You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Spectra Assure platform is a set of [ReversingLabs](https://www.reversinglabs.com/) solutions primarily designed for software assurance and software supply chain security use-cases.
9
+
Spectra Assure products analyze compiled software packages, their components and third-party dependencies to detect exposures, reduce vulnerabilities, and eliminate threats before reaching production.
10
+
11
+
Every Spectra Assure analysis (software scan) produces a set of reports and the overall CI status (pass or fail) for the analyzed software package.
12
+
The reports are created in multiple different formats, with different level of detail and scope of information about the analysis results.
13
+
The official documentation describes all [supported report formats](https://docs.secure.software/concepts/analysis-reports) in Spectra Assure.
14
+
15
+
**The primary purpose of this parser is extracting known vulnerabilities (CVEs) that are present in the `components` and `dependencies` sections of the `rl-json` report.**
7
16
8
17
### File Types
9
18
10
-
The parser accepts only `report.rl.json` files.
11
-
You can find instructions how to export the `rl-json` report from the cli and portal scanners.
19
+
The parser accepts only `report.rl.json` files (the Spectra Assure [rl-json report](https://docs.secure.software/concepts/analysis-reports#rl-json)).
@@ -30,63 +40,62 @@ For the specification of the rl-json report, see the documentation at:
30
40
31
41
##### Component
32
42
33
-
For a Components, the title shows:
43
+
For a component, the title includes:
34
44
35
-
- the CVE.
36
-
- the type: `Component`.
37
-
- the `purl` of the `Component` if present, otherwise name and version.
45
+
- the CVE
46
+
- the type: `Component`
47
+
- the `purl` of the `Component` if present; otherwise name and version
38
48
39
49
40
50
##### Dependency
41
51
42
-
The title shows the:
52
+
For a dependency, the title includes:
43
53
44
-
- the CVE.
45
-
- the type: `Dependecy`.
46
-
- the `purl` of the `Dependency` if present, otherwise name and version.
54
+
- the CVE
55
+
- the type: `Dependency`
56
+
- the `purl` of the `Dependency` if present; otherwise name and version
47
57
48
58
#### Description
49
59
50
60
##### Component
51
61
52
-
For a component we repeat the title, but add the sha256.
62
+
For a component, the description repeats the information from the [title](#title) and includes the SHA256 hash of the component.
53
63
54
-
The sha256 is added as sometimes a file scan my have multiple items with the same name and version
55
-
but with a different hash.
56
-
Typically this happens with Windows intstall packages with multiple languages.
64
+
The SHA256 is included because sometimes a file scan may have multiple items with the same name and version, but with different hashes.
65
+
Typically this happens with multi-language Windows installer packages.
57
66
58
67
59
68
##### Dependency
60
69
61
-
For a dependency we repeat the title and then add the component_name, the component pathand the component_hash.
62
-
For duplicates we add one additional line to the description for each duplicate, showing its title and component.
70
+
For a dependency, the description repeats the information from the [title](#title) and includes the component path, `component-name`and `component-hash`.
71
+
For duplicates, the description includes an additional line showing the title and component of each duplicate.
63
72
64
73
#### Vulnerabilities
65
74
66
-
From the vulnerability data in the rl-json file, we fetch:
75
+
For vulnerabilities, the following information is retrieved:
67
76
68
-
- the CVE unique id
69
-
-cvss version
70
-
-cvss.basescore
77
+
- the CVE unique ID
78
+
-CVSS version
79
+
-CVSS base score
71
80
72
-
From the cvss.basescore we map the severity into:
81
+
From the CVSS base score, we map the severity into:
73
82
74
83
- Info
75
84
- Low
76
85
- Medium
77
86
- High
78
87
- Critical
79
88
89
+
If no mapping is matched, the default severity is `Info`.
90
+
80
91
##### Notes
81
92
82
-
- Currently no endpoints are created
93
+
- Currently, no endpoints are created.
83
94
- Deduplication is done with the `unique-id-from-tool` field.
84
-
- for component: `<component sha256>:<cve>`
95
+
- for components: `<component sha256>:<cve>`
85
96
- for dependencies: `<component sha256>:<cve>:<dependency purl>`
86
-
- On detecting a duplicate `dependency` we increment the number of occurrences.<br/>
87
-
`Components` have no duplicates so the nr of occurrences is always 1.
88
-
- The default severity if no mapping is matched is `Info`.
89
-
- We extract the scan date and the scanner version and set a static scanner-name.
97
+
- On detecting a duplicate dependency, we increment the number of occurrences. Components have no duplicates, so the number of occurrences is always 1.
98
+
- We extract the scan date, the Spectra Assure scanner version, and set a static scanner name.
0 commit comments