DependencyTrack / DependencyTrack/dependency-track
OSV Advisory chokes on UBUNTU-CVE-2022-50434
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Observed in apiserver container log:
```
2025-10-22 13:07:12,838 ERROR [Persist] Insert of object "org.dependencytrack.model.VulnerableSoftware@3b53b2dc" using statement "INSERT INTO "VULNERABLESOFTWARE" ("CPE22","CPE23","EDITION","LANGUAGE","OTHER","PART","PRODUCT","PURL","PURL_NAME","PURL_NAMESPACE","PURL_QUALIFIERS","PURL_SUBPATH","PURL_TYPE","PURL_VERSION","SWEDITION","TARGETHW","TARGETSW","UPDATE","UUID","VENDOR","VERSION","VERSIONENDEXCLUDING","VERSIONENDINCLUDING","VERSIONSTARTEXCLUDING","VERSIONSTARTINCLUDING","VULNERABLE") VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)" failed : ERROR: could not read block 32372 in file "base/16384/16886": Invalid argument [osvEcosystem=Ubuntu, vulnId=UBUNTU-CVE-2022-50434]
2025-10-22 13:07:12,840 ERROR [Persist] Insert of object "org.dependencytrack.model.VulnerableSoftware@1d47660" using statement "INSERT INTO "VULNERABLESOFTWARE" ("CPE22","CPE23","EDITION","LANGUAGE","OTHER","PART","PRODUCT","PURL","PURL_NAME","PURL_NAMESPACE","PURL_QUALIFIERS","PURL_SUBPATH","PURL_TYPE","PURL_VERSION","SWEDITION","TARGETHW","TARGETSW","UPDATE","UUID","VENDOR","VERSION","VERSIONENDEXCLUDING","VERSIONENDINCLUDING","VERSIONSTARTEXCLUDING","VERSIONSTARTINCLUDING","VULNERABLE") VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)" failed : ERROR: current transaction is aborted, commands ignored until end of transaction block [osvEcosystem=Ubuntu, vulnId=UBUNTU-CVE-2022-50434]
[... many entries with the same error for the same vulnerability ...]
2025-10-22 13:07:12,848 ERROR [OsvDownloadTask] Failed to process advisory [osvEcosystem=Ubuntu, vulnId=UBUNTU-CVE-2022-50434]
javax.jdo.JDOUserException: One or more instances could not be made persistent
at org.datanucleus.api.jdo.JDOPersistenceManager.makePersistentAll(JDOPersistenceManager.java:755)
at alpine.persistence.AbstractAlpineQueryManager.lambda$persist$3(AbstractAlpineQueryManager.java:336)
at alpine.persistence.Transaction.call(Transaction.java:139)
at alpine.persistence.AbstractAlpineQueryManager.callInTransaction(AbstractAlpineQueryManager.java:542)
at alpine.persistence.AbstractAlpineQueryManager.callInTransaction(AbstractAlpineQueryManager.java:553)
at alpine.persistence.AbstractAlpineQueryManager.persist(AbstractAlpineQueryManager.java:336)
at org.dependencytrack.tasks.OsvDownloadTask.updateDatasource(OsvDownloadTask.java:234)
at org.dependencytrack.tasks.OsvDownloadTask.unzipFolder(OsvDownloadTask.java:168)
at org.dependencytrack.tasks.OsvDownloadTask.inform(OsvDownloadTask.java:142)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:110)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: org.datanucleus.exceptions.NucleusDataStoreException: Insert of object "org.dependencytrack.model.VulnerableSoftware@3b53b2dc" using statement "INSERT INTO "VULNERABLESOFTWARE" ("CPE22","CPE23","EDITION","LANGUAGE","OTHER","PART","PRODUCT","PURL","PURL_NAME","PURL_NAMESPACE","PURL_QUALIFIERS","PURL_SUBPATH","PURL_TYPE","PURL_VERSION","SWEDITION","TARGETHW","TARGETSW","UPDATE","UUID","VENDOR","VERSION","VERSIONENDEXCLUDING","VERSIONENDINCLUDING","VERSIONSTARTEXCLUDING","VERSIONSTARTINCLUDING","VULNERABLE") VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)" failed : ERROR: could not read block 32372 in file "base/16384/16886": Invalid argument
at org.datanucleus.store.rdbms.request.RequestUtil.convertSqlException(RequestUtil.java:41)
at org.datanucleus.store.rdbms.request.InsertRequest.execute(InsertRequest.java:625)
at org.datanucleus.store.rdbms.RDBMSPersistenceHandler.insertObjectInTable(RDBMSPersistenceHandler.java:235)
at org.datanucleus.store.rdbms.RDBMSPersistenceHandler.insertObject(RDBMSPersistenceHandler.java:211)
at org.datanucleus.state.StateManagerImpl.internalMakePersistent(StateManagerImpl.java:4610)
at org.datanucleus.state.StateManagerImpl.makePersistent(StateManagerImpl.java:4587)
at org.datanucleus.ExecutionContextImpl.persistObjