Class H2Functions

java.lang.Object

org.owasp.dependencycheck.data.nvdcve.H2Functions

public final class H2Functions
extends Object

Stored procedures for the H2 database.

Author:

Jeremy Long

Method Summary

Modifier and Type	Method	Description
static void	insertSoftware(Connection conn, int vulnerabilityId, String part, String vendor, String product, String version, String update, String edition, String language, String swEdition, String targetSw, String targetHw, String other, String ecosystem, String versionEndExcluding, String versionEndIncluding, String versionStartExcluding, String versionStartIncluding, Boolean vulnerable)	Adds a CPE to a vulnerability; if the CPE is not contained in the database it is first added.
static void	mergeKnownExploited(Connection conn, String cveId, String vendorProject, String product, String vulnerabilityName, String dateAdded, String shortDescription, String requiredAction, String dueDate, String notes)	Update or insert a known exploited vulnerability.
static ResultSet	updateVulnerability(Connection conn, String cve, String description, String v2Severity, Float v2ExploitabilityScore, Float v2ImpactScore, Boolean v2AcInsufInfo, Boolean v2ObtainAllPrivilege, Boolean v2ObtainUserPrivilege, Boolean v2ObtainOtherPrivilege, Boolean v2UserInteractionRequired, Float v2Score, String v2AccessVector, String v2AccessComplexity, String v2Authentication, String v2ConfidentialityImpact, String v2IntegrityImpact, String v2AvailabilityImpact, String v2Version, Float v3ExploitabilityScore, Float v3ImpactScore, String v3AttackVector, String v3AttackComplexity, String v3PrivilegesRequired, String v3UserInteraction, String v3Scope, String v3ConfidentialityImpact, String v3IntegrityImpact, String v3AvailabilityImpact, Float v3BaseScore, String v3BaseSeverity, String v3Version, String v4version, String v4attackVector, String v4attackComplexity, String v4attackRequirements, String v4privilegesRequired, String v4userInteraction, String v4vulnConfidentialityImpact, String v4vulnIntegrityImpact, String v4vulnAvailabilityImpact, String v4subConfidentialityImpact, String v4subIntegrityImpact, String v4subAvailabilityImpact, String v4exploitMaturity, String v4confidentialityRequirement, String v4integrityRequirement, String v4availabilityRequirement, String v4modifiedAttackVector, String v4modifiedAttackComplexity, String v4modifiedAttackRequirements, String v4modifiedPrivilegesRequired, String v4modifiedUserInteraction, String v4modifiedVulnConfidentialityImpact, String v4modifiedVulnIntegrityImpact, String v4modifiedVulnAvailabilityImpact, String v4modifiedSubConfidentialityImpact, String v4modifiedSubIntegrityImpact, String v4modifiedSubAvailabilityImpact, String v4safety, String v4automatable, String v4recovery, String v4valueDensity, String v4vulnerabilityResponseEffort, String v4providerUrgency, Float v4baseScore, String v4baseSeverity, Float v4threatScore, String v4threatSeverity, Float v4environmentalScore, String v4environmentalSeverity, String v4source, String v4type)	Updates or inserts the vulnerability into the database.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

insertSoftware

public static void insertSoftware(Connection conn,
 int vulnerabilityId,
 String part,
 String vendor,
 String product,
 String version,
 String update,
 String edition,
 String language,
 String swEdition,
 String targetSw,
 String targetHw,
 String other,
 String ecosystem,
 String versionEndExcluding,
 String versionEndIncluding,
 String versionStartExcluding,
 String versionStartIncluding,
 Boolean vulnerable)
                           throws SQLException

Adds a CPE to a vulnerability; if the CPE is not contained in the database it is first added.

