feat: recommending safe packages

cve_bin_tool/cli.py

@@ -161,6 +161,12 @@ def main(argv=None):
         action="store",
         help="add a unique tag to differentiate between multiple intermediate reports",
     )
+    output_group.add_argument(
+        "--affected-versions",
+        action="count",
+        default=0,
+        help="Lists versions of product affected by a given CVE (to facilitate upgrades)",
+    )
     parser.add_argument("-V", "--version", action="version", version=VERSION)
     parser.add_argument(
         "-u",
@@ -233,6 +239,7 @@ def main(argv=None):
         "tag": "",
         "merge": None,
         "nvd": "json",
+        "affected_versions": 0,
     }
 
     with ErrorHandler(mode=ErrorMode.NoTrace):
@@ -438,6 +445,7 @@ def main(argv=None):
             # Creates a Object for OutputEngine
             output = OutputEngine(
                 all_cve_data=cve_scanner.all_cve_data,
+                all_cve_version_info=cve_scanner.all_cve_version_info,
                 scanned_dir=args["directory"],
                 filename=args["output_file"],
                 themes_dir=args["html_theme"],
@@ -449,6 +457,7 @@ def main(argv=None):
                 is_report=args["report"],
                 append=args["append"],
                 merge_report=merged_reports,
+                affected_versions=args["affected_versions"],
             )
 
             if not args["quiet"]:

cve_bin_tool/cve_scanner.py

@@ -20,7 +20,7 @@
 from cve_bin_tool.linkify import linkify_cve
 from cve_bin_tool.log import LOGGER
 from cve_bin_tool.theme import cve_theme
-from cve_bin_tool.util import CVE, CVEData, ProductInfo
+from cve_bin_tool.util import CVE, CVEData, ProductInfo, VersionInfo
 
 
 class CVEScanner:
@@ -31,6 +31,7 @@ class CVEScanner:
     products_with_cve: int
     products_without_cve: int
     all_cve_data: DefaultDict[ProductInfo, CVEData]
+    all_cve_version_info: DefaultDict[str, VersionInfo]
 
     RANGE_UNSET: str = ""
     dbname: str = os.path.join(DISK_LOCATION_DEFAULT, DBNAME)
@@ -49,6 +50,7 @@ def __init__(
         self.products_with_cve = 0
         self.products_without_cve = 0
         self.all_cve_data = defaultdict(CVEData)
+        self.all_cve_version_info = defaultdict(VersionInfo)
 
     def get_cves(self, product_info: ProductInfo, triage_data: TriageData):
         """Get CVEs against a specific version of a product.
@@ -121,6 +123,7 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData):
                 and parsed_version >= parse_version(versionStartIncluding)
             ):
                 passes_start = True
+
             if (
                 versionStartExcluding is not self.RANGE_UNSET
                 and parsed_version > parse_version(versionStartExcluding)
@@ -147,6 +150,7 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData):
                 and parsed_version < parse_version(versionEndExcluding)
             ):
                 passes_end = True
+
             if (
                 versionEndIncluding is self.RANGE_UNSET
                 and versionEndExcluding is self.RANGE_UNSET
@@ -156,6 +160,12 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData):
             # if it fits into both ends of the range, add the cve number
             if passes_start and passes_end:
                 cve_list.append(cve_number)
+                self.all_cve_version_info[cve_number] = VersionInfo(
+                    start_including=versionStartIncluding,
+                    start_excluding=versionStartExcluding,
+                    end_including=versionEndIncluding,
+                    end_excluding=versionEndExcluding,
+                )
 
         # Go through and get all the severities
         if cve_list:

cve_bin_tool/output_engine/__init__.py

@@ -271,9 +271,11 @@ def __init__(
         is_report: bool = False,
         append: Union[str, bool] = False,
         merge_report: Union[None, List[str]] = None,
+        affected_versions: int = 0,
+        all_cve_version_info=None,
     ):
         self.logger = logger or LOGGER.getChild(self.__class__.__name__)
-        self.all_cve_data = all_cve_data
+        self.all_cve_version_info = all_cve_version_info
         self.scanned_dir = scanned_dir
         self.filename = os.path.abspath(filename) if filename else ""
         self.products_with_cve = products_with_cve
@@ -285,6 +287,8 @@ def __init__(
         self.append = append
         self.tag = tag
         self.merge_report = merge_report
+        self.affected_versions = affected_versions
+        self.all_cve_data = all_cve_data
 
     def output_cves(self, outfile, output_type="console"):
         """Output a list of CVEs
@@ -317,7 +321,12 @@ def output_cves(self, outfile, output_type="console"):
                 outfile,
             )
         else:  # console, or anything else that is unrecognised
-            output_console(self.all_cve_data, self.time_of_last_update)
+            output_console(
+                self.all_cve_data,
+                self.all_cve_version_info,
+                self.time_of_last_update,
+                self.affected_versions,
+            )
 
