cve-oldest.pl

#!/usr/bin/perl

# NOTE:
#
# This accesses the web site git repo to find the 'vuln.pm' file with the
# proper meta-data!
#
# Shows the number of days each CVE was present in a curl release before
# fixed.
#

my $webroot = $ARGV[0] || "../curl-www";

require "$webroot/docs/vuln.pm";
$csv = "$webroot/docs/releases.csv";

sub relinfo {
    open(C, "<$csv");
    while(<C>) {
        chomp;
        my ($index, $version, $vulns, $date, $since, $ddays, $adays, $dbugs, $abugs,
            $dchanges, $achanges) = split(';', $_);
        $release{$version}=$date;
        push @inorder, $version;
    }
    close(C);
}

relinfo();

sub deltadays {
    my ($prev, $date) = @_;
    my $psecs = `date +%s -d "$prev"`;
    my $secs = `date +%s -d "$date"`;
    return int(($secs-$psecs)/86400);
}

sub conv {
    my ($days) = @_;
    return $days / 365.25;
}

for(@vuln) {
    my ($id, $start, $stop, $desc, $cve, $date, $rdate, $cwe, $award,
        $area, $cissue, $where, $severity, $issue)=split('\|');
    my $delta = deltadays($release{$start}, $date);

    $age{$cve} = $delta;
}

my $index = 1;
for my $cve (sort {$age{$b} <=> $age{$a}} keys %age) {
    printf "%u;%s;%.2f\n", $index++, $cve, conv($age{$cve});
    if($index == 21) {
        last;
    }
}