Greetings!
I have a script that processes the output of a vulnerability scanner. When I have a CVE identifier, I look up the CVSS base metrics from the NVD files (nvd.nist.gov).
Everything works just fine, but as I process thousands of records, I run out of memory, top shows an ever incrementing VSIZE...
The issue is in this block of code, as I can set the $cve_id to skip this else clause and the script trundles along happily.
I know that I am declaring a new "my parser=", etc. everytime, how can I make sure the data structure are deleted/torn down?</p
else {
# Take the CVE indentifier and get the CVSS vectors
# parse the CVE identifier to determine what data file to search
my @record_fields = split( /:/, $cve_id );
$cve_id = $record_fields[1];
$cve_id =~ s/^\s+//;
$cve_id =~ s/\s+$//;
my @id_fields = split( /-/, $cve_id );
my $year = $id_fields[1];
if ($year < 2003) {
$data_file = "$nvd_files/nvdcve-2.0-2002.xml";
}
else {
$data_file = "$nvd_files/nvdcve-2.0-" . $year . ".xml";
}
# Parse the data file:
my $cve_parser = XML::LibXML->new();
my $cve_doc = $cve_parser->parse_file( $data_file );
my $cve_xc = XML::LibXML::XPathContext->new( $cve_doc->documentEle
+ment() );
# Register the namespaces:
$cve_xc->registerNs( def => 'http://scap.nist.gov/schema/feed/vuln
+erability/2.0' );
$cve_xc->registerNs( vuln => 'http://scap.nist.gov/schema/vulnerab
+ility/0.4' );
$cve_xc->registerNs( cvss => 'http://scap.nist.gov/schema/cvss-v2/
+0.2' );
# Find the appropriate CVE entry in the data source:
for my $entry ($cve_xc->findnodes("/def:nvd/def:entry[\@id = '$cve
+_id']")) {
if (my ($metrics) = $cve_xc->findnodes('vuln:cvss/cvss:base_me
+trics', $entry)) {
$av = $cve_xc->find('cvss:access-vector', $metrics);
$ac = $cve_xc->find('cvss:access-complexity', $metrics);
$au = $cve_xc->find('cvss:authentication', $metrics);
$ci = $cve_xc->find('cvss:confidentiality-impact', $metric
+s);
$ii = $cve_xc->find('cvss:integrity-impact', $metrics);
$ai = $cve_xc->find('cvss:availability-impact', $metrics);
}
else {
$av = "";
$ac = "";
$au = "";
$ci = "";
$ii = "";
$ai = "";
}
}
}
As always, thanks for any and all help!
Scott