Design: Oracle CPU CSAF Processor

Overview

Discovers Oracle Critical Patch Update (CPU) bulletins (quarterly: Jan/Apr/Jul/Oct), fetches each CPU’s CSAF 2.0 JSON document plus per-bug HTML page for free-text enrichment, and writes one CVEMetadata row per vulnerability under source="oracle" keyed by OSA-{bugId}. Stages CRIT candidate envelopes per (cveID × ServiceMatch × CSAF product_status branch) for Oracle Cloud (OCI) and Oracle SaaS services. On-prem Oracle products (Database, WebLogic, Java SE) are stored but skipped at the CRIT stage — CRIT scope is cloud-resource attribution only.

Source identifier: oracle Data type: csaf (CSAF 2.0 JSON + per-bug HTML enrichment) ECS task name: go-oracle-cpu-csaf-processor Schedule: Weekly Sunday 14:00 UTC (cron(0 14 ? * SUN *)) Pattern: B — batch (per-CPU, multiple vulnerabilities per CSAF document) Phase: 1.5

CRIT staging is off in ECS. --emit-crit defaults to false in the binary (main.go:53) and the task definition’s command is ["/app/oracle-cpu-csaf-processor"] with no flags (terraform/go-schedules.tf, module "oracle_cpu_csaf_processor"). The scheduled weekly run therefore ingests CVEMetadata only — every CRIT envelope in production came from a manual just go-oracle-cpu-csaf-backfill (whose recipe defaults EMIT_CRIT=true) or from crit-inference-processor. scripts/task-manager.toml advertises emit-crit with default = "true", which describes the justfile recipe, not the schedule.

Flags

A soft deadline is applied only when EXPECTED_DURATION_MINUTES is set: softDeadline = now + (mins − 10) and the CPU loop breaks at softDeadline − 5 min (main.go:71-72, main.go:145), so the effective window is mins − 15. Local backfills carry no deadline.

Data Source

CPU index

Oracle publishes CPUs at predictable URLs:

• HTML index: https://www.oracle.com/security-alerts/cpu{month}{year}.html
• CSAF JSON: https://www.oracle.com/security-alerts/cpu{month}{year}/oracle-cpu-{month}{year}-csaf.json

CPUs older than April 2022 are HTML-only (CSAF era began with cpuapr2022). For pre-CSAF CPUs the processor falls back to extracting CVE-* IDs from the HTML and writing minimal CVEMetadata rows under source="oracle" (no aliases, no metrics, no descriptions, no CRIT) — the row’s value is the existence record + sourceFileHash for downstream cross-correlation.

CSAF document shape

{
  "document": {
    "tracking": {
      "id": "CPU-2026-04",
      "current_release_date": "2026-04-15T20:00:00Z",
      "initial_release_date": "2026-04-15T20:00:00Z"
    },
    "title": "Oracle Critical Patch Update Advisory - April 2026",
    "publisher": {"category": "vendor", "name": "Oracle"}
  },
  "product_tree": {
    "branches": [
      {
        "category": "product_family",
        "name": "Oracle Cloud Infrastructure",
        "branches": [{"category": "product_name", "name": "Oracle Cloud Infrastructure Compute", "product": {"product_id": "oci-compute", "name": "OCI Compute"}}]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12345",
      "title": "Vulnerability in OCI Compute",
      "ids": [{"system_name": "Oracle Bug ID", "text": "37123456"}],
      "scores": [{"cvss_v3": {"vector_string": "CVSS:3.1/AV:N/...", "base_score": 8.1, "base_severity": "HIGH"}}],
      "notes": [{"category": "description", "text": "..."}],
      "cwes": [{"id": "CWE-79", "name": "Cross-site Scripting"}],
      "product_status": {
        "known_affected": ["oci-compute"],
        "fixed": []
      },
      "remediations": [
        {"category": "vendor_fix", "details": "Apply the April 2026 CPU.", "product_ids": ["oci-compute"]}
      ],
      "references": [{"url": "https://www.oracle.com/...", "category": "external"}]
    }
  ]
}

Per-vulnerability splitting: each vulnerabilities[i] becomes one CVEMetadata row under source="oracle" keyed by OSA-{bugId} (where bugId is the first ids[] entry whose system_name == "Oracle Bug ID").

Per-bug HTML enrichment

The CPU’s HTML index page carries free-text “Notes” / “Justification” cells per bug ID. The processor extracts:

• Justification — VEX-equivalent narrative.
• AdvisoryURL — {cpuHTMLURL}#{bugId} anchor.
• PatchedVersions, AffectedVersions, free-text Notes.

This data enriches the description rows (the CSAF doesn’t carry the same narrative).

Architecture / Data Flow

Source → Database Mappings

CVEMetadata (per-vulnerability path)

CVEMetadata (HTML-only fallback path, pre-2022 CPUs)

No aliases / metrics / descriptions / CRIT for the HTML-only path. storeOracleHTMLOnly also supplies no DatePublished, so every row on this path lands with datePublished = 0 (1 115 such rows in production as of 2026-08). Reachable only when --from-year is lowered below 2022.

Rows this processor does not write

Deliberate gaps, recorded here because their absence is easy to mistake for a bug:

• rawDataJSON is never populated. writeOracleVuln omits the column entirely (store.go:83-92), so all source='oracle' rows have rawDataJSON IS NULL. The CSAF bytes live only in S3, once per CPU.
• No CVEAffected / affectedVendor / affectedProduct. The product tree is walked for CRIT service resolution only; nothing is projected into the affected tables, so affectedProduct IS NULL on every oracle row.
• No Artifact / Link rows, and therefore no CVEMetadata.fileLinkId — the S3 archive is a bare PutObject.

