Add V2 Importer for Tuxcare advisories #2104

Samk1710 · 2026-01-04T20:47:12Z

Addresses Issue:

Import data from Tuxcare #2004

Data Source: https://cve.tuxcare.com/els/download-json?orderBy=updated-desc

Importer Log Excerpt:

INFO 2026-01-05 10:26:03.844748 UTC Successfully collected 65,599 advisories
INFO 2026-01-05 10:26:03.845009 UTC Step [collect_and_store_advisories] completed in 1373 seconds (22.9 minutes)
INFO 2026-01-05 10:26:03.845091 UTC Pipeline completed in 1373 seconds (22.9 minutes)

Signed-off-by: Sampurna Pyne <[email protected]>

ziadhany

@Samk1710 Thanks , see feedback and suggestions below

vulnerabilities/pipelines/v2_importers/tuxcare_importer.py

vulnerabilities/tests/pipelines/v2_importers/test_tuxcare_importer_v2.py

vulnerabilities/pipelines/v2_importers/tuxcare_importer.py

Signed-off-by: Sampurna Pyne <[email protected]>

Samk1710 · 2026-01-07T21:17:49Z

@ziadhany Thanks for your review.
I have updated the code as per your suggestion and feedback. Requesting a re-review. Thanks again!

ziadhany · 2026-01-08T22:30:40Z

vulnerabilities/pipelines/v2_importers/tuxcare_importer.py

+            summary = f"TuxCare advisory for {cve_id}"
+            if project_name:
+                summary += f" in {project_name}"
+            if os_name:


I think this is wrong. The OS name should be considered a qualifier.
Please look at https://github.com/package-url/purl-spec

I ran a small local script on the data source JSON file to find the unique OS names.

CentOS: 23778 Ubuntu: 13934 Oracle: 8190 AlmaLinux: 6562 Unknown: 4526 CloudLinux: 1934 RHEL: 1524 Debian: 944 TuxCare: 792 Alpine: 119

Idea is to map these with the appropriate PURLs. Will be implementing this and pushing the changes shortly.
Do let me know if any other approach is more suitable. Thanks for the correction.

Hey @ziadhany
I had a quick question: while looking through the importers I came across some parity with the qualifier field in PURL. I went with qualifiers["os"] = os_name. Was a little confused if it should be distro though. If you could kindly guide me on this!

@Samk1710 Yes, I think it should be distro.
I also think we should remove summary, it doesn’t make sense to me.

I think the purl should look like this:

pkg:generic/tuxcare/project_name@version?distro=os_name

Thanks for the clarification. I'll remove the summary, it is in fact redundant.

ziadhany · 2026-01-08T22:32:34Z

@Samk1710, could you please also fix the CI ?

…o add-tuxcare-importer

Signed-off-by: Sampurna Pyne <[email protected]>

…lnerablecode into add-tuxcare-importer

Samk1710 · 2026-01-10T00:01:17Z

Hey @ziadhany
I have updated the implementation as per your review and suggestion of os_name qualifier. Do let me know if it aligns with what you had in mind. Thanks !

Signed-off-by: Sampurna Pyne <[email protected]>

vulnerabilities/pipelines/v2_importers/tuxcare_importer.py

Signed-off-by: Sampurna Pyne <[email protected]>

Samk1710 · 2026-01-12T14:23:16Z

Hey @ziadhany
I have refactored the purl as per your suggestion and pushed. Thanks for the guidance :)

Signed-off-by: Sampurna Pyne <[email protected]>

Samk1710 · 2026-01-13T13:15:42Z

@Samk1710, could you please also fix the CI ?

Hey @ziadhany could you kindly run the checks. I have fixed the import ordering. Thanks.

ziadhany

@Samk1710 , The code looks good. I think we just need some refinement of the package URL and the affected and fixed versions.

ziadhany · 2026-01-16T13:48:48Z

vulnerabilities/pipelines/v2_importers/tuxcare_importer.py

+            if not cve_id or not cve_id.startswith("CVE-"):
+                continue


Please avoid silently skipping this

ziadhany · 2026-01-16T14:45:00Z

vulnerabilities/pipelines/v2_importers/tuxcare_importer.py

+
+        return PackageURL(
+            type="generic", namespace="tuxcare", name=project_name, qualifiers=qualifiers
+        )


@Samk1710 I think this purl is incorrect, sorry for the confusion.

I noticed that TuxCare provides security patches for Endless Lifecycle Support (ELS), delivering qualified security and selected bug-fix errata advisories across all architectures.

So, I think the correct way to do this is that we should create a mapping.

cve "CVE-2024-50006" os_name "Ubuntu 16.04 ELS" project_name "linux-hwe" version "4.15.0" score "4.7" severity "MEDIUM" status "Needs Triage"

pkg:deb/ubuntu/[email protected]?distro=ubuntu-16.04-els

For unknown OS, use generic.

ziadhany · 2026-01-16T14:51:53Z

vulnerabilities/pipelines/v2_importers/tuxcare_importer.py

+                    logger.warning(f"Failed to parse date {last_updated} for {cve_id}: {e}")
+
+            yield AdvisoryData(
+                advisory_id=advisory_id,


Advisory_id should be unique, so drop the old database and run the importer again to ensure there is no duplication

from vulnerabilities.models import AdvisoryV2 from django.db.models import Count duplicates = ( AdvisoryV2.objects .values('avid') .annotate(count=Count('id')) .filter(count__gt=1) ) len(duplicates)

Hey @ziadhany!

