From d399537e9eb4cc18dc7b0ab2a9b356ab85e02964 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Jos=C3=A9=20Nicola?= <juan.nicola@greenbone.net>
Date: Thu, 25 Jan 2024 10:19:41 +0100
Subject: [PATCH] Add: nasl-cli notus update subcommand (#1558)

* Add: nasl-cli notus update subcommand

Load up Notus Advisories into redis.
It performs the signature check, the hashsum check and the upload.

Signature check is optional. It must be enabled with the command line option but also the environment variable to the gnupg keyring must be set.

Usage:
`GPGHOME=/path/to/.gnupg nasl-cli notus update --path <path-to-the-advisories> --signature-check`

* remove swap files and unnecessary commented code

* Change: Rename NvtDispatcher by CacheDispatcher

Since it is no not only for Nvts but also for Notus advisories.

* Change: Load both notus and vts caches with `nasl-cli feed update`

instead of having two subcommands.

* Change: run feed-verifier with --nvt-only option

* Fix: CI. Update zlib version to 1.3.1
---
 rust/Cargo.lock                             |   2 +
 rust/cross.Dockerfile                       |   4 +-
 rust/cross_aarch64.Dockerfile               |   4 +-
 rust/feed-verifier/src/main.rs              |   2 +-
 rust/feed/src/update/mod.rs                 |   8 +-
 rust/models/src/advisories.rs               | 197 ++++++++++++++++++++
 rust/models/src/lib.rs                      |   2 +
 rust/nasl-builtin-knowledge-base/src/lib.rs |   1 +
 rust/nasl-cli/Cargo.toml                    |   1 +
 rust/nasl-cli/README.md                     |  14 +-
 rust/nasl-cli/src/feed/mod.rs               | 107 +++++++++--
 rust/nasl-cli/src/interpret/mod.rs          |   6 +-
 rust/nasl-cli/src/main.rs                   |   6 +-
 rust/nasl-cli/src/notusupdate/mod.rs        |   5 +
 rust/nasl-cli/src/notusupdate/update.rs     |  88 +++++++++
 rust/nasl-interpreter/src/include.rs        |   2 +-
 rust/notus/src/loader/hashsum.rs            |  87 ++++++++-
 rust/notus/src/loader/mod.rs                |  15 +-
 rust/redis-storage/src/connector.rs         |  55 ++++--
 rust/redis-storage/src/lib.rs               |   3 +-
 rust/storage/Cargo.toml                     |   1 +
 rust/storage/src/lib.rs                     |  21 +++
 rust/storage/src/nvt.rs                     |   7 +-
 23 files changed, 583 insertions(+), 55 deletions(-)
 create mode 100644 rust/models/src/advisories.rs
 create mode 100644 rust/nasl-cli/src/notusupdate/mod.rs
 create mode 100644 rust/nasl-cli/src/notusupdate/update.rs

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 429d365a2..955ef29e9 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -1682,6 +1682,7 @@ dependencies = [
  "models",
  "nasl-interpreter",
  "nasl-syntax",
+ "notus",
  "redis-storage",
  "scanconfig",
  "serde",
@@ -2771,6 +2772,7 @@ checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 name = "storage"
 version = "0.1.0"
 dependencies = [
+ "models",
  "serde",
  "time",
  "tracing",
diff --git a/rust/cross.Dockerfile b/rust/cross.Dockerfile
index c5af8d582..4ec764b70 100644
--- a/rust/cross.Dockerfile
+++ b/rust/cross.Dockerfile
@@ -17,10 +17,10 @@ RUN ./configure --host=x86_64-unknown-linux-gnu --with-pcap=linux
 RUN cat config.log
 RUN make install
 
-RUN curl --output /tmp/zlib.tar.gz https://www.zlib.net/zlib-1.3.tar.gz
+RUN curl --output /tmp/zlib.tar.gz https://www.zlib.net/zlib-1.3.1.tar.gz
 WORKDIR /tmp
 RUN tar xvf zlib.tar.gz
-WORKDIR /tmp/zlib-1.3
+WORKDIR /tmp/zlib-1.3.1
 RUN ./configure
 RUN make install
 RUN ldconfig
diff --git a/rust/cross_aarch64.Dockerfile b/rust/cross_aarch64.Dockerfile
index e51bc14fc..60daa6fee 100644
--- a/rust/cross_aarch64.Dockerfile
+++ b/rust/cross_aarch64.Dockerfile
@@ -22,10 +22,10 @@ RUN ./configure --host=aarch64-unknown-linux-gnu --with-pcap=linux
 RUN cat config.log
 RUN make install
 
-RUN curl --output /tmp/zlib.tar.gz https://www.zlib.net/zlib-1.3.tar.gz
+RUN curl --output /tmp/zlib.tar.gz https://www.zlib.net/zlib-1.3.1.tar.gz
 WORKDIR /tmp
 RUN tar xvzf zlib.tar.gz
-WORKDIR /tmp/zlib-1.3
+WORKDIR /tmp/zlib-1.3.1
 RUN ./configure
 RUN make install
 RUN ldconfig
diff --git a/rust/feed-verifier/src/main.rs b/rust/feed-verifier/src/main.rs
index d8c59fb1f..1afd6126b 100644
--- a/rust/feed-verifier/src/main.rs
+++ b/rust/feed-verifier/src/main.rs
@@ -166,7 +166,7 @@ fn main() {
     };
     let (ncd, nasl_cli) = run_get(
         &mut kb,
-        &format!("{} feed update", nasl_cli.to_str().unwrap_or_default()),
+        &format!("{} feed update --vts-only", nasl_cli.to_str().unwrap_or_default()),
     )
     .expect("results");
     let mut errors = 0;
diff --git a/rust/feed/src/update/mod.rs b/rust/feed/src/update/mod.rs
index 0681be708..3aaad826e 100644
--- a/rust/feed/src/update/mod.rs
+++ b/rust/feed/src/update/mod.rs
@@ -14,7 +14,7 @@ use nasl_interpreter::{
 };
 use storage::{nvt::NVTField, Dispatcher, NoOpRetriever};
 
-use crate::verify::{self, SignatureChecker, HashSumFileItem};
+use crate::verify::{self, HashSumFileItem, SignatureChecker};
 
 pub use self::error::ErrorKind;
 
@@ -69,7 +69,6 @@ pub fn feed_version<K: Default + AsRef<str>>(
     Ok(feed_version)
 }
 
-
 impl<'a, R, S, L, V, K> SignatureChecker for Update<S, L, V, K>
 where
     S: Sync + Send + Dispatcher<K>,
@@ -77,8 +76,9 @@ where
     L: Sync + Send + Loader + AsBufReader<File>,
     V: Iterator<Item = Result<HashSumFileItem<'a, R>, verify::Error>>,
     R: Read + 'a,
-{}
-    
+{
+}
+
 impl<'a, S, L, V, K, R> Update<S, L, V, K>
 where
     S: Sync + Send + Dispatcher<K>,
diff --git a/rust/models/src/advisories.rs b/rust/models/src/advisories.rs
new file mode 100644
index 000000000..37f38aace
--- /dev/null
+++ b/rust/models/src/advisories.rs
@@ -0,0 +1,197 @@
+// SPDX-FileCopyrightText: 2023 Greenbone AG
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+use std::collections::HashMap;
+
+/// Represents an advisory json file for notus product.
+#[cfg_attr(feature = "serde_support", derive(serde::Deserialize))]
+#[derive(Debug, Clone)]
+pub struct ProductsAdivisories {
+    /// Version of the advisory file
+    pub version: String,
+    /// SPDX license identifier
+    #[cfg_attr(feature = "serde_support", serde(rename = "spdx-license-identifier"))]
+    pub license_identifier: String,
+    /// Copyright
+    pub copyright: String,
+    /// Vulnerability Family
+    pub family: String,
+    /// List of Advisories
+    #[cfg_attr(feature = "serde_support", serde(default))]
+    pub advisories: Vec<Advisories>,
+}
+
+/// Represents an advisory json file for notus product.
+#[derive(Default, Debug, Clone, PartialEq, Eq)]
+#[cfg_attr(
+    feature = "serde_support",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+pub struct Advisories {
+    /// The advisory's title.
+    pub title: String,
+    /// The advisory's ID.
+    pub oid: String,
+    /// Creation Date
+    pub creation_date: u64,
+    /// Last modification date
+    pub last_modification: u64,
+    /// Advisory ID
+    pub advisory_id: String,
+    /// Advisory xref
+    pub advisory_xref: String,
+    /// List of cves
+    #[cfg_attr(feature = "serde_support", serde(default))]
+    pub cves: Vec<String>,
+    /// Summary
+    pub summary: String,
+    /// Insight
+    #[cfg_attr(feature = "serde_support", serde(default))]
+    pub insight: String,
+    /// Affected
+    pub affected: String,
+    /// Listo of xrefs
+    #[cfg_attr(feature = "serde_support", serde(default))]
+    pub xrefs: Vec<String>,
+    /// Quality of detection
+    pub qod_type: String,
+    /// Severity
+    pub severity: Severity,
+}
+
+/// A single vulnerability from an advisory file to be stored
+#[cfg_attr(
+    feature = "serde_support",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[derive(Default, Debug, Clone, PartialEq, Eq)]
+pub struct Vulnerability {
+    /// VT Parameters
+    pub vt_params: Vec<String>,
+    /// Creation Date
+    pub creation_date: u64,
+    /// Last modification date
+    pub last_modification: u64,
+    /// Summary
+    pub summary: String,
+    /// Impact
+    pub impact: String,
+    /// Affected
+    pub affected: String,
+    /// Insight
+    pub insight: String,
+    /// Solution
+    pub solution: String,
+    /// Solution Type
+    pub solution_type: String,
+    /// Vuldetect
+    pub vuldeterct: String,
+    /// Quality of detection
+    pub qod_type: String,
+    /// Severity vector
+    pub severity_vector: String,
+    /// File name
+    pub filename: String,
+    /// All references: xrefs, cves, xrefs, advisory xrefs and advisory id.
+    pub refs: HashMap<String, Vec<String>>,
+    /// Vulnerability Family
+    pub family: String,
+    /// Title
+    pub name: String,
+    /// Category
+    pub category: String,
+}
+
+/// Severity
+#[cfg_attr(
+    feature = "serde_support",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[derive(Default, Debug, Clone, PartialEq, Eq)]
+pub struct Severity {
+    /// Origin of the severity
+    pub origin: String,
+    /// severity date
+    pub date: u64,
+    /// Cvss version v2
+    #[cfg_attr(
+        feature = "serde_support",
+        serde(skip_serializing_if = "Option::is_none")
+    )]
+    pub cvss_v2: Option<String>,
+    /// cvss vector v3
+    #[cfg_attr(
+        feature = "serde_support",
+        serde(skip_serializing_if = "Option::is_none")
+    )]
+    pub cvss_v3: Option<String>,
+}
+
+pub struct ProductsAdivisoriesIterator<'a> {
+    products_advisories: &'a ProductsAdivisories,
+    index: usize,
+}
+
+impl<'a> Iterator for ProductsAdivisoriesIterator<'a> {
+    type Item = &'a Advisories;
+
+    fn next(&mut self) -> Option<&'a Advisories> {
+        if self.index < self.products_advisories.advisories.len() {
+            let result = Some(&self.products_advisories.advisories[self.index]);
+            self.index += 1;
+            result
+        } else {
+            None
+        }
+    }
+}
+
+impl ProductsAdivisories {
+    pub fn iter(&self) -> ProductsAdivisoriesIterator {
+        ProductsAdivisoriesIterator {
+            products_advisories: self,
+            index: 0,
+        }
+    }
+}
+
+pub struct VulnerabilityData<'a> {
+    pub adv: &'a Advisories,
+    pub product_data: &'a ProductsAdivisories,
+    pub filename: &'a String,
+}
+
+impl<'a> From<&VulnerabilityData<'a>> for Vulnerability {
+    fn from(data: &VulnerabilityData<'a>) -> Self {
+        let sv = match &data.adv.severity.cvss_v2 {
+            Some(cvss) => cvss,
+            None => match &data.adv.severity.cvss_v3 {
+                Some(cvss) => cvss,
+                None => "",
+            },
+        };
+
+        let refs = HashMap::new();
+        Self {
+            vt_params: Vec::new(),
+            creation_date: data.adv.creation_date,
+            last_modification: data.adv.last_modification,
+            summary: data.adv.summary.to_owned(),
+            impact: "".to_string(),
+            affected: data.adv.affected.to_owned(),
+            insight: data.adv.insight.to_owned(),
+            solution: "Please install the updated package(s).".to_string(),
+            solution_type: "VendorFix".to_string(),
+            vuldeterct: "Checks if a vulnerable package version is present on the target host."
+                .to_string(),
+            qod_type: data.adv.qod_type.to_owned(),
+            severity_vector: sv.to_string(),
+            filename: data.filename.to_string(),
+            refs,
+            family: data.product_data.family.to_owned(),
+            name: data.adv.title.to_owned(),
+            category: "3".to_string(),
+        }
+    }
+}
diff --git a/rust/models/src/lib.rs b/rust/models/src/lib.rs
index 1db6720f5..5473a41f1 100644
--- a/rust/models/src/lib.rs
+++ b/rust/models/src/lib.rs
@@ -2,6 +2,7 @@
 //
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+mod advisories;
 mod credential;
 mod host_info;
 mod parameter;
@@ -15,6 +16,7 @@ mod status;
 mod target;
 mod vt;
 
