Question

NIST最近以JSON格式发布了所有CVE数据，我正在尝试解析它以添加到MySQL数据库，以便我可以将我的安全性结果与NIST显示的进行比较。

这些数据对解析非常困惑，因为有很多嵌套，包含了一些列表。

以下是JSON的片段。

{
    "CVE_data_type": "CVE",
    "CVE_data_format": "MITRE",
    "CVE_data_version": "4.0",
    "CVE_data_numberOfCVEs": "600",
    "CVE_data_timestamp": "Fri Apr 28 16:00:10 EDT 2017",
    "CVE_Items": [
        {
            "CVE_data_meta": {
                "CVE_ID": "CVE-2007-6761"
            },
            "CVE_affects": {
                "CVE_vendor": {
                    "CVE_data_version": "4.0",
                    "CVE_vendor_data": [
                        {
                            "CVE_vendor_name": "linux",
                            "CVE_product": {
                                "CVE_product_data": [
                                    {
                                        "CVE_data_version": "4.0",
                                        "CVE_product_name": "linux_kernel",
                                        "CVE_version": {
                                            "CVE_version_data": [
                                                {
                                                    "CVE_version_value": "2.6.23",
                                                    "CVE_version_affected": "<="
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        }
                    ]
                }
            },
            "CVE_configurations": {
                "CVE_data_version": "4.0",
                "CVE_configuration_data": [
                    {
                        "operator": "OR",
                        "cpe": [
                            {
                                "vulnerable": true,
                                "previousVersions": true,
                                "cpeMatchString": "cpe:/o:linux:linux_kernel:2.6.23",
                                "cpe23Uri": "cpe:2.3:o:linux:linux_kernel:2.6.23:*:*:*:*:*:*:*"
                            }
                        ]
                    }
                ]
            },
            "CVE_description": {
                "CVE_data_version": "4.0",
                "CVE_description_data": [
                    {
                        "lang": "en",
                        "value": "drivers/media/video/videobuf-vmalloc.c in the Linux kernel before 2.6.24 does not initialize videobuf_mapping data structures, which allows local users to trigger an incorrect count value and videobuf leak via unspecified vectors, a different vulnerability than CVE-2010-5321."
                    }
                ]
            },
            "CVE_references": {
                "CVE_data_version": "4.0",
                "CVE_reference_data": [
                    {
                        "url": "http://www.linuxgrill.com/anonymous/kernel/v2.6/ChangeLog-2.6.24",
                        "name": "CONFIRM",
                        "publish_date": "04/24/2017"
                    },
                    {
                        "url": "http://www.securityfocus.com/bid/98001",
                        "name": "BID",
                        "publish_date": "04/26/2017"
                    },
                    {
                        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=827340",
                        "name": "MISC",
                        "publish_date": "04/24/2017"
                    },
                    {
                        "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0b29669c065f60501e7289e1950fa2a618962358",
                        "name": "CONFIRM",
                        "publish_date": "04/24/2017"
                    },
                    {
                        "url": "https://github.com/torvalds/linux/commit/0b29669c065f60501e7289e1950fa2a618962358",
                        "name": "CONFIRM",
                        "publish_date": "04/24/2017"
                    }
                ]
            },
            "CVE_impact": {
                "CVE_impact_cvssv2": {
                    "bm": {
                        "av": "LOCAL",
                        "ac": "LOW",
                        "au": "NONE",
                        "c": "PARTIAL",
                        "i": "PARTIAL",
                        "a": "PARTIAL",
                        "score": "4.6"
                    }
                },
                "CVE_impact_cvssv3": {
                    "bm": {
                        "av": "LOCAL",
                        "ac": "LOW",
                        "pr": "LOW",
                        "ui": "NONE",
                        "scope": "UNCHANGED",
                        "c": "HIGH",
                        "i": "HIGH",
                        "a": "HIGH",
                        "score": "7.8"
                    }
                }
            },
            "CVE_problemtype": {
                "CVE_data_version": "4.0",
                "CVE_problemtype_data": [
                    {
                        "description": [
                            {
                                "lang": "en",
                                "value": "CWE-119"
                            }
                        ]
                    }
                ]
            }
        }
    ]
}

当我尝试解析它以获取我想要的信息时，我遇到了错误。这是代码测试。

import json

with open('/tmp/nvdcve-1.0-recent.json') as data_file:
    cve_data = json.load(data_file)

product_list = []

for data_list in cve_data["CVE_Items"]:
    for cve_tag,cve_id in data_list["CVE_data_meta"].items():
        cve = str(cve_id)

    for vendor_data in data_list["CVE_affects"]["CVE_vendor"]["CVE_vendor_data"]["CVE_product"]:
        for data_version,product_name,version_set in vendor_data["CVE_product_data"].items():
            print(product_name)

错误

TypeError                                 Traceback (most recent call last)
<ipython-input-10-81b0239327c1> in <module>()
     10         cve = str(cve_id)
     11
---> 12     for vendor_data in data_list["CVE_affects"]["CVE_vendor"]["CVE_vendor_data"]["CVE_product"]:
     13         for data_version,product_name,version_set in vendor_data["CVE_product_data"].items():
     14             print data_version

TypeError: list indices must be integers, not str

这让我感到困惑，因为巢内有巢，并且在巢内有列表。我很难弄清楚如何获得这些超级嵌套信息。

Answer 1

我感觉到你的痛苦，但经过仔细检查后，“CVE_vendor_data”不是字典，而是字典列表。注意冒号后面的“[]”。这就是为什么它需要整数来索引列表。 “CVE_product_data”也是如此。它也是一个词典列表。

Python解析大型JSON嵌套和列表 - 字符串索引必须是整数

1 个答案: