diff --git a/dojo/tools/awssecurityhub/parser.py b/dojo/tools/awssecurityhub/parser.py index 252c4c5a237..3c993ac41fb 100644 --- a/dojo/tools/awssecurityhub/parser.py +++ b/dojo/tools/awssecurityhub/parser.py @@ -47,6 +47,7 @@ def get_item(finding: dict, test): impact = [] references = [] unsaved_vulnerability_ids = [] + epss_score = None if aws_scanner_type == "Inspector": description = f"This is an Inspector Finding\n{finding.get('Description', '')}" vulnerabilities = finding.get("Vulnerabilities", []) @@ -66,6 +67,8 @@ def get_item(finding: dict, test): if vendor := vulnerability.get("Vendor"): if vendor_url := vendor.get("Url"): references.append(vendor_url) + if vulnerability.get("EpssScore") is not None: + epss_score = vulnerability.get("EpssScore") if finding.get("ProductFields", {}).get("aws/inspector/FindingStatus", "ACTIVE") == "ACTIVE": mitigated = None @@ -140,6 +143,10 @@ def get_item(finding: dict, test): dynamic_finding=False, component_name=component_name, ) + + if epss_score is not None: + result.epss_score = epss_score + # Add the unsaved vulnerability ids result.unsaved_vulnerability_ids = unsaved_vulnerability_ids diff --git a/unittests/tools/test_awssecurityhub_parser.py b/unittests/tools/test_awssecurityhub_parser.py index 6dd78605fd5..23a2796e837 100644 --- a/unittests/tools/test_awssecurityhub_parser.py +++ b/unittests/tools/test_awssecurityhub_parser.py @@ -101,3 +101,4 @@ def test_inspector_ecr(self): self.assertEqual("CVE-2023-2650 - openssl - Image: repo-os/sha256:af965ef68c78374a5f987fce98c0ddfa45801df2395bf012c50b863e65978d74", finding.title) self.assertIn("repo-os/sha256:af965ef68c78374a5f987fce98c0ddfa45801df2395bf012c50b863e65978d74", finding.impact) self.assertIn("Repository: repo-os", finding.impact) + self.assertEqual(0.0014, finding.epss_score)