+pub use advisories::*;
 pub use credential::*;
 pub use host_info::*;
 pub use parameter::*;
diff --git a/rust/nasl-builtin-knowledge-base/src/lib.rs b/rust/nasl-builtin-knowledge-base/src/lib.rs
index bea352003..a6b6395d5 100644
--- a/rust/nasl-builtin-knowledge-base/src/lib.rs
+++ b/rust/nasl-builtin-knowledge-base/src/lib.rs
@@ -54,6 +54,7 @@ fn get_kb_item<K>(register: &Register, c: &Context<K>) -> Result<NaslValue, Func
             .map(|r| {
                 r.into_iter().find_map(|x| match x {
                     Field::NVT(_) => None,
+                    Field::NOTUS(_) => None,
                     Field::KB(kb) => kb.value.into(),
                 })
             })
diff --git a/rust/nasl-cli/Cargo.toml b/rust/nasl-cli/Cargo.toml
index d1919f0e5..4eb8d8048 100644
--- a/rust/nasl-cli/Cargo.toml
+++ b/rust/nasl-cli/Cargo.toml
@@ -27,6 +27,7 @@ tracing-subscriber = { version = "0.3.17" }
 serde_json = "1.0.96"
 toml = "0.8.6"
 serde = "1.0.190"
+notus = { version = "0.1.0", path = "../notus" }
 
 
 [features]
diff --git a/rust/nasl-cli/README.md b/rust/nasl-cli/README.md
index 1033c1d76..9b340e75c 100644
--- a/rust/nasl-cli/README.md
+++ b/rust/nasl-cli/README.md
@@ -38,7 +38,6 @@ Hello, world!
 
 Usage: `nasl-cli execute [OPTIONS] [-t HOST] <script>`
 
-
 ### feed
 
 Handles feed related tasks.
@@ -48,19 +47,28 @@ Usage: `nasl-cli feed <COMMAND>`
 #### update
 
 Runs nasl scripts in description mode and updates data into redis so that ospd-openvas can read the data.
+Also, load the Notus advisories up into the redis cache. The path to the notus advisories must be provided.
 
 When either path or redis is not set it will get the defaults by calling `openvas -s`.
 
 Usage `nasl-cli feed update [OPTIONS]`
 
+Usage example, load both:
+`GPGHOME=/path/to/.gnupg nasl-cli feed update --notus-path <path-to-the-advisories> --signature-check`
+
 Options:
-- `-p`, `--path <FILE>`:   Path to the feed.
-- `-r`, `--redis <VALUE>`: Redis url. Must either start `unix://` or `redis://`.
+- `-v`, `--vts-only`: Load only nvts into redis cache
+- `-n`, `--notus-only`: Load only Notus advisories into redis cache
+- `--vts-path <FILE>`: Path to the feed.
+- `--notus-path <FILE>`: Path to the notus advisories.
 - `-x`, `--signature-check`: Enable NASL signature check.
+- `-r`, `--redis <VALUE>`: Redis url. Must either start `unix://` or `redis://`.
 
 On `feed update` it will first read the `sha256sums` file within the feed directory and verify each file with the corresponding sha256sums. When the hash is correct it will execute each mentioned `*.nasl` script within that dir with `description = 1`.
 Optionally, it is possible to perform a signature verification of the sha256sums file before uploading. To perform the signature check, also the environment variable `GNUPGHOME` must be set with the gnupg home directory, where the `pubring.kbx` file is stored.
 
