CheckPanosVersionAffected import Advisory

    return [
        Advisory(
            data_type="CVE",
            data_format="MITRE",
            cve_id="CVE-2019-17440",
            cve_date_public="2019-12-19T19:35:00.000Z",
            cve_title="PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC)",
            description="Improper restriction of communication",
            cvss_score=10,
            cvss_severity="CRITICAL",
            cvss_vector_string="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            affected_version_list=[
                "PAN-OS 9.0.5",
                "PAN-OS 9.0.4",
                "PAN-OS 9.0.3-h3",
                "PAN-OS 9.0.3-h2",
                "PAN-OS 9.0.3-h1",
                "PAN-OS 9.0.3",
                "PAN-OS 9.0.2-h4",
                "PAN-OS 9.0.2-h3",
                "PAN-OS 9.0.2-h2",
                "PAN-OS 9.0.2-h1",
                "PAN-OS 9.0.2",
                "PAN-OS 9.0.1",
                "PAN-OS 9.0.0",
                "PAN-OS 9.0",
                "PAN-OS 8.1.11",
            ],
        ),
        Advisory(
            data_type="CVE",
            data_format="MITRE",
            cve_id="CVE-2019-17441",
            cve_date_public="2019-12-15T19:35:00.000Z",
            cve_title="This is a fake advisory",
            description="Improper restriction of communication",
            cvss_score=10,
            cvss_severity="CRITICAL",
            cvss_vector_string="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            affected_version_list=["PAN-OS 8.1.12-h3", "PAN-OS 8.1.11", "PAN-OS 8.1.10"],
        ),
    ]


def test_compare_version_with_advisories(advisories_list):
    """
    Given a list of advisories as dataclasses, tests the comparison function
    """
    from CheckPanosVersionAffected import compare_version_with_advisories

    # Match single item
    match = compare_version_with_advisories(panos_version="9.0.5", advisories_list=advisories_list)
    assert len(match) == 1
    assert match[0].cve_id == "CVE-2019-17440"

    # Match multiple advisories
    match = compare_version_with_advisories(panos_version="8.1.11", advisories_list=advisories_list)
    assert len(match) == 2

    # Match no advisories
    match = compare_version_with_advisories(panos_version="7.1.11", advisories_list=advisories_list)
    assert len(match) == 0


def test_main(mocker):
    """
    Tests the complete main() function, including reading advisories in as a list from the context data as it is produced by the
    integration command.
    """
    from CheckPanosVersionAffected import main

    advisories_list = json.load(open(os.path.sep.join(["test_data", "example_advisories_data.json"])))

    mocker.patch.object(demisto, "args", return_value={"advisories": advisories_list, "version": "9.1.3"})
    expected_results = json.load(open(os.path.sep.join(["test_data", "expected_response.json"])))
    mocker.patch.object(demisto, "results")
    main()
    demisto.results.assert_called_with(expected_results)