Alias-minted placeholder rows

db.InsertAliases creates a shell CVEMetadata row for any alias target that does not already exist, under the aliased source. Because R13 emits OSA-{otherBugId} aliases for every additional bug id on a vulnerability, and those secondary bug ids are usually not the FirstBugID of any vulnerability, they become content-free source='oracle' rows: dataVersion='5.1', no title, datePublished = 0. Production holds 3 253 of these against 4 705 real CSAF-era rows — 36 % of the oracle footprint.

CVEAlias

For each vulnerabilities[i]:

• The cve field becomes the canonical CVE alias.
• Every other Oracle Bug ID referenced by the vuln (AllBugIDs(v) minus the primary bugID) gets prefixed with OSA- and added.

db.InsertAliases(ctx, tx, osaID, "oracle", aliasIDs, slogNop()) — InsertAliases canonicalises edge direction (CVE primary, OSA alias).

CVEReference

• Primary advisory ref: {cpuHTMLURL}#{bugId} with type advisory.
• Every URL in vulnerabilities[i].references[] (external, self) added with the original category value.

CVEDescription

• Each vulnerabilities[i].notes[] entry where category ∈ {description, summary, details} → one row with containerType="cna", lang="en".
• HTML Justification cell (when present) → one extra row prefixed "Oracle CPU notes: ".

CVEMetric

For each vulnerabilities[i].scores[]:

• cvss_v3 (when vector_string != "") → metricType="cvssV3_1".
• cvss_v2 (when vector_string != "") → metricType="cvssV2_0".

CVEProblemType

For each vulnerabilities[i].cwes[]:

• cweID = c.ID, description = c.Name, descriptionType="CWE".

S3 archive

oracle/files/{cpuName}/csaf.json

Per-CPU not per-vulnerability — saves S3 write count (one CSAF doc covers many vulns).

Service Mapping

service_map.go resolves Oracle SaaS / OCI / on-prem product mentions in product_tree branches.

On-prem detection (filtered out of CRIT)

onPremHints — when ANY product name matches one of these, seenOnPrem=true. CVEMetadata still lands; CRIT is suppressed:

• “oracle database 19c”, “oracle database 21c”, “oracle database 23c”
• “oracle weblogic server”
• “oracle java se”, “oracle jdk”, “oracle jre”
• “oracle solaris”
• “oracle linux”
• “myql server” (on-prem MySQL)
• “oracle berkeley db”

Cloud / SaaS resolution (60+ synonyms)

Extended-dict layer (internal/critutil/dictionaries/extended/oracle.json): 13 entries with template_format=oracle_ocid.

Resolve returns

matches []ServiceMatch
hasCloud bool       // at least one cloud match found
seenOnPrem bool     // at least one on-prem hint seen

When hasCloud=false && seenOnPrem=true, the producer logs "crit skipped: on-prem Oracle product" and stores no CRIT envelope. When neither is true, the producer logs "crit skipped: unmapped product" (extended-dict gap).

Business Rules

Discovery (index.go:DiscoverCPUs)

CPU processing (main.go:processCPU)

CSAF parsing (csaf.go)

Storage (store.go:writeOracleVuln)

Service mapping (service_map.go:Resolve)

CRIT mapper (crit_mapper.go:mapOracleToCRIT)

Coupling rules

• R30 automatic ⇒ provider_only.
• R31 existing_deployments_remain_vulnerable = !(provider_only && automatic).

Drain (main.go)

• R32 Drain skipped on CRIT_DISABLE_INPROCESS_DRAIN.
• R33 4 workers.

Verification Queries

-- OSA-prefixed primary keys
SELECT count(*) FROM "CVEMetadata" WHERE source='oracle' AND "cveId" LIKE 'OSA-%';

-- HTML-only fallback rows (pre-2022 CPUs)
SELECT count(*) FROM "CVEMetadata" WHERE source='oracle' AND "dataVersion"='html-1.0';

-- CVE alias edges
SELECT count(*) FROM "CVEAlias"
 WHERE "discoveredFrom"='oracle' AND "primaryCveId" LIKE 'CVE-%';

-- Service distribution — should be Oracle Cloud / SaaS only (on-prem skipped)
SELECT service, count(*) FROM "CritRecord"
 WHERE provider='oracle' GROUP BY 1 ORDER BY 2 DESC;

-- No on-prem leakage (e.g. service='database' for on-prem Database)
-- on-prem 'compute' / 'database' should be 0 for OSA-* with CRIT
SELECT count(*) FROM "CritRecord"
 WHERE provider='oracle' AND service IN ('database')
   AND "critJSON"->'evidence'->>'on-prem' IS NOT NULL;

-- Pending should be empty
SELECT "processingStatus", count(*) FROM "S3QueueObject"
 WHERE source='oracle-cpu-csaf-processor' GROUP BY 1;

Risk Surface

S3 Persistence

• Archive path: oracle/files/{sha256}/{filename} ✓
• Quarantine path: failed-feeds/oracle-cpu-csaf-processor/{YYYY-MM-DD}/{reason}/{filename} ⚠ not yet wired
• Failure reasons emitted: _(none wired)_

Uses s3client.Uploader from internal/s3client/uploader.go. Skipped when S3_BUCKET_NAME is unset (local dev).

See the S3 Persistence Contract for the full reason taxonomy.