+Notus advisories and VTs can be uploaded independtently using the options `--vts-only` and `--notus-only` respectively. They can not be used together. 
+
 #### transform
 Runs nasl scripts in description mode and returns it as a json array into stdout.
 
diff --git a/rust/nasl-cli/src/feed/mod.rs b/rust/nasl-cli/src/feed/mod.rs
index 029287233..06a99ed58 100644
--- a/rust/nasl-cli/src/feed/mod.rs
+++ b/rust/nasl-cli/src/feed/mod.rs
@@ -4,9 +4,11 @@ use std::{io, path::PathBuf};
 use clap::{arg, value_parser, ArgAction, Command};
 // re-export to work around name conflict
 
+use redis_storage::{FEEDUPDATE_SELECTOR, NOTUSUPDATE_SELECTOR};
+
 use storage::StorageError;
 
-use crate::{get_path_from_openvas, read_openvas_config, CliError, CliErrorKind};
+use crate::{get_path_from_openvas, notusupdate, read_openvas_config, CliError, CliErrorKind};
 
 pub fn extend_args(cmd: Command) -> Command {
     crate::add_verbose(
@@ -16,9 +18,13 @@ pub fn extend_args(cmd: Command) -> Command {
                 .subcommand_required(true)
                 .subcommand(Command::new("update")
                 .about("Runs nasl scripts in description mode and updates data into redis")
-                .arg(arg!(-p --path <FILE> "Path to the feed.") .required(false)
-                    .value_parser(value_parser!(PathBuf)))
-                .arg(arg!(-x --"signature-check" "Enable NASL signature check.") .required(false).action(ArgAction::SetTrue))
+                .arg(arg!(-v --"vts-only" "Load only nvts into redis cache").required(false).action(ArgAction::SetTrue))
+                .arg(arg!(-n --"notus-only" "Load only Notus advisories into redis cache").required(false).action(ArgAction::SetTrue))
+                .arg(arg!(--"vts-path" <FILE> "Path to the feed.").required(false)
+                     .value_parser(value_parser!(PathBuf)))
+                .arg(arg!(--"notus-path" <FILE> "Path to the notus advisories.").required(false)
+                     .value_parser(value_parser!(PathBuf)))
+                .arg(arg!(-x --"signature-check" "Enable NASL signature check.").required(false).action(ArgAction::SetTrue))
                 .arg(arg!(-r --redis <VALUE> "Redis url. Must either start `unix://` or `redis://`.").required(false))
                 )
                 .subcommand(Command::new("transform")
@@ -37,18 +43,19 @@ pub fn extend_args(cmd: Command) -> Command {
 }
 
 pub fn run(root: &clap::ArgMatches) -> Option<Result<(), CliError>> {
-    fn get_path(args: &clap::ArgMatches) -> PathBuf {
-        args.get_one::<PathBuf>("path").cloned().unwrap_or_else(|| {
-            let config =
-                read_openvas_config().expect("openvas -s must be executable when path is not set");
-            get_path_from_openvas(config)
-        })
+    fn get_vts_path(args: &clap::ArgMatches) -> PathBuf {
+        args.get_one::<PathBuf>("vts-path")
+            .cloned()
+            .unwrap_or_else(|| {
+                let config = read_openvas_config()
+                    .expect("openvas -s must be executable when path is not set");
+                get_path_from_openvas(config)
+            })
     }
 
     let (args, verbose) = crate::get_args_set_logging(root, "feed")?;
     match args.subcommand() {
         Some(("update", args)) => {
-            let path = get_path(args);
             let redis = match args.get_one::<String>("redis").cloned() {
                 Some(x) => x,
                 None => {
@@ -72,16 +79,76 @@ pub fn run(root: &clap::ArgMatches) -> Option<Result<(), CliError>> {
                 .cloned()
                 .unwrap_or(false);
 
-            let dispatcher = redis_storage::NvtDispatcher::as_dispatcher(&redis)
-                .map_err(StorageError::from)
-                .map_err(|e| CliError {
-                    kind: e.into(),
-                    filename: format!("{path:?}"),
-                });
-            Some(dispatcher.and_then(|dispatcher| update::run(dispatcher, path, signature_check)))
+            let loadup_notus_only = args.get_one::<bool>("notus-only").cloned().unwrap_or(false);
+
+            let loadup_vts_only = args.get_one::<bool>("vts-only").cloned().unwrap_or(false);
+
+            if loadup_vts_only && loadup_notus_only {
+                return Some(Err(CliError {
+                    filename: "".to_string(),
+                    kind: CliErrorKind::LoadError(nasl_syntax::LoadError::Dirty(
+                        "Please do not use --notus-only and --vts-only together".to_string(),
+                    )),
+                }));
+            }
+
+            // if not notus only, load vts
+            let mut ret: Option<Result<(), CliError>> = None;
+            if !loadup_notus_only {
+                let path = get_vts_path(args);
+
+                let dispatcher =
+                    redis_storage::CacheDispatcher::as_dispatcher(&redis, FEEDUPDATE_SELECTOR)
+                        .map_err(StorageError::from)
+                        .map_err(|e| CliError {
+                            kind: e.into(),
+                            filename: format!("{path:?}"),
+                        });
+                ret = match dispatcher
+                    .and_then(|dispatcher| update::run(dispatcher, path, signature_check))
+                {
+                    Err(err) => {
+                        return Some(Err(err));
+                    }
+                    Ok(()) => Some(Ok(())),
+                };
+            }
+
+            // if not vts only, load notus advisories
+            // TODO: get the path to the advisories reading some config file in the future
+            if !loadup_vts_only {
+                let path = match args.get_one::<PathBuf>("notus-path") {
+                    Some(p) => p.to_path_buf(),
+                    None => {
+                        return Some(Err(CliError {
+                            filename: "".to_string(),
+                            kind: CliErrorKind::LoadError(nasl_syntax::LoadError::Dirty(
+                                "Path to the notus advisories is mandatory".to_string(),
+                            )),
+                        }));
+                    }
+                };
+
+                let dispatcher =
+                    redis_storage::CacheDispatcher::as_dispatcher(&redis, NOTUSUPDATE_SELECTOR)
+                        .map_err(StorageError::from)
+                        .map_err(|e| CliError {
+                            kind: e.into(),
+                            filename: format!("{path:?}"),
+                        });
+                ret = match dispatcher.and_then(|dispatcher| {
+                    notusupdate::update::run(dispatcher, path, signature_check)
+                }) {
+                    Err(err) => {
+                        return Some(Err(err));
+                    }
+                    Ok(()) => Some(Ok(())),
+                };
+            }
+            ret
         }
         Some(("transform", args)) => {
-            let path = get_path(args);
+            let path = get_vts_path(args);
 
             let mut o = json_storage::ArrayWrapper::new(io::stdout());
             let dispatcher = json_storage::NvtDispatcher::as_dispatcher(&mut o);
@@ -95,7 +162,7 @@ pub fn run(root: &clap::ArgMatches) -> Option<Result<(), CliError>> {
         }
 