Parameters:

conn - the database connection

vulnerabilityId - the vulnerability id

part - the CPE part

vendor - the CPE vendor

product - the CPE product

version - the CPE version

update - the CPE update version

edition - the CPE edition

language - the CPE language

swEdition - the CPE software edition

targetSw - the CPE target software

targetHw - the CPE target hardware

other - the CPE other

ecosystem - the ecosystem

versionEndExcluding - a version range to identify the software

versionEndIncluding - a version range to identify the software

versionStartExcluding - a version range to identify the software

versionStartIncluding - a version range to identify the software

vulnerable - a flag indicating whether or not the software is vulnerable

Throws:

SQLException - thrown if there is an error adding the CPE or software reference

updateVulnerability

public static ResultSet updateVulnerability(Connection conn,
 String cve,
 String description,
 String v2Severity,
 Float v2ExploitabilityScore,
 Float v2ImpactScore,
 Boolean v2AcInsufInfo,
 Boolean v2ObtainAllPrivilege,
 Boolean v2ObtainUserPrivilege,
 Boolean v2ObtainOtherPrivilege,
 Boolean v2UserInteractionRequired,
 Float v2Score,
 String v2AccessVector,
 String v2AccessComplexity,
 String v2Authentication,
 String v2ConfidentialityImpact,
 String v2IntegrityImpact,
 String v2AvailabilityImpact,
 String v2Version,
 Float v3ExploitabilityScore,
 Float v3ImpactScore,
 String v3AttackVector,
 String v3AttackComplexity,
 String v3PrivilegesRequired,
 String v3UserInteraction,
 String v3Scope,
 String v3ConfidentialityImpact,
 String v3IntegrityImpact,
 String v3AvailabilityImpact,
 Float v3BaseScore,
 String v3BaseSeverity,
 String v3Version,
 String v4version,
 String v4attackVector,
 String v4attackComplexity,
 String v4attackRequirements,
 String v4privilegesRequired,
 String v4userInteraction,
 String v4vulnConfidentialityImpact,
 String v4vulnIntegrityImpact,
 String v4vulnAvailabilityImpact,
 String v4subConfidentialityImpact,
 String v4subIntegrityImpact,
 String v4subAvailabilityImpact,
 String v4exploitMaturity,
 String v4confidentialityRequirement,
 String v4integrityRequirement,
 String v4availabilityRequirement,
 String v4modifiedAttackVector,
 String v4modifiedAttackComplexity,
 String v4modifiedAttackRequirements,
 String v4modifiedPrivilegesRequired,
 String v4modifiedUserInteraction,
 String v4modifiedVulnConfidentialityImpact,
 String v4modifiedVulnIntegrityImpact,
 String v4modifiedVulnAvailabilityImpact,
 String v4modifiedSubConfidentialityImpact,
 String v4modifiedSubIntegrityImpact,
 String v4modifiedSubAvailabilityImpact,
 String v4safety,
 String v4automatable,
 String v4recovery,
 String v4valueDensity,
 String v4vulnerabilityResponseEffort,
 String v4providerUrgency,
 Float v4baseScore,
 String v4baseSeverity,
 Float v4threatScore,
 String v4threatSeverity,
 Float v4environmentalScore,
 String v4environmentalSeverity,
 String v4source,
 String v4type)
                                     throws SQLException

Updates or inserts the vulnerability into the database. If updating a vulnerability the method will delete all software, CWE, and references and new entries will be added later.

Parameters:

