diff --git a/software_vulnarabilities/jenkins.py b/software_vulnarabilities/jenkins.py index 6b4d8b3..872d2d8 100644 --- a/software_vulnarabilities/jenkins.py +++ b/software_vulnarabilities/jenkins.py @@ -21,7 +21,9 @@ CROWD_URL = "https://crowd.lmru.tech" GHE_URL = "https://github.lmru.tech" -ARGOCD_URL = "https://argocd.devops.lmru.tech/" +ARGOCD_URL = "https://argocd.devops.lmru.tech" + +GRAFANA_OBS_URL = "https://obs-grafana-yc-techno.apps.lmru.tech" NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0" NVD_API_KEY = "aa054ea4-4a99-4f16-b5ed-1f77b5193d80" @@ -140,6 +142,30 @@ def get_argocd_version(): print("Could not determine ArgoCD version from /api/version endpoint.") return None +def get_oncall_version(): + url = f"{GRAFANA_OBS_URL}/metrics" + resp = requests.get(url, verify=False) + resp.raise_for_status() + text = resp.text + + # Ищем строку с plugin_id="grafana-oncall-app" + # Пример строки: + # grafana_plugin_build_info{plugin_id="grafana-oncall-app",plugin_type="app",signature_status="valid",version="1.3.58"} 1 + match_line = re.search(r'grafana_plugin_build_info\{[^}]*plugin_id="grafana-oncall-app"[^}]*\}', text) + if not match_line: + print("Could not find grafana-oncall-app plugin info in /metrics.") + return None + + line = match_line.group(0) + # Извлекаем version="..." + match_version = re.search(r'version="([^"]+)"', line) + if match_version: + oncall_version = match_version.group(1) + return oncall_version + else: + print("Could not extract version from grafana-oncall-app plugin line.") + return None + def fetch_cves_by_cpe(cpe_name, max_retries=3, delay=5): """ Запросить уязвимости из NVD по cpeName. @@ -351,6 +377,17 @@ def main(): argocd_vulns = fetch_cves_by_cpe(argocd_cpe) insert_vulnerabilities(conn, "argocd", "argocd", argocd_version, argocd_vulns) + # OnCall + oncall_version = get_oncall_version() + if not oncall_version: + print("Could not determine OnCall version.") + sys.exit(1) + oncall_cpe = f"cpe:2.3:a:grafana:oncall:{oncall_version}:*:*:*:*:*:*:*" + print(f"OnCall version: {oncall_version}") + print(f"OnCall CPE: {oncall_cpe}") + + oncall_vulns = fetch_cves_by_cpe(oncall_cpe) + insert_vulnerabilities(conn, "grafana", "oncall_plugin", oncall_version, oncall_vulns) conn.close()