         if isinstance(self.append, str):
             save_intermediate(

cve_bin_tool/output_engine/console.py

@@ -16,12 +16,58 @@
 from ..input_engine import Remarks
 from ..linkify import linkify_cve
 from ..theme import cve_theme
-from ..util import ProductInfo
+from ..util import ProductInfo, VersionInfo
+
+
+def format_version_range(
+    start_including, start_excluding, end_including, end_excluding
+):
+    """
+    formats version info to desirable output
+
+    Example:
+    ```
+        format_version_info('2.2.8', '', '2.2.11', '') => "[2.2.8 - 2.2.11]"
+        format_version_info('2.2.8', '', '', '2.2.11') => "[2.2.8 - 2.2.11)"
+        format_version_info('', '2.2.8', '2.2.11', '') => "(2.2.8 - 2.2.11]"
+        format_version_info('', '2.2.8', '', '2.2.11') => "(2.2.8 - 2.2.11])"
+        format_version_info('2.2.8', '', '', '') => ">= 2.2.8"
+        format_version_info('', '2.2.8', '', '') => "> 2.2.8"
+        format_version_info('', '', '2.2.11', '') => "<= 2.2.11"
+        format_version_info('', '', '', '2.2.11') => "< 2.2.11"
+        format_version_infor([]) => "-"
+    ```
+
+    Reference for Interval terminologies: https://en.wikipedia.org/wiki/Interval_(mathematics)
+    """
+
+    versions = (start_including, start_excluding, end_including, end_excluding)
+    if versions:
+        # should refactor to use python 3.10's "Structural Pattern Matching"
+        if start_including and end_including:
+            return f"[{start_including} - {end_including}]"
+        elif start_including and end_excluding:
+            return f"[{start_including} - {end_excluding})"
+        elif start_excluding and end_including:
+            return f"({start_excluding} - {end_including}]"
+        elif start_excluding and end_excluding:
+            return f"({start_excluding} - {end_excluding})"
+        elif start_including:
+            return f">= {start_including}"
+        elif start_excluding:
+            return f"> {start_excluding}"
+        elif end_including:
+            return f"<= {end_including}"
+        elif end_excluding:
+            return f"< {end_excluding}"
+    return "-"
 
 
 def output_console(
     all_cve_data: Dict[ProductInfo, CVEData],
+    all_cve_version_info: Dict[str, VersionInfo],
     time_of_last_update,
+    affected_versions: int,
     console=Console(theme=cve_theme),
 ):
     """Output list of CVEs in a tabular format with color support"""
@@ -65,6 +111,35 @@ def output_console(
                     "cvss_version": cve.cvss_version,
                 }
             )
+            if affected_versions != 0:
+                try:
+                    start_including = dict(all_cve_version_info)[
+                        cve.cve_number
+                    ].start_including
+                    start_excluding = dict(all_cve_version_info)[
+                        cve.cve_number
+                    ].start_excluding
+                    end_including = dict(all_cve_version_info)[
+                        cve.cve_number
+                    ].end_including
+                    end_excluding = dict(all_cve_version_info)[
+                        cve.cve_number
+                    ].end_excluding
+                except KeyError:  # TODO: handle 'UNKNOWN' and some cves more cleanly
+                    start_including = ""
+                    start_excluding = ""
+                    end_including = ""
+                    end_excluding = ""
+                cve_by_remarks[cve.remarks][-1].update(
+                    {
+                        "affected_versions": format_version_range(
+                            start_including,
+                            start_excluding,
+                            end_including,
+                            end_excluding,
+                        )
+                    }
+                )
 
     for remarks in sorted(cve_by_remarks):
         color = remarks_colors[remarks]
@@ -79,24 +154,43 @@ def output_console(
         table.add_column("CVE Number")
         table.add_column("Severity")
         table.add_column("Score (CVSS Version)")
+        if affected_versions != 0:
+            table.add_column("Affected Versions")
         # table.add_column("CVSS Version")
 
         for cve_data in cve_by_remarks[remarks]:
             color = cve_data["severity"].lower()
-            table.add_row(
-                Text.styled(cve_data["vendor"], color),
-                Text.styled(cve_data["product"], color),
-                Text.styled(cve_data["version"], color),
-                linkify_cve(Text.styled(cve_data["cve_number"], color)),
-                Text.styled(cve_data["severity"], color),
-                Text.styled(
-                    str(cve_data["score"])
-                    + " (v"
-                    + str(cve_data["cvss_version"])
-                    + ")",
-                    color,
-                ),
-            )
+            if affected_versions != 0:
+                table.add_row(
+                    Text.styled(cve_data["vendor"], color),
+                    Text.styled(cve_data["product"], color),
+                    Text.styled(cve_data["version"], color),
+                    linkify_cve(Text.styled(cve_data["cve_number"], color)),
+                    Text.styled(cve_data["severity"], color),
+                    Text.styled(
+                        str(cve_data["score"])
+                        + " (v"
+                        + str(cve_data["cvss_version"])
+                        + ")",
+                        color,
+                    ),
+                    Text.styled(cve_data["affected_versions"], color),
+                )
+            else:
+                table.add_row(
+                    Text.styled(cve_data["vendor"], color),
+                    Text.styled(cve_data["product"], color),
+                    Text.styled(cve_data["version"], color),
+                    linkify_cve(Text.styled(cve_data["cve_number"], color)),
+                    Text.styled(cve_data["severity"], color),
+                    Text.styled(
+                        str(cve_data["score"])
+                        + " (v"
+                        + str(cve_data["cvss_version"])
+                        + ")",
+                        color,
+                    ),
+                )
         # Print the table to the console
         console.print(table)
         for cve_data in cve_by_remarks[remarks]:

cve_bin_tool/util.py

@@ -65,6 +65,13 @@ class ProductInfo(NamedTuple):
     version: str
 
 
+class VersionInfo(NamedTuple):
+    start_including: str
+    start_excluding: str
+    end_including: str
+    end_excluding: str
+
+
 class CVEData(defaultdict):
     def __missing__(self, key):
         if key == "cves":