conn - the database connection

cve - the CVE identifier

description - the vulnerability description

v2Severity - the CVSS v2 severity

v2ExploitabilityScore - the CVSS v2 exploitability score

v2ImpactScore - the CVSS v2 impact score

v2AcInsufInfo - the CVSS v2 AcInsufInfo

v2ObtainAllPrivilege - the CVSS v2 obtain all privilege flag

v2ObtainUserPrivilege - the CVSS v2 obtain user privilege flag

v2ObtainOtherPrivilege - the CVSS v2 obtain other privilege flag

v2UserInteractionRequired - the CVSS v2 user interaction required flag

v2Score - the CVSS v2 score

v2AccessVector - the CVSS v2 access vector

v2AccessComplexity - the CVSS v2 access complexity

v2Authentication - the CVSS v2 authentication

v2ConfidentialityImpact - the CVSS v2 confidentiality impact

v2IntegrityImpact - the CVSS v2 integrity impact

v2AvailabilityImpact - the CVSS v2 availability impact

v2Version - the CVSS v2 version

v3ExploitabilityScore - the CVSS v3 exploitability score

v3ImpactScore - the CVSS v3 impact score

v3AttackVector - the CVSS v3 attack vector

v3AttackComplexity - the CVSS v3 attack complexity

v3PrivilegesRequired - the CVSS v3 privilege required flag

v3UserInteraction - the CVSS v3 user interaction required flag

v3Scope - the CVSS v3 scope

v3ConfidentialityImpact - the CVSS v3 confidentiality impact

v3IntegrityImpact - the CVSS v3 integrity impact

v3AvailabilityImpact - the CVSS v3 availability impact

v3BaseScore - the CVSS v3 base score

v3BaseSeverity - the CVSS v3 base severity

v3Version - the CVSS v3 version

v4version - CVSS v4 data

v4attackVector - CVSS v4 data

v4attackComplexity - CVSS v4 data

v4attackRequirements - CVSS v4 data

v4privilegesRequired - CVSS v4 data

v4userInteraction - CVSS v4 data

v4vulnConfidentialityImpact - CVSS v4 data

v4vulnIntegrityImpact - CVSS v4 data

v4vulnAvailabilityImpact - CVSS v4 data

v4subConfidentialityImpact - CVSS v4 data

v4subIntegrityImpact - CVSS v4 data

v4subAvailabilityImpact - CVSS v4 data

v4exploitMaturity - CVSS v4 data

v4confidentialityRequirement - CVSS v4 data

v4integrityRequirement - CVSS v4 data

v4availabilityRequirement - CVSS v4 data

v4modifiedAttackVector - CVSS v4 data

v4modifiedAttackComplexity - CVSS v4 data

v4modifiedAttackRequirements - CVSS v4 data

v4modifiedPrivilegesRequired - CVSS v4 data

v4modifiedUserInteraction - CVSS v4 data

v4modifiedVulnConfidentialityImpact - CVSS v4 data

v4modifiedVulnIntegrityImpact - CVSS v4 data

v4modifiedVulnAvailabilityImpact - CVSS v4 data

v4modifiedSubConfidentialityImpact - CVSS v4 data

v4modifiedSubIntegrityImpact - CVSS v4 data

v4modifiedSubAvailabilityImpact - CVSS v4 data

v4safety - CVSS v4 data

v4automatable - CVSS v4 data

v4recovery - CVSS v4 data

v4valueDensity - CVSS v4 data

v4vulnerabilityResponseEffort - CVSS v4 data

v4providerUrgency - CVSS v4 data

v4baseScore - CVSS v4 data

v4baseSeverity - CVSS v4 data

v4threatScore - CVSS v4 data

v4threatSeverity - CVSS v4 data

v4environmentalScore - CVSS v4 data

v4environmentalSeverity - CVSS v4 data

v4source - CVSS v4 data

v4type - CVSS v4 data

Returns:

a result set containing the vulnerability id

Throws:

SQLException - thrown if there is an error updating or inserting the vulnerability

mergeKnownExploited

public static void mergeKnownExploited(Connection conn,
 String cveId,
 String vendorProject,
 String product,
 String vulnerabilityName,
 String dateAdded,
 String shortDescription,
 String requiredAction,
 String dueDate,
 String notes)
                                throws SQLException

Update or insert a known exploited vulnerability.

Parameters:

conn - the connection

cveId - the id

vendorProject - the vendor/project

product - the product

vulnerabilityName - the vulnerability name

dateAdded - the date added

shortDescription - the short description

requiredAction - the action required

dueDate - the due date

notes - notes

Throws:

SQLException - thrown if there is a database error merging the Known Exploited information to the database