This repo contains a Python source file for taking a Sysdig image scan result csv file as input, cross checking the combination of CVE and Ubuntu package name against the Ubuntu CVE database. It is assumed that the input csv file format is such that it contains the following columns:

• Feed

• Feed Group

• Fix

• Nvd Data (JSON)

• Package

• Package_Cpe

• Package_Name

• Package_Path

• Package_Type

• Severity

• Url

• Vendor_Data

• Vuln

• CVE (optional)

  This repo contains the sample file Consolidated_Dec-Sheet1.csv which is in this format

In order to run cross_check.py a number of python packages should be imported using pip3:

pip3 install requests
pip3 install beautifulsoup4
pip3 install pandas
pip3 install numpy

If the code is to be executed from within VS Code, it is recommended that a Python virtual environment is created, otherwise Python will complain about not being able to find the source code for the numpy package, do this as follows:

python3 -m venv myenv

Execute the program as follows

python3 cross_check.py -i <path to source csv file> -o <path to output csv file>

The output spreadsheet produced by running the python code will contain the columns from the source csv file plus two new columns:

• CVE2 Essentially a copy of the CVE column

• Ubuntu_CVE_lookup The "Ubuntu_CVE_Lookup" column contains the package name that the CVE relates to according to Ubuntu and its status, one of:

  • "No match in Ubuntu 22.04 CVE database", for example if you lookup CVE-2022-47695 you will see that this only returns information for binutils, hence for libctf-nobfd0 you get a status of . . . "No match in Ubuntu 22.04 CVE database"
  • 'Released' - a fix has been released
  • 'Needed' - the Ubuntu team has identified that a fix is needed, put no patch/fix has been provided yet, this status is typically for newly discovered vulnerabilities
  • 'Deferred' - the package (for the given release) is vulnerable, the problem is understood, but has been deferred for some reason.
  • "Needs triage" - the vulnerability of this package (for the given release) is not known. It needs to be evaluated.
  • "Not vulnerable" - self explanatory

Refer to the file Ubuntu_2204_CVE_cf_Dec-Sheet1.csv as an example output file which has been produced by running cross_check.py against the sample input file Consolidated_Dec-Sheet1.csv.