         Some(("transpile", args)) => {
-            let path = get_path(args);
+            let path = get_vts_path(args);
             let rules = match args.get_one::<String>("rules").cloned() {
                 Some(x) => x,
                 None => unreachable!("rules is set to required"),
diff --git a/rust/nasl-cli/src/interpret/mod.rs b/rust/nasl-cli/src/interpret/mod.rs
index e76cc588d..6f6b00cbb 100644
--- a/rust/nasl-cli/src/interpret/mod.rs
+++ b/rust/nasl-cli/src/interpret/mod.rs
@@ -9,6 +9,7 @@ use nasl_interpreter::{
     load_non_utf8_path, logger::DefaultLogger, logger::NaslLogger, ContextBuilder, FSPluginLoader,
     Interpreter, KeyDispatcherSet, LoadError, Loader, NaslValue, NoOpLoader, RegisterBuilder,
 };
+use redis_storage::FEEDUPDATE_SELECTOR;
 use storage::{DefaultDispatcher, Dispatcher, Retriever};
 
 use crate::{CliError, CliErrorKind, Db};
@@ -26,7 +27,10 @@ impl Run<String> {
             Db::InMemory => ContextBuilder::new(key, Box::<DefaultDispatcher<String>>::default()),
             Db::Redis(url) => ContextBuilder::new(
                 key,
-                Box::new(redis_storage::NvtDispatcher::as_dispatcher(url).unwrap()),
+                Box::new(
+                    redis_storage::CacheDispatcher::as_dispatcher(url, FEEDUPDATE_SELECTOR)
+                        .unwrap(),
+                ),
             ),
         };
 
diff --git a/rust/nasl-cli/src/main.rs b/rust/nasl-cli/src/main.rs
index 78ca2e458..ad504e9ed 100644
--- a/rust/nasl-cli/src/main.rs
+++ b/rust/nasl-cli/src/main.rs
@@ -7,16 +7,14 @@ mod error;
 mod execute;
 mod feed;
 mod interpret;
+mod notusupdate;
 mod scanconfig;
 mod syntax;
 
 use configparser::ini::Ini;
 pub use error::*;
 
-use std::{
-    path::PathBuf,
-    process,
-};
+use std::{path::PathBuf, process};
 use storage::StorageError;
 
 use clap::{arg, ArgAction, ArgMatches, Command};
diff --git a/rust/nasl-cli/src/notusupdate/mod.rs b/rust/nasl-cli/src/notusupdate/mod.rs
new file mode 100644
index 000000000..512f0491e
--- /dev/null
+++ b/rust/nasl-cli/src/notusupdate/mod.rs
@@ -0,0 +1,5 @@
+// SPDX-FileCopyrightText: 2023 Greenbone AG
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+pub mod update;
diff --git a/rust/nasl-cli/src/notusupdate/update.rs b/rust/nasl-cli/src/notusupdate/update.rs
new file mode 100644
index 000000000..535a482c5
--- /dev/null
+++ b/rust/nasl-cli/src/notusupdate/update.rs
@@ -0,0 +1,88 @@
+// SPDX-FileCopyrightText: 2023 Greenbone AG
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+use std::path::PathBuf;
+
+use crate::{CliError, CliErrorKind};
+use models::{Vulnerability, VulnerabilityData};
+use nasl_syntax::{FSPluginLoader, LoadError};
+use notus::loader::{hashsum::HashsumAdvisoryLoader, AdvisoryLoader};
+use redis_storage::NOTUS_KEY;
+use storage::{Dispatcher, Field::NOTUS, Notus};
+
+pub fn run<S>(storage: S, path: PathBuf, signature_check: bool) -> Result<(), CliError>
+where
+    S: Sync + Send + Dispatcher<String>,
+{
+    let loader = FSPluginLoader::new(path.to_string_lossy().to_string());
+    let advisories_files = match HashsumAdvisoryLoader::new(loader.clone()) {
+        Ok(loader) => loader,
+        Err(_) => {
+            return Err(CliError {
+                filename: "".to_string(),
+                kind: CliErrorKind::LoadError(LoadError::Dirty(
+                    "Problem loading advisory".to_string(),
+                )),
+            })
+        }
+    };
+
+    // Perform signature check if enabled.
+    if signature_check {
+        match advisories_files.verify_signature() {
+            Ok(_) => tracing::info!("Signature check succsessful"),
+            Err(feed::VerifyError::MissingKeyring) => {
+                tracing::warn!("Signature check enabled but missing keyring");
+                return Err(feed::VerifyError::MissingKeyring.into());
+            }
+            Err(feed::VerifyError::BadSignature(e)) => {
+                tracing::warn!("{}", e);
+                return Err(CliError {
+                    filename: feed::Hasher::Sha256.sum_file().to_string(),
+                    kind: crate::CliErrorKind::LoadError(nasl_syntax::LoadError::Dirty(e)),
+                });
+            }
+            Err(e) => {
+                tracing::warn!("Unexpected error during signature verification: {e}");
+                return Err(CliError {
+                    filename: feed::Hasher::Sha256.sum_file().to_string(),
+                    kind: crate::CliErrorKind::LoadError(nasl_syntax::LoadError::Dirty(
+                        e.to_string(),
+                    )),
+                });
+            }
+        }
+    } else {
+        tracing::warn!("Signature check disabled");
+    }
+
+    // Get the all products files and process
+    for filename in advisories_files.get_advisories().unwrap().iter() {
+        let advisories = advisories_files.load_advisory(filename).unwrap();
+
+        // Each products contains multiple advisories. Each advisory is converted
+        // to a Vulnerability, serialized, and stored as a single entry in the cache.
+        for adv in advisories.iter() {
+            let key = format!("internal/notus/advisories/{}", adv.oid);
+            let value = Vulnerability::from(&VulnerabilityData {
+                adv,
+                product_data: &advisories,
+                filename,
+            });
+
+            let serialized = serde_json::to_string(&value).unwrap();
+
+            let _ = storage.dispatch(
+                &key,
+                NOTUS(Notus {
+                    value: serialized.into(),
+                }),
+            );
+        }
+        // Finally, set the "notuscache" key, so the cache can be found under this key.
+        let _ = storage.dispatch(&NOTUS_KEY.to_string(), NOTUS(Notus { value: 1.into() }));
+    }
+
+    Ok(())
+}
diff --git a/rust/nasl-interpreter/src/include.rs b/rust/nasl-interpreter/src/include.rs
index e8797098e..0e4b0ec32 100644
--- a/rust/nasl-interpreter/src/include.rs
+++ b/rust/nasl-interpreter/src/include.rs
@@ -56,7 +56,7 @@ mod tests {
                 .ok_or_else(|| LoadError::NotFound(String::default()))
         }
         fn root_path(&self) -> Result<std::string::String, nasl_syntax::LoadError> {
-           Ok(String::default()) 
+            Ok(String::default())
         }
     }
 
