From 140a700b00c392e2b7bd75e2bf9b5079979d5e2d Mon Sep 17 00:00:00 2001
From: Giulia Naponiello <gnaponie@redhat.com>
Date: Oct 10 2019 07:54:33 +0000
Subject: Use SFM2 API for the impact and affected pkgs from CVE


The Bugzilla whitelist field was removed due to security reasons.
The security team introduced new API for Freshmaker to get the impact
of CVE and the list of components affected by the CVE.
This replaces the Bugzilla whitelist field completely.

Signed-off-by: Giulia Naponiello <gnaponie@redhat.com>

---

diff --git a/freshmaker/bugzilla.py b/freshmaker/bugzilla.py
deleted file mode 100644
index d626b80..0000000
--- a/freshmaker/bugzilla.py
+++ /dev/null
@@ -1,180 +0,0 @@
-# -*- coding: utf-8 -*-
-# Copyright (c) 2018  Red Hat, Inc.
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-#
-# Written by Jan Kaluza <jkaluza@redhat.com>
-#            Ralph Bean <rbean@redhat.com
-
-import requests
-
-from defusedxml import ElementTree
-from freshmaker import log, conf
-
-
-class BugzillaAPI(object):
-
-    # Ordered Threat severities.
-    THREAT_SEVERITIES = [
-        "low",
-        "moderate",
-        "important",
-        "critical",
-    ]
-
-    SEVERITY_MAPPING = {
-        # severity: impact
-        "low": "low",
-        "medium": "moderate",
-        "high": "important",
-        "critical": "critical",
-    }
-
-    def __init__(self, server_url=None):
-        """
-        Creates new BugzillaAPI instance.
-
-        :param str server_url: BugzillaAPI base URL.
-        """
-        if server_url is not None:
-            self.server_url = server_url.rstrip('/')
-        else:
-            self.server_url = conf.bugzilla_server_url.rstrip('/')
-
-    def query_bugzilla(self, cve):
-        """
-        Queries Bugzilla to find out infos about the cve, specifically
-        the list of major xml elements in the cve.
-        It queries show_bug.cgi?ctype=xml&id=$cve endpoint.
-
-        :param str cve: CVE, for example "CVE-2017-10268".
-        :rtype: list
-        :return: list of major xml elements.
-        """
-        log.debug("Querying bugzilla for %s", cve)
-        r = requests.get(
-            "%s/show_bug.cgi" % self.server_url,
-            params={"ctype": "xml", "id": cve})
-        r.raise_for_status()
-
-        # Parse
-        root = ElementTree.fromstring(r.text.encode('utf-8'))
-
-        # List the major xml elements
-        elements = list(list(root)[0])
-        return elements
-
-    def _get_cve_whiteboard(self, elements):
-        """
-        Returns the whiteboard dict about `cve` obtained from
-        show_bug.cgi?ctype=xml&id=$cve endpoint
-
-        :param str elements: list of major xml elements, returned by `query_bugzilla`.
-        :rtype: dict
-        :return: the status whiteboard of the bugzilla CVE.
-        """
-        # Extract the whiteboard string
-        whiteboard = [e.text for e in elements if e.tag == 'status_whiteboard']
-
-        # Handle missing and/or empty whiteboards
-        if not whiteboard:
-            return dict()
-        whiteboard = whiteboard[0]
-        if not whiteboard:
-            return dict()
-
-        # Convert the whiteboard to a dict, and return
-        return dict(entry.split('=', 1) for entry in whiteboard.split(','))
-
-    def fetch_cve_metadata(self, cve_list):
-        """
-        Fetches metadata about each CVE in `cve_list` and returns a tuple with
-        the name of highest severity rate and the affected packages (a dictionary
-        with product and pkg_name).
-        See `BugzillaAPI.THREAT_SEVERITIES` for list of possible severity rates.
-
-        :param list cve_list: List of strings with CVE names.
-        :rtype: str
-        :return: Tuple, the first element is the name of highest severity rate occuring
-        in CVEs from `cve_list`. The second element is a list of dicts, with "product"
-        and "pkg_name" of the affected packages.
