org.owasp.dependencycheck.data.nvdcve

Class H2Functions

java.lang.Object

org.owasp.dependencycheck.data.nvdcve.H2Functions

public final class H2Functions
extends Object

Stored procedures for the H2 database.

Author:

Jeremy Long

Method Summary

Modifier and Type	Method and Description
static void	insertSoftware(Connection conn, int vulnerabilityId, String part, String vendor, String product, String version, String update, String edition, String language, String swEdition, String targetSw, String targetHw, String other, String ecosystem, String versionEndExcluding, String versionEndIncluding, String versionStartExcluding, String versionStartIncluding, Boolean vulnerable) Adds a CPE to a vulnerability; if the CPE is not contained in the database it is first added.
static ResultSet	updateVulnerability(Connection conn, String cve, String description, String v2Severity, Float v2ExploitabilityScore, Float v2ImpactScore, Boolean v2AcInsufInfo, Boolean v2ObtainAllPrivilege, Boolean v2ObtainUserPrivilege, Boolean v2ObtainOtherPrivilege, Boolean v2UserInteractionRequired, Float v2Score, String v2AccessVector, String v2AccessComplexity, String v2Authentication, String v2ConfidentialityImpact, String v2IntegrityImpact, String v2AvailabilityImpact, String v2Version, Float v3ExploitabilityScore, Float v3ImpactScore, String v3AttackVector, String v3AttackComplexity, String v3PrivilegesRequired, String v3UserInteraction, String v3Scope, String v3ConfidentialityImpact, String v3IntegrityImpact, String v3AvailabilityImpact, Float v3BaseScore, String v3BaseSeverity, String v3Version) Updates or inserts the vulnerability into the database.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

insertSoftware

public static void insertSoftware(Connection conn,
                                  int vulnerabilityId,
                                  String part,
                                  String vendor,
                                  String product,
                                  String version,
                                  String update,
                                  String edition,
                                  String language,
                                  String swEdition,
                                  String targetSw,
                                  String targetHw,
                                  String other,
                                  String ecosystem,
                                  String versionEndExcluding,
                                  String versionEndIncluding,
                                  String versionStartExcluding,
                                  String versionStartIncluding,
                                  Boolean vulnerable)
                           throws SQLException

Adds a CPE to a vulnerability; if the CPE is not contained in the database it is first added.

Parameters:

conn - the database connection

vulnerabilityId - the vulnerability id

part - the CPE part

vendor - the CPE vendor

product - the CPE product

version - the CPE version

update - the CPE update version

edition - the CPE edition

language - the CPE language

swEdition - the CPE software edition

targetSw - the CPE target software

targetHw - the CPE target hardware

other - the CPE other

ecosystem - the ecosystem

versionEndExcluding - a version range to identify the software

versionEndIncluding - a version range to identify the software

versionStartExcluding - a version range to identify the software

versionStartIncluding - a version range to identify the software

vulnerable - a flag indicating whether or not the software is vulnerable

Throws:

SQLException - thrown if there is an error adding the CPE or software reference

updateVulnerability

public static ResultSet updateVulnerability(Connection conn,
                                            String cve,
                                            String description,
                                            String v2Severity,
                                            Float v2ExploitabilityScore,
                                            Float v2ImpactScore,
                                            Boolean v2AcInsufInfo,
                                            Boolean v2ObtainAllPrivilege,
                                            Boolean v2ObtainUserPrivilege,
                                            Boolean v2ObtainOtherPrivilege,
                                            Boolean v2UserInteractionRequired,
                                            Float v2Score,
                                            String v2AccessVector,
                                            String v2AccessComplexity,
                                            String v2Authentication,
                                            String v2ConfidentialityImpact,
                                            String v2IntegrityImpact,
                                            String v2AvailabilityImpact,
                                            String v2Version,
                                            Float v3ExploitabilityScore,
                                            Float v3ImpactScore,
                                            String v3AttackVector,
                                            String v3AttackComplexity,
                                            String v3PrivilegesRequired,
                                            String v3UserInteraction,
                                            String v3Scope,
                                            String v3ConfidentialityImpact,
                                            String v3IntegrityImpact,
                                            String v3AvailabilityImpact,
                                            Float v3BaseScore,
                                            String v3BaseSeverity,
                                            String v3Version)
                                     throws SQLException

Updates or inserts the vulnerability into the database. If updating a vulnerability the method will delete all software, CWE, and references and new entries will be added later.

Parameters:

conn - the database connection

cve - the CVE identifier

description - the vulnerability description

v2Severity - the CVSS v2 severity

v2ExploitabilityScore - the CVSS v2 exploitability score

v2ImpactScore - the CVSS v2 impact score

v2AcInsufInfo - the CVSS v2 AcInsufInfo

v2ObtainAllPrivilege - the CVSS v2 obtain all privilege flag

v2ObtainUserPrivilege - the CVSS v2 obtain user privilege flag

v2ObtainOtherPrivilege - the CVSS v2 obtain other privilege flag

v2UserInteractionRequired - the CVSS v2 user interaction required flag

v2Score - the CVSS v2 score

v2AccessVector - the CVSS v2 access vector

v2AccessComplexity - the CVSS v2 access complexity

v2Authentication - the CVSS v2 authentication

v2ConfidentialityImpact - the CVSS v2 confidentiality impact

v2IntegrityImpact - the CVSS v2 integrity impact

v2AvailabilityImpact - the CVSS v2 availability impact

v2Version - the CVSS v2 version

v3ExploitabilityScore - the CVSS v3 exploitability score

v3ImpactScore - the CVSS v3 impact score

v3AttackVector - the CVSS v3 attack vector

v3AttackComplexity - the CVSS v3 attack complexity

v3PrivilegesRequired - the CVSS v3 privilege required flag

v3UserInteraction - the CVSS v3 user interaction required flag

v3Scope - the CVSS v3 scope

v3ConfidentialityImpact - the CVSS v3 confidentiality impact

v3IntegrityImpact - the CVSS v3 integrity impact

v3AvailabilityImpact - the CVSS v3 availability impact

v3BaseScore - the CVSS v3 base score

v3BaseSeverity - the CVSS v3 base severity

v3Version - the CVSS v3 version

Returns:

a result set containing the vulnerability id

Throws:

SQLException - thrown if there is an error updating or inserting the vulnerability