diff --git a/rust/notus/src/loader/hashsum.rs b/rust/notus/src/loader/hashsum.rs
index 355f05503..ff3c26ad2 100644
--- a/rust/notus/src/loader/hashsum.rs
+++ b/rust/notus/src/loader/hashsum.rs
@@ -5,11 +5,12 @@
 use std::{io::Read, marker::PhantomData};
 
 use feed::{HashSumNameLoader, SignatureChecker};
+use models::ProductsAdivisories;
 use nasl_syntax::{AsBufReader, Loader};
 
 use crate::error::Error;
 
-use super::{FeedStamp, ProductLoader};
+use super::{AdvisoryLoader, FeedStamp, ProductLoader};
 
 #[derive(Debug, Clone)]
 pub struct HashsumProductLoader<R, L> {
@@ -110,3 +111,87 @@ where
         Ok(p)
     }
 }
+
+#[derive(Debug, Clone)]
+pub struct HashsumAdvisoryLoader<R, L> {
+    loader: L,
+    read_type: PhantomData<R>,
+}
+
+impl<R, L> SignatureChecker for HashsumAdvisoryLoader<R, L>
+where
+    L: Loader + AsBufReader<R>,
+    R: Read,
+{
+}
+
+impl<R, L> HashsumAdvisoryLoader<R, L>
+where
+    L: Loader + AsBufReader<R>,
+    R: Read,
+{
+    pub fn new(reader: L) -> Result<Self, Error> {
+        Ok(Self {
+            loader: reader,
+            read_type: PhantomData,
+        })
+    }
+}
+
+impl<R, L> AdvisoryLoader for HashsumAdvisoryLoader<R, L>
+where
+    L: Loader + AsBufReader<R>,
+    R: Read,
+{
+    fn get_advisories(&self) -> Result<Vec<String>, Error> {
+        let mut ret = vec![];
+        let loader = HashSumNameLoader::sha256(&self.loader).map_err(Error::HashsumLoadError)?;
+
+        for entry in loader {
+            let item = entry.map_err(Error::HashsumLoadError)?;
+            ret.push(item.get_filename())
+        }
+        Ok(ret)
+    }
+
+    fn load_advisory(&self, os: &str) -> Result<ProductsAdivisories, Error> {
+        let mut loader =
+            HashSumNameLoader::sha256(&self.loader).map_err(Error::HashsumLoadError)?;
+        let file_item = loader
+            .find(|entry| {
+                if let Ok(item) = entry {
+                    return item.get_filename() == *os;
+                }
+                false
+            })
+            .ok_or_else(|| Error::UnknownProduct(os.to_string()))?
+            .map_err(Error::HashsumLoadError)?;
+
+        file_item.verify().map_err(Error::HashsumLoadError)?;
+
+        let file = self
+            .loader
+            .load(file_item.get_filename().as_str())
+            .map_err(|e| {
+                Error::LoadProductError(
+                    os.to_string(),
+                    crate::error::LoadProductErrorKind::LoadError(e),
+                )
+            })?;
+
+        match serde_json::from_str(&file) {
+            Ok(adv) => Ok(adv),
+            Err(err) => Err(Error::JSONParseError(os.to_string(), err)),
+        }
+    }
+
+    /// Perform a signature check of the sha256sums file
+    fn verify_signature(&self) -> Result<(), feed::VerifyError> {
+        let path = self.loader.root_path().unwrap();
+        <HashsumProductLoader<R, L> as self::SignatureChecker>::signature_check(&path)
+    }
+    fn get_root_dir(&self) -> Result<String, Error> {
+        let p = self.loader.root_path().unwrap();
+        Ok(p)
+    }
+}
diff --git a/rust/notus/src/loader/mod.rs b/rust/notus/src/loader/mod.rs
index f428893e4..4b2ee9def 100644
--- a/rust/notus/src/loader/mod.rs
+++ b/rust/notus/src/loader/mod.rs
@@ -4,7 +4,7 @@
 
 use std::time::SystemTime;
 
-use models::Product;
+use models::{Product, ProductsAdivisories};
 
 use crate::error::Error;
 