-        """
-        max_rating = -1
-        elements = []
-        affected_pkgs = []
-        severity = None
-        for cve in cve_list:
-            try:
-                elements = self.query_bugzilla(cve)
-            except requests.exceptions.HTTPError as e:
-                if e.response.status_code == 404:
-                    log.warning(
-                        "CVE %s cannot be found in bugzilla, "
-                        "threat_severity unknown.  %s", cve, e.response.request.url)
-                    continue
-                raise
-            except IndexError:
-                log.warning(
-                    "CVE %s XML appears malformed.  No children?  "
-                    "threat_severity unknown.", cve)
-                continue
-
-            whiteboard = self._get_cve_whiteboard(elements)
-
-            # Since Aug 1st 2019 the "whiteboard" field was removed. This is kept for backward
-            # compatibility. But in case the field is not present, instead of "impact" we need to
-            # check "severity", and in this case we also won't filter any package from RHSA builds,
-            # and just use all the packages attached to the advisory.
-            if whiteboard:
-                try:
-                    severity = whiteboard["impact"].lower()
-                except KeyError:
-                    log.info(
-                        "CVE %s has no 'impact' in bugzilla whiteboard, "
-                        "we'll try to get it from the 'severity field'.", cve)
-
-                try:
-                    affected_pkgs.extend([
-                        {'product': pkg.split('/')[0], 'pkg_name': pkg.split('/')[-1]}
-                        for pkg, isaffected in whiteboard.items() if isaffected == 'affected'])
-                except IndexError:
-                    log.warning("CVE %s has no affected packages in bugzilla whiteboard", cve)
-
-            if not severity:
-                try:
-                    # extract the severity string
-                    severity = [e.text for e in elements if e.tag == 'bug_severity']
-                    severity = BugzillaAPI.SEVERITY_MAPPING[severity[0].lower()]
-                except (IndexError, ValueError):
-                    log.warning(
-                        "CVE %s has no 'severity' in bugzilla cve, "
-                        "threat_severity unknown.", cve)
-                    continue
-            try:
-                rating = BugzillaAPI.THREAT_SEVERITIES.index(severity)
-            except ValueError:
-                log.error("Unknown threat_severity '%s' for CVE %s",
-                          severity, cve)
-                continue
-
-            max_rating = max(max_rating, rating)
-
-        if max_rating == -1:
-            return (None, affected_pkgs)
-        return (BugzillaAPI.THREAT_SEVERITIES[max_rating], affected_pkgs)
diff --git a/freshmaker/config.py b/freshmaker/config.py
index 8183a5c..757acd5 100644
--- a/freshmaker/config.py
+++ b/freshmaker/config.py
@@ -226,10 +226,10 @@ class Config(object):
             'desc': 'Dict with base container "name-version" as key and URL '
                     'to extra .repo file to include in a rebuild',
         },
-        'bugzilla_server_url': {
+        'sfm2_api_url': {
             'type': str,
-            'default': 'https://bugzilla.redhat.com',
-            'desc': 'Server URL of BugzillaAPI.'},
+            'default': 'https://sfm2.prodsec.redhat.com',
+            'desc': 'SFM2 API URl'},
         'lightblue_server_url': {
             'type': str,
             'default': '',
diff --git a/freshmaker/errata.py b/freshmaker/errata.py
index fa1cf01..7098751 100644
--- a/freshmaker/errata.py
+++ b/freshmaker/errata.py
@@ -32,7 +32,7 @@ from freshmaker.events import (
     BrewSignRPMEvent, ErrataBaseEvent,
     FreshmakerManualRebuildEvent)
 from freshmaker import conf, log
-from freshmaker.bugzilla import BugzillaAPI
+from freshmaker.sfm2 import SFM2API
 from freshmaker.utils import retry
 
 
@@ -56,9 +56,9 @@ class ErrataAdvisory(object):
         self.cve_list = cve_list or []
         self.has_hightouch_bug = has_hightouch_bug
 
-        bugzilla = BugzillaAPI()
+        sfm2 = SFM2API()
 
-        self.highest_cve_severity, self.affected_pkgs = bugzilla.fetch_cve_metadata(self.cve_list)
+        self.highest_cve_severity, self.affected_pkgs = sfm2.fetch_cve_metadata(self.cve_list)
 
     @classmethod
     def from_advisory_id(cls, errata, errata_id):
diff --git a/freshmaker/sfm2.py b/freshmaker/sfm2.py
new file mode 100644
index 0000000..d9b6554
--- /dev/null
+++ b/freshmaker/sfm2.py
@@ -0,0 +1,126 @@
+# -*- coding: utf-8 -*-
+# Copyright (c) 2019  Red Hat, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+import requests
+
+from freshmaker import log, conf
+
+
+class SFM2API(object):
+
+    # Ordered Threat severities.