I've analyzed the data and found duplicate advisory IDs in the database. This happens because TuxCare structures their data with the same CVE ID across different OS distributions, packages, and versions - each record represents the same CVE but for a specific OS+package+version combination.

For example, CVE-2023-52922 appears in 17 different records:

{ "cve": "CVE-2023-52922", "os_name": "CloudLinux 7 ELS", "project_name": "squid", "version": "3.5.20", "status": "In Testing" } { "cve": "CVE-2023-52922", "os_name": "Oracle Linux 7 ELS", "project_name": "squid", "version": "3.5.20", "status": "In Testing" } { "cve": "CVE-2023-52922", "os_name": "CentOS 8.4 ELS", "project_name": "squid", "version": "4.11-4", "status": "Ignored" } { "cve": "CVE-2023-52922", "os_name": "CentOS 8.5 ELS", "project_name": "kernel", "version": "4.18.0", "score": "7.8", "severity": "HIGH", "status": "Released", "last_updated": "2025-05-21 01:43:28.677045" }

Workaround
-- use a composite advisory_id like {cve_id}-{normalized_os}-{project_name}-{version}
-- CVE-2023-52922-cloudlinux-7-els-squid-3.5.20 and CVE-2023-52922-oracle-linux-7-els-squid-3.5.20
-- add CVE_ID to aliases: ["CVE-2023-52922"]

This way each OS+package+version combination gets a unique advisory, the CVE remains searchable via aliases, and we avoid duplicates.

Does this approach work for you? Do share your suggestions.

Also, just a heads up - the TuxCare endpoint is currently returning a 500 error, it might take some time before I can run the importer and verify everything works as expected.

ziadhany · 2026-01-16T15:12:44Z

vulnerabilities/pipelines/v2_importers/tuxcare_importer.py

+                affected_version_range = None
+                if version:
+                    try:
+                        affected_version_range = GenericVersionRange.from_versions([version])
+                    except ValueError as e:
+                        logger.warning(f"Failed to parse version {version} for {cve_id}: {e}")


Why are we assuming that all versions are affected? According to my understanding, different versions can have different statuses:

- In Progress - In Testing - In Rollout - Needs Triage - Not Vulnerable - Already Fixed - Ignored

Add V2 Importer for Tuxcare

0bb18b5

Signed-off-by: Sampurna Pyne <[email protected]>

ziadhany self-requested a review January 5, 2026 10:22

ziadhany requested changes Jan 7, 2026

View reviewed changes

Refactor as per review

8039472

Signed-off-by: Sampurna Pyne <[email protected]>

Samk1710 requested a review from ziadhany January 7, 2026 21:18

ziadhany reviewed Jan 8, 2026

View reviewed changes

Samk1710 and others added 4 commits January 9, 2026 16:41

Merge branch 'main' into add-tuxcare-importer

bce8139

Merge branch 'main' of https://github.com/Samk1710/vulnerablecode int…

ea5bae5

…o add-tuxcare-importer

Refactor to PURL qualifier

83bb44d

Signed-off-by: Sampurna Pyne <[email protected]>

Merge branch 'add-tuxcare-importer' of https://github.com/Samk1710/vu…

d464ef9

…lnerablecode into add-tuxcare-importer

Samk1710 requested a review from ziadhany January 10, 2026 00:03

Codestyle fix

0a8456a

Signed-off-by: Sampurna Pyne <[email protected]>

ziadhany requested changes Jan 12, 2026

View reviewed changes

vulnerabilities/pipelines/v2_importers/tuxcare_importer.py Outdated Show resolved Hide resolved

Refactor PURL and fix type-hinting

663d5fd

Signed-off-by: Sampurna Pyne <[email protected]>

Samk1710 requested a review from ziadhany January 12, 2026 14:23

Fix import ordering

640e80f

Signed-off-by: Sampurna Pyne <[email protected]>

ziadhany requested changes Jan 16, 2026

View reviewed changes

Uh oh!

Add V2 Importer for Tuxcare advisories #2104

Are you sure you want to change the base?

Add V2 Importer for Tuxcare advisories #2104

Uh oh!

Conversation

Samk1710 commented Jan 4, 2026 • edited by ziadhany Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ziadhany left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Samk1710 commented Jan 7, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ziadhany Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ziadhany commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Samk1710 commented Jan 10, 2026

Uh oh!

Uh oh!

Samk1710 commented Jan 12, 2026

Uh oh!

Samk1710 commented Jan 13, 2026

Uh oh!

ziadhany left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Samk1710 commented Jan 4, 2026 •

edited by ziadhany

Loading

ziadhany Jan 12, 2026 •

edited

Loading

ziadhany commented Jan 8, 2026 •

edited

Loading