@@ -34,3 +34,16 @@ pub trait ProductLoader {
     /// Get the root directory of the notus products
     fn get_root_dir(&self) -> Result<String, Error>;
 }
+
+/// Trait for an AdvisoryLoader
+pub trait AdvisoryLoader {
+    /// Get a list of all available products. This list contains the exact strings, that can also be
+    /// used for `load_product`.
+    fn get_advisories(&self) -> Result<Vec<String>, Error>;
+    /// Load advisories files present in the path.
+    fn load_advisory(&self, os: &str) -> Result<ProductsAdivisories, Error>;
+    /// Verify the signature of the Hashsum file
+    fn verify_signature(&self) -> Result<(), feed::VerifyError>;
+    /// Get the root directory of the notus products
+    fn get_root_dir(&self) -> Result<String, Error>;
+}
diff --git a/rust/redis-storage/src/connector.rs b/rust/redis-storage/src/connector.rs
index 925967395..ab27b8f09 100644
--- a/rust/redis-storage/src/connector.rs
+++ b/rust/redis-storage/src/connector.rs
@@ -15,6 +15,7 @@ use storage::nvt::NvtPreference;
 use storage::nvt::NvtRef;
 use storage::nvt::PerNVTDispatcher;
 use storage::Kb;
+use storage::Notus;
 use storage::StorageError;
 
 enum KbNvtPos {
@@ -89,6 +90,7 @@ pub enum NameSpaceSelector {
 }
 
 const CACHE_KEY: &str = "nvticache";
+pub const NOTUS_KEY: &str = "notuscache";
 const DB_INDEX: &str = "GVM.__GlobalDBIndex";
 
 impl NameSpaceSelector {
@@ -149,6 +151,8 @@ impl NameSpaceSelector {
 /// Default selector for a feed-update run
 pub const FEEDUPDATE_SELECTOR: &[NameSpaceSelector] =
     &[NameSpaceSelector::Key(CACHE_KEY), NameSpaceSelector::Free];
+pub const NOTUSUPDATE_SELECTOR: &[NameSpaceSelector] =
+    &[NameSpaceSelector::Key(NOTUS_KEY), NameSpaceSelector::Free];
 
 pub trait RedisWrapper {
     fn rpush<T: ToRedisArgs>(&mut self, key: &str, val: T) -> RedisStorageResult<()>;
@@ -169,6 +173,23 @@ impl RedisWrapper for RedisCtx {
     }
 }
 
+pub trait RedisAddAdvisory: RedisWrapper {
+    /// Add an NVT in the redis cache.
+    ///
+    /// The NVT metadata is stored in two different keys:
+
+    /// - 'nvt:<OID>': stores the general metadata ordered following the KbNvtPos indexes
+    /// - 'oid:<OID>:prefs': stores the plugins preferences, including the script_timeout
+    ///   (which is especial and uses preferences id 0)
+    fn redis_add_advisory(&mut self, key: &str, adv: Notus) -> RedisStorageResult<()> {
+        let value = adv.value.to_string();
+        self.rpush(key, &value)?;
+        Ok(())
+    }
+}
+
+impl RedisAddAdvisory for RedisCtx {}
+
 pub trait RedisAddNvt: RedisWrapper {
     /// Get References. It returns a tuple of three strings
     /// Each string is a references type, and each string
@@ -353,16 +374,16 @@ impl RedisCtx {
 /// In this case we need to wait until we get the OID so that we can build the key additionally
 /// we need to have all references and preferences to respect the order to be downwards compatible.
 /// This should be changed when there is new OSP frontend available.
-pub struct NvtDispatcher<R, K>
+pub struct CacheDispatcher<R, K>
 where
-    R: RedisWrapper + RedisAddNvt,
+    R: RedisWrapper + RedisAddNvt + RedisAddAdvisory,
 {
     cache: Arc<Mutex<R>>,
     kbs: Arc<Mutex<Vec<Kb>>>,
     phanton: PhantomData<K>,
 }
 
-impl<K> NvtDispatcher<RedisCtx, K>
+impl<K> CacheDispatcher<RedisCtx, K>
 where
     K: AsRef<str>,
 {
@@ -373,10 +394,10 @@ where
     pub fn init(
         redis_url: &str,
         selector: &[NameSpaceSelector],
-    ) -> RedisStorageResult<NvtDispatcher<RedisCtx, K>> {
+    ) -> RedisStorageResult<CacheDispatcher<RedisCtx, K>> {
         let rctx = RedisCtx::open(redis_url, selector)?;
 
-        Ok(NvtDispatcher {
+        Ok(CacheDispatcher {
             cache: Arc::new(Mutex::new(rctx)),
             kbs: Arc::new(Mutex::new(Vec::new())),
             phanton: PhantomData,
@@ -389,8 +410,9 @@ where
     /// before returning the underlying cache as a Dispatcher.
     pub fn as_dispatcher(
         redis_url: &str,
-    ) -> RedisStorageResult<PerNVTDispatcher<NvtDispatcher<RedisCtx, K>, K>> {
-        let cache = Self::init(redis_url, FEEDUPDATE_SELECTOR)?;
+        selector: &[NameSpaceSelector],
+    ) -> RedisStorageResult<PerNVTDispatcher<CacheDispatcher<RedisCtx, K>, K>> {
+        let cache = Self::init(redis_url, selector)?;
         cache.reset()?;
         Ok(PerNVTDispatcher::new(cache))
     }
@@ -404,9 +426,9 @@ where
     }
 }
 
-impl<S, K> storage::nvt::NvtDispatcher<K> for NvtDispatcher<S, K>
+impl<S, K> storage::nvt::NvtDispatcher<K> for CacheDispatcher<S, K>
 where
-    S: RedisWrapper + RedisAddNvt,
+    S: RedisWrapper + RedisAddNvt + RedisAddAdvisory,
     K: AsRef<str>,
 {
     fn dispatch_nvt(&self, nvt: Nvt) -> Result<(), StorageError> {
@@ -424,11 +446,17 @@ where
         kbs.push(kb);
         Ok(())
     }
+    fn dispatch_advisory(&self, key: &K, adv: storage::Notus) -> Result<(), StorageError> {
+        let mut cache = Arc::as_ref(&self.cache).lock()?;
+        cache
+            .redis_add_advisory(key.as_ref(), adv)
+            .map_err(|e| e.into())
+    }
 }
 