+    THREAT_SEVERITIES = [
+        "low",
+        "moderate",
+        "important",
+        "critical",
+    ]
+
+    def __init__(self, server_url=None):
+        """
+        Creates new SFM2API instance.
+
+        :param str server_url: SFM2API base URL.
+        """
+        if server_url is not None:
+            self.server_url = server_url.rstrip('/')
+        else:
+            self.server_url = conf.sfm2_api_url.rstrip('/')
+
+    def query_sfm2(self, cve):
+        """
+        Queries SFM2 to find out infos about the cve, specifically
+        the CVE impact and list of affected packages
+        It queries api/public/flaws?id=$cve&include_fields=affects,impact endpoint.
+
+        :param str cve: CVE, for example "CVE-2017-10268".
+        :rtype: list
+        :return: dict with two keys, "impact", and "affects". The first references
+        the impact of the CVE, and the second is a list of dicts representing packages
+        affected by the CVE.
+        """
+        log.debug("Querying SFM2 for %s", cve)
+        r = requests.get(
+            "%s/api/public/flaws" % self.server_url,
+            params={"include_fields": "affects,impact", "id": cve})
+        r.raise_for_status()
+
+        return r.json()[0]
+
+    def fetch_cve_metadata(self, cve_list):
+        """
+        Fetches metadata about each CVE in `cve_list` and returns a tuple with
+        the name of highest severity rate and the affected packages (a dictionary
+        with product and pkg_name).
+        See `SFM2API.THREAT_SEVERITIES` for list of possible severity rates.
+
+        :param list cve_list: List of strings with CVE names.
+        :rtype: str
+        :return: Tuple, the first element is the name of highest severity rate occuring
+        in CVEs from `cve_list`. The second element is a list of dicts, with "product"
+        and "pkg_name" of the affected packages.
+        """
+        max_rating = -1
+        elements = []
+        affected_pkgs = []
+        severity = None
+        for cve in cve_list:
+            try:
+                elements = self.query_sfm2(cve)
+            except requests.exceptions.HTTPError as e:
+                if e.response.status_code == 400:
+                    log.warning(
+                        "The request for the CVE %s to the SFM2 API seems wrong, "
+                        "impact and affected packages unknown. %s", cve, e.response.request.url)
+                    continue
+                if e.response.status_code == 500:
+                    log.warning(
+                        "Some error occurred looking forCVE %s with SFM2 API, "
+                        "impact and affected packages unknown. %s", cve, e.response.request.url)
+                    continue
+                raise
+
+            try:
+                severity = elements['impact']
+            except (IndexError, KeyError):
+                log.warning("Some error occured looking for impact for CVE %s using SFM2 API", cve)
+
+            try:
+                affected_pkgs.extend([
+                    {'product': item['ps_module'], 'pkg_name': item['ps_component']}
+                    for item in elements['affects'] if (
+                        item['affected'] != "notaffected" and
+                        item['resolution'] not in ["wontfix", "ooss"])])
+            except (KeyError, IndexError):
+                log.exception("Some error occured looking for affected packages for CVE %s using SFM2 API", cve)
+
+            try:
+                rating = SFM2API.THREAT_SEVERITIES.index(severity)
+            except ValueError:
+                log.error("Unknown threat_severity '%s' for CVE %s",
+                          severity, cve)
+                continue
+
+            max_rating = max(max_rating, rating)
+
+        if max_rating == -1:
+            return (None, affected_pkgs)
+        return (SFM2API.THREAT_SEVERITIES[max_rating], affected_pkgs)
diff --git a/tests/test_bugzilla.py b/tests/test_bugzilla.py
deleted file mode 100644
index ed84e82..0000000
--- a/tests/test_bugzilla.py
+++ /dev/null
@@ -1,137 +0,0 @@
-# -*- coding: utf-8 -*-
-#
-# Copyright (c) 2017  Red Hat, Inc.
