debian How to check Debian CVE status using python script
Article Number: 372 | Rating: Unrated | Last Updated: Sun, Sep 23, 2018 11:06 AM
Check current status of Debian Common Vulnerabilities and Exposures using simple python script and Security Bug Tracker.
Python script
I have used regular shell script at first, but it was too complicated after a while, as parsing HTML code using sed is a really bad idea. I have switched to Python using Beautiful Soup library, so the whole idea could be simplified.
#!/usr/bin/python
# check security updates in specific distribution for provided CVE status
# imports
import sys, getopt
import urllib2
from bs4 import BeautifulSoup
# help function
def help():
print 'check security updates in specific distribution for provided CVE status'
print
print 'check_cve.py -c <required_cve> -d <optional_distribution>'
print
def main(argv):
# cve and distribution
cve = ""
distribution = ""
try:
opts, args = getopt.getopt(argv,"hd:c:",["distribution=","cve="])
except getopt.GetoptError:
help()
sys.exit(3)
for opt, arg in opts:
if opt == '-h':
help()
sys.exit()
elif opt in ("-d", "--distribution"):
distribution = arg
elif opt in ("-c", "--cve"):
cve = arg
# exit if cve is not provided
if len(cve) == 0:
help()
sys.exit(2)
# make request
uri = "https://security-tracker.debian.org/tracker/" + cve
request = urllib2.Request(uri)
try:
request_handle = urllib2.urlopen(request)
except urllib2.HTTPError, error:
print "HTTP error on" + " " + uri + " " + "code" + " " + str(error.code)
exit(4)
except urllib2.URLError, error:
print "URL error on" + " " + uri + " " + "reason" + " " + str(error.reason)
exit(5)
# read and parse html
html = request_handle.read()
soup = BeautifulSoup(html,"html.parser")
table = soup.find_all("table")[1] # get second table
source = (((table.select('tr')[1]).select('td')[0]).getText()).replace(" (PTS)","")
output = 0
for row in table:
columns = row.select('td')
parsed_array = []
for column in columns:
parsed_array.append(column.text)
if(len(parsed_array) == 4):
if len(distribution) != 0:
if distribution in parsed_array[1]:
print "Source package " + source + " (version " + parsed_array[2] + ")" + " is "+ parsed_array[3] + " (" + cve + ")" +" in " + parsed_array[1]
output = 1
else:
print "Source package " + source + " (version " + parsed_array[2] + ")" + " is "+ parsed_array[3] + " (" + cve + ")" + " in " + parsed_array[1]
output = 1
if output == 0:
print "matching data not provided"
if __name__ == "__main__":
main(sys.argv[1:])
Sample usage
Display usage information.
$ python check_cve.py check security updates in specific distribution for provided CVE status check_cve.py -c <required_cve> -d <optional_distribution>
Display CVE-2016-8655 status for Debian Jessie.
$ python check_cve.py -d jessie -c CVE-2016-8655 Source package linux (version 3.16.36-1+deb8u1) is vulnerable (CVE-2016-8655) in jessie Source package linux (version 3.16.36-1+deb8u2) is vulnerable (CVE-2016-8655) in jessie (security)
Display CVE-2016-8614 status.
$ python check_cve.py -c CVE-2016-8614 Source package ansible (version 1.7.2+dfsg-2) is vulnerable (CVE-2016-8614) in jessie Source package ansible (version 2.2.0.0-1) is fixed (CVE-2016-8614) in stretch, sid
It is as simple as that.