-impl<S, K> storage::Retriever<K> for NvtDispatcher<S, K>
+impl<S, K> storage::Retriever<K> for CacheDispatcher<S, K>
 where
-    S: RedisWrapper + RedisAddNvt,
+    S: RedisWrapper + RedisAddNvt + RedisAddAdvisory,
 {
     fn retrieve(
         &self,
@@ -468,7 +496,7 @@ mod tests {
     use storage::nvt::{NvtPreference, NvtRef, PreferenceType, TagKey, TagValue, ACT};
     use storage::Dispatcher;
 
-    use super::{NvtDispatcher, RedisAddNvt, RedisWrapper};
+    use super::{CacheDispatcher, RedisAddAdvisory, RedisAddNvt, RedisWrapper};
 
     #[derive(Clone)]
     struct FakeRedis {
@@ -498,6 +526,7 @@ mod tests {
         }
     }
     impl RedisAddNvt for FakeRedis {}
+    impl RedisAddAdvisory for FakeRedis {}
 
     use storage::nvt::NVTField::*;
     use storage::Field::NVT;
@@ -550,7 +579,7 @@ mod tests {
         let fr = FakeRedis { sender };
         let cache = Arc::new(Mutex::new(fr));
         let kbs = Arc::new(Mutex::new(Vec::new()));
-        let rcache = NvtDispatcher {
+        let rcache = CacheDispatcher {
             cache,
             kbs,
             phanton: PhantomData,
diff --git a/rust/redis-storage/src/lib.rs b/rust/redis-storage/src/lib.rs
index b242a1f28..55b9f1627 100644
--- a/rust/redis-storage/src/lib.rs
+++ b/rust/redis-storage/src/lib.rs
@@ -5,8 +5,9 @@
 #![doc = include_str!("../README.md")]
 /// Module with structures and methods to access redis.
 mod connector;
-pub use connector::NvtDispatcher;
+pub use connector::CacheDispatcher;
 /// Module to handle custom errors
 pub mod dberror;
 /// Default selector for feed update
 pub use connector::FEEDUPDATE_SELECTOR;
+pub use connector::{NOTUSUPDATE_SELECTOR, NOTUS_KEY};
diff --git a/rust/storage/Cargo.toml b/rust/storage/Cargo.toml
index a20dbf5cb..9438f0765 100644
--- a/rust/storage/Cargo.toml
+++ b/rust/storage/Cargo.toml
@@ -10,6 +10,7 @@ license = "GPL-2.0-or-later"
 time = {version = "0", features = ["parsing"]}
 serde = { version = "1.0", features = ["derive"], optional = true }
 tracing = "0.1.37"
+models = { path = "../models" }
 
 [features]
 serde_support = ["serde"]
diff --git a/rust/storage/src/lib.rs b/rust/storage/src/lib.rs
index 2afce200d..bb9b43db7 100644
--- a/rust/storage/src/lib.rs
+++ b/rust/storage/src/lib.rs
@@ -26,6 +26,7 @@ use types::Primitive;
     derive(serde::Serialize, serde::Deserialize),
     serde(rename_all = "snake_case")
 )]
+
 /// Structure to hold a knowledge base item
 pub struct Kb {
     /// Key of the knowledge base entry
@@ -39,6 +40,19 @@ pub struct Kb {
     pub expire: Option<u64>,
 }
 
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+#[cfg_attr(
+    feature = "serde_support",
+    derive(serde::Serialize, serde::Deserialize),
+    serde(rename_all = "snake_case")
+)]
+
+/// Structure to hold a knowledge base item
+pub struct Notus {
+    /// Notus advisory metadata
+    pub value: Primitive,
+}
+
 /// Describes various Fields of supported items.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum Field {
@@ -46,6 +60,8 @@ pub enum Field {
     NVT(NVTField),
     /// Knowledge Base item
     KB(Kb),
+    /// Notus advisories
+    NOTUS(Notus),
 }
 
 impl From<NVTField> for Field {
@@ -59,6 +75,11 @@ impl From<Kb> for Field {
         Self::KB(value)
     }
 }
+impl From<Notus> for Field {
+    fn from(value: Notus) -> Self {
+        Self::NOTUS(value)
+    }
+}
 
 /// Defines abstract error cases
 #[derive(Clone, Debug, PartialEq, Eq)]
diff --git a/rust/storage/src/nvt.rs b/rust/storage/src/nvt.rs
index 2af60b2fb..7b032d1b8 100644
--- a/rust/storage/src/nvt.rs
+++ b/rust/storage/src/nvt.rs
@@ -11,7 +11,7 @@ use std::{
     sync::{Arc, Mutex},
 };
 
-use crate::{time::AsUnixTimeStamp, types, Dispatcher, Field, Kb, Retriever, StorageError};
+use crate::{time::AsUnixTimeStamp, types, Dispatcher, Field, Kb, Notus, Retriever, StorageError};
 
 /// Attack Category either set by script_category
 ///
@@ -460,6 +460,10 @@ pub trait NvtDispatcher<K> {
     fn dispatch_kb(&self, _: &K, _: Kb) -> Result<(), StorageError> {
         Ok(())
     }
+    /// Stores an advisory
+    fn dispatch_advisory(&self, _: &K, _: Notus) -> Result<(), StorageError> {
+        Ok(())
+    }
 }
 
 /// Collects the information while being in a description run and calls the dispatch method
@@ -530,6 +534,7 @@ where
         match scope {
             Field::NVT(nvt) => self.store_nvt_field(nvt),
             Field::KB(kb) => self.dispatcher.dispatch_kb(key, kb),
+            Field::NOTUS(adv) => self.dispatcher.dispatch_advisory(key, adv),
         }
     }