Add weaknesses information from NVD

[hasnatbashir]

1. Why do we have weaknesses related fields commented out?
2. Are there any plans to add this information in near future?
3. Can I open a PR for this?

Code Reference

[willmurphyscode]

Thanks for the request @hasnatbashir! I don't know why that was commented out. I've added marked this issue for discussion at our weekly livestream, and we will try to give an answer then. My guess is that it was done to reduce the size of the grype database, but we've recently switched to a more compression friendly schema and a better compression algorithm, so that might not be relevant anymore.

Discussion topic: Should we add CWE back into the matches? If so, how can we surface this in the Grype UI?

[hasnatbashir]

Thanks @willmurphyscode. Can you please share the exact time the stream starts? Its on Thursdays, right?

[willmurphyscode]

Hi @hasnatbashir here are all the details: https://anchorecommunity.discourse.group/t/august-28th-open-source-gardening-live-stream/546?u=willmurphy

[willmurphyscode]

Hi @hasnatbashir, we discussed this on our livestream! In case you missed it, here's a TL;DR:

1. Yes, please feel free to add this back in - please make sure that the upstream records are still the shape the code expects
2. You'll need to update v6 transformer to get this to have any effect: https://github.com/anchore/grype-db/blob/main/pkg/process/v6/transformers/nvd/transform.go#L39

We want this to populate a new model, much like how KEV was implemented. Some useful PRs:

1. https://github.com/anchore/grype-db/pull/507/files
2. https://github.com/anchore/grype/pull/2464/files#diff-42d5e6f9add8ffacdecfbb01998569a837d4b96015c928fcfb3211ce87152d80R743

Feel free to post partial work, ask for help, etc. Thanks for taking a look at this!

[hasnatbashir]

Hi @willmurphyscode, thanks for the clarification.

I just need the CWE IDs against the vulnerabilities so my implementation approach would be straightforward,
add a field for the list of CWE IDs to VulnerabilityBlob object in grype and then parse the CWE IDs from NVD.

Let me know if we need to make some additional changes or if the schema should be aligned with the upstream data source i.e NVD.

Relevant PRs:

• feat: add CWEs field to VulnerabilityBlob to support weaknesses data from NVD grype#2904
• add cwe ids from nvd weaknesses data #660