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in all
-# copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-
-from mock import patch
-
-from freshmaker.bugzilla import BugzillaAPI
-from tests import helpers
-
-
-class MockResponse(object):
-    def __init__(self, text):
-        self.text = text
-
-    def raise_for_status(self):
-        pass
-
-
-xml_with_status = """
-<bugzilla><bug>
-<status_whiteboard>impact={impact}</status_whiteboard>
-</bug></bugzilla>
-"""
-
-xml_with_empty_status = """
-<bugzilla><bug>
-<status_whiteboard></status_whiteboard>
-</bug></bugzilla>
-"""
-
-xml_with_affected_pkgs = """
-<bugzilla><bug>
-<status_whiteboard>impact={impact},{packages}</status_whiteboard>
-</bug></bugzilla>
-"""
-
-xml_without_status = """<bugzilla><bug></bug></bugzilla>"""
-xml_with_empty_bug = """<bugzilla></bugzilla>"""
-
-xml_with_severity = """
-<bugzilla><bug>
-<bug_severity>{severity}</bug_severity>
-</bug></bugzilla>
-"""
-
-
-class TestBugzillaAPI(helpers.FreshmakerTestCase):
-
-    @patch("freshmaker.bugzilla.requests.get")
-    def test_fetch_cve_metadata(self, requests_get):
-        impacts = ["Low", "Moderate", "Important", "Critical"]
-        bugzilla = BugzillaAPI()
-        for num_of_cves in range(1, 4):
-            requests_get.side_effect = [
-                MockResponse(xml_with_status.format(impact=impact))
-                for impact in impacts]
-            highest_cve_severity, _ = bugzilla.fetch_cve_metadata(["CVE-1"] * num_of_cves)
-            self.assertEqual(highest_cve_severity, impacts[num_of_cves - 1].lower())
-
-    @patch("freshmaker.bugzilla.requests.get")
-    def test_fetch_cve_metadata_empty_list(self, requests_get):
-        bugzilla = BugzillaAPI()
-        highest_cve_severity, _ = bugzilla.fetch_cve_metadata([])
-        self.assertEqual(highest_cve_severity, None)
-        requests_get.assert_not_called()
-
-    @patch("freshmaker.bugzilla.requests.get")
-    def test_fetch_cve_metadata_no_status(self, requests_get):
-        bugzilla = BugzillaAPI()
-        requests_get.return_value = MockResponse(xml_without_status)
-        highest_cve_severity, _ = bugzilla.fetch_cve_metadata(["CVE-1"])
-        self.assertEqual(highest_cve_severity, None)
-
-    @patch("freshmaker.bugzilla.requests.get")
-    def test_fetch_cve_metadata_empty_status(self, requests_get):
-        bugzilla = BugzillaAPI()
-        requests_get.return_value = MockResponse(xml_with_empty_status)
-        highest_cve_severity, _ = bugzilla.fetch_cve_metadata(["CVE-1"])
-        self.assertEqual(highest_cve_severity, None)
-
-    @patch("freshmaker.bugzilla.requests.get")
-    def test_fetch_cve_metadata_empty_bug(self, requests_get):
-        bugzilla = BugzillaAPI()
-        requests_get.return_value = MockResponse(xml_with_empty_bug)
-        highest_cve_severity, _ = bugzilla.fetch_cve_metadata(["CVE-1"])
-        self.assertEqual(highest_cve_severity, None)
-
-    @patch("freshmaker.bugzilla.requests.get")
-    def test_fetch_cve_metadata_unknown_impact(self, requests_get):
-        impacts = ["Low", "unknown"]
-        requests_get.side_effect = [
-            MockResponse(xml_with_status.format(impact=impact))
-            for impact in impacts]
-        bugzilla = BugzillaAPI()
-        highest_cve_severity, _ = bugzilla.fetch_cve_metadata(["CVE-1", "CVE-2"])
-        self.assertEqual(highest_cve_severity, "low")
-
-    @patch("freshmaker.bugzilla.requests.get")
-    def test_fetch_cve_metadata_with_affected_pkgs(self, requests_get):
-        impacts = ["Low"]
-        packages = "openshift-enterprise-3.11/atomic-openshift=affected,openshift-enterprise-4.1/openshift=notaffected"
-        requests_get.side_effect = [
-            MockResponse(xml_with_affected_pkgs.format(impact=impact, packages=packages))
-            for impact in impacts]
-        bugzilla = BugzillaAPI()
-        highest_cve_severity, affected_pkgs = bugzilla.fetch_cve_metadata(["CVE-1"])
-        self.assertEqual(highest_cve_severity, "low")
-        self.assertEqual(affected_pkgs[0]['product'], 'openshift-enterprise-3.11')
-        self.assertEqual(affected_pkgs[0]['pkg_name'], 'atomic-openshift')
-
-    @patch("freshmaker.bugzilla.requests.get")
-    def test_fetch_cve_metadata_with_severity(self, requests_get):
-        severities = ["low", "medium", "high", "critical"]
-        impacts = ["low", "moderate", "important", "critical"]
-        bugzilla = BugzillaAPI()
-        for i in range(0, 4):
-            requests_get.side_effect = [MockResponse(xml_with_severity.format(severity=severities[i]))]
-            highest_cve_severity, _ = bugzilla.fetch_cve_metadata(["CVE-1"])
-            self.assertEqual(highest_cve_severity, impacts[i])
diff --git a/tests/test_errata.py b/tests/test_errata.py
index 148b723..1e1dbc4 100644
--- a/tests/test_errata.py
+++ b/tests/test_errata.py
@@ -162,7 +162,7 @@ class TestErrata(helpers.FreshmakerTestCase):
         self.errata = Errata("https://localhost/")
 
         self.patcher = helpers.Patcher(
-            'freshmaker.errata.BugzillaAPI.')
+            'freshmaker.errata.SFM2API.')
         self.patcher.patch("fetch_cve_metadata",
                            return_value=["moderate", {}])
 
diff --git a/tests/test_sfm2.py b/tests/test_sfm2.py
new file mode 100644
index 0000000..d0e322c
--- /dev/null
+++ b/tests/test_sfm2.py
@@ -0,0 +1,162 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2017  Red Hat, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+from mock import patch, MagicMock
+
+from freshmaker.sfm2 import SFM2API
+from tests import helpers
+from requests.exceptions import HTTPError
+
+
+class MockResponse(object):
+    def __init__(self, text):
+        self.text = text
+
+    def json(self):
+        return self.text
+
+    def raise_for_status(self):
+        pass
+
+
+class TestSFM2API(helpers.FreshmakerTestCase):
+
+    @patch("freshmaker.sfm2.requests.get")
+    def test_fetch_cve_metadata(self, requests_get):
+        impacts = ["low", "moderate", "important", "critical"]
+        sfm2 = SFM2API()
+        for num_of_cves in range(1, 4):
+            requests_get.side_effect = [MockResponse([{'affects': [], 'impact': impacts[num_of_cves - 1]}])]
+            highest_cve_severity, _ = sfm2.fetch_cve_metadata(["CVE-%s" % num_of_cves])
+            self.assertEqual(highest_cve_severity, impacts[num_of_cves - 1].lower())
+
+    @patch("freshmaker.sfm2.requests.get")
+    def test_fetch_cve_metadata_empty_list(self, requests_get):
+        sfm2 = SFM2API()
+        highest_cve_severity, _ = sfm2.fetch_cve_metadata([])
+        self.assertEqual(highest_cve_severity, None)
+        requests_get.assert_not_called()
+
+    @patch("freshmaker.sfm2.requests.get")
+    def test_fetch_cve_metadata_empty_affects_and_impact(self, requests_get):
+        sfm2 = SFM2API()
+        requests_get.return_value = MockResponse([{'affects': [], 'impact': None}])
+        highest_cve_severity, affected_pkgs = sfm2.fetch_cve_metadata(["CVE-1"])
+        self.assertEqual(highest_cve_severity, None)
+        self.assertEqual(affected_pkgs, [])
+
+    @patch("freshmaker.sfm2.requests.get")
+    def test_fetch_cve_metadata_unspecified_impact(self, requests_get):
+        impacts = ["low", "unspecified", "none"]
+        requests_get.side_effect = [MockResponse([{'affects': [], 'impact': impact}]) for impact in impacts]
+        sfm2 = SFM2API()
+        highest_cve_severity, _ = sfm2.fetch_cve_metadata(["CVE-1", "CVE-2"])
