☰

是否有用于访问历史 Ubuntu 安全通知的 API？

tag-icon • tag-icon security
是否有用于访问历史 Ubuntu 安全通知的 API？

我正在开发一个自动安全审计系统，该系统可以分析自定义 Ubuntu 安装以检查受安全漏洞影响的软件包。由于这些机器未连接到互联网，我无法简单地运行apt-get，我们需要尽可能减少升级，以便仅在真正需要时更新软件包。

此过程的一部分是监控 Ubuntu 安全通知 (USN) 以获取新报告并提取信息。但是，我找不到轻松访问所有历史 USN 通知的方法。

有一个 RSS 源链接http://www.ubuntu.com/usn/但它只返回最近的 50 份报告，这不起作用，因为我正在处理旧版本的 Ubuntu，并且需要检查历史报告。

我看到的两个选项都不太好，一个是抓取电子邮件档案，另一个是抓取网站。但如果可能的话，我宁愿避免这样做……

有任何想法吗？

答案1

不，没有 API，但应该很容易通过抓取主要 CVE或者合作伙伴 CVE列表放入数据库，而不是 USN 网站或电子邮件存档： 在此处输入图片描述

答案2

以下是一些节点代码（使用节点 6.10.0 测试），它将抓取以下内容https://usn.ubuntu.com/usn/到电子表格中。

电子表格如下所示：

CSV 输出为电子表格

运行代码的方法如下：

var config = {};
config.searchIssuesAfter = new Date('2016-08-28');
config.reportName = 'Ubuntu Report';
config.securityNoticeURL = 'https://usn.ubuntu.com/usn/precise/';
config.usnBaseURL = 'https://usn.ubuntu.com';
config.numberOfPages = 6;
ubuntuReport = require('./getUbuntuData.js'); 
ubuntuReport.go(config);

这是支持文件 getUbuntuData.js

var fs = require('fs');
var axios = require('axios');
var cheerio = require('cheerio');

module.exports = {
  go: function(config1) {
    //config
    var config = Object.assign({}, config1);
    var local = {};
    local.list = [];


    // Private functions  
    local.getPromiseUSNListFn = function(numPages){
      var promiseList = [];
      promiseList.push(axios.get(config.securityNoticeURL));
      for (var i = 2; i <= numPages; i++){
          promiseList.push(axios.get(config.securityNoticeURL+'?page='+i));
      }
      return promiseList;
    };

    local.sortByDateFn = function(a, b){
      return  b.timestamp - a.timestamp;
    };

    local.createSecurityNoticeListFn = function(response){
      var $ = cheerio.load(response.data);

      $('.notice').each( (i, elm) => {
        var securityNoticeNode = $(elm).find('h3 > a');
        var usn = securityNoticeNode.text().split(':')[0];
        var title = securityNoticeNode.text().split(': ')[1];
        var href = securityNoticeNode.attr("href");
        var dateNode = $(elm).find('h3');
        var dateStr = dateNode.contents().filter(function() {
          return this.nodeType == 3;
        }).text().trim();
        dateStr = dateStr.replace(/^\s*-\s*/,""); 
        var removeNewlinesRegEx = /(\r\n|\n|\r)/gm;
        dateStr = dateStr.replace(removeNewlinesRegEx,""); 
        dateStr = dateStr.replace(/(\d)(th|rd|nd|st)/,"$1");
        var date = new Date(dateStr);

        var infoObj = {
          usn: usn,
          title: title,
          href: config.usnBaseURL+href,
          timestamp: date.getTime(),
          date: dateStr
        };
        local.list.push(infoObj);
      });
    };

    local.getSecurityNoticeData = function(el){

        return axios.get(el.href).then( (response) => {
          el.summary = "";
          el.packages = [];
          el.versions = [];
          var $ = cheerio.load(response.data);
          console.log("Received : "+el.title);
          var removeNewlinesRegEx = /(\r\n|\n|\r)/gm;
          el.summary = $("h3:contains('Summary')").next().text().trim().replace(removeNewlinesRegEx," ");
          $("dl > dd").each((j, packageNode) => {
            el.packages.push($(packageNode).children().first().text().trim().replace(removeNewlinesRegEx," "));
            el.versions.push($(packageNode).children().first().next().text().trim().replace(removeNewlinesRegEx," "));
          });
        });
    };

    local.getPromiseListSecurityNoticesFn = function(){
      var promiseList = [];
      for (var i = 0; i < local.list.length; i++){
          promiseList.push(local.getSecurityNoticeData(local.list[i]));
      }
      return promiseList;
    };

    local.buildCSV = function(){
      var csv = "";
      csv += config.reportName+",,,,,,,,\n";
      csv += "Date,USN,Title,Package,Installed ?,Version,Urgency,Summary,Link\n";
      local.list.forEach((node) => {
        //node - final element
        var date = node.date;
        var usn = node.usn;
        var title = node.title;
        var packages = '"'+node.packages.join(", ")+'"';
        var installed = "?";
        var versions = '"'+node.versions.join(", ")+'"';
        var urgency = "?";
        var summary = '"'+node.summary+'"';
        var link = node.href;
        csv += date+",";
        csv += usn+",";
        csv += title+",";
        csv += packages+",";
        csv += installed+",";
        csv += versions+",";
        csv += urgency+",";
        csv += summary+",";
        csv += link;
        csv += "\n";
      });
      fs.writeFileSync(__dirname+"/../ubuntu_worksheet.csv", csv);
    };

    //Start 
    axios.all(local.getPromiseUSNListFn(config.numberOfPages))
      .then(axios.spread(function () {
        var i;
        for (i = 0; i < arguments.length; i++){
          console.log("Received page : "+i);
          local.createSecurityNoticeListFn(arguments[i]);
        }
        local.list.sort(local.sortByDateFn);
        for (i = 0; i < local.list.length; i++){
          if (local.list[i].timestamp < config.searchIssuesAfter.getTime()){
            //truncate list 
            local.list.length = i;
            break;
          }
        }
      }))
      .then(()=>{
        return axios.all(local.getPromiseListSecurityNoticesFn());
      }).then(()=>{
        local.buildCSV();
        console.log('data saved to ubuntu_worksheet.csv');
      });
   }
};

相关内容