+        self.assertEqual(highest_cve_severity, "low")
+
+    @patch("freshmaker.sfm2.requests.get")
+    def test_fetch_cve_metadata_unspecified_impact_only(self, requests_get):
+        impacts = ["unspecified", "none"]
+        requests_get.side_effect = [MockResponse([{'affects': [], 'impact': impact}]) for impact in impacts]
+        sfm2 = SFM2API()
+        highest_cve_severity, _ = sfm2.fetch_cve_metadata(["CVE-1", "CVE-2"])
+        self.assertEqual(highest_cve_severity, None)
+
+    @patch("freshmaker.sfm2.requests.get")
+    def test_fetch_cve_metadata_with_affected_pkgs(self, requests_get):
+        response_impact_and_affected_pkgs = [{'affects': [{
+            'affected': 'affected',
+            'cvss2': None,
+            'cvss3': None,
+            'impact': None,
+            'ps_component': 'openssl',
+            'ps_module': 'rhel-6',
+            'resolution': 'fix'
+        }, {
+            'affected': 'affected',
+            'cvss2': None,
+            'cvss3': None,
+            'impact': None,
+            'ps_component': 'openssl',
+            'ps_module': 'rhel-7.1.z',
+            'resolution': 'fix'
+        }, {
+            'affected': None,
+            'cvss2': None,
+            'cvss3': None,
+            'impact': None,
+            'ps_component': 'openssl097a',
+            'ps_module': 'rhel-5',
+            'resolution': 'wontfix'
+        }, {
+            'affected': 'notaffected',
+            'cvss2': None,
+            'cvss3': None,
+            'impact': None,
+            'ps_component': 'nss',
+            'ps_module': 'rhel-5',
+            'resolution': None
+        }], 'impact': 'important'}]
+        requests_get.side_effect = [MockResponse(response_impact_and_affected_pkgs)]
+        sfm2 = SFM2API()
+        highest_cve_severity, affected_pkgs = sfm2.fetch_cve_metadata(["CVE-1"])
+        self.assertEqual(highest_cve_severity, "important")
+        self.assertEqual(affected_pkgs[0]['product'], 'rhel-6')
+        self.assertEqual(affected_pkgs[0]['pkg_name'], 'openssl')
+        self.assertEqual(affected_pkgs[1]['product'], 'rhel-7.1.z')
+        self.assertEqual(len(affected_pkgs), 2)
+
+    @patch("freshmaker.sfm2.requests.get")
+    def test_fetch_cve_metadata_with_not_affected_pkgs(self, requests_get):
+        response_impact_and_affected_pkgs = [{'affects': [{
+            'affected': None,
+            'cvss2': None,
+            'cvss3': None,
+            'impact': None,
+            'ps_component': 'openssl097a',
+            'ps_module': 'rhel-5',
+            'resolution': 'wontfix'
+        }, {
+            'affected': 'notaffected',
+            'cvss2': None,
+            'cvss3': None,
+            'impact': None,
+            'ps_component': 'nss',
+            'ps_module': 'rhel-5',
+            'resolution': None
+        }], 'impact': 'important'}]
+        requests_get.side_effect = [MockResponse(response_impact_and_affected_pkgs)]
+        sfm2 = SFM2API()
+        highest_cve_severity, affected_pkgs = sfm2.fetch_cve_metadata(["CVE-1"])
+        self.assertEqual(highest_cve_severity, "important")
+        self.assertEqual(affected_pkgs, [])
+
+    @patch("freshmaker.sfm2.requests.get")
+    def test_fetch_cve_metadata_with_error(self, requests_get):
+        for status_code in [400, 500]:
+            error_response = MagicMock()
+            error_response.status_code = status_code
+            error_response.raise_for_status.side_effect = HTTPError(
+                "Expected exception", response=error_response)
+            sfm2 = SFM2API()
+            highest_cve_severity, affected_pkgs = sfm2.fetch_cve_metadata(["CVE-1"])
+            self.assertEqual(highest_cve_severity, None)
+            self.assertEqual(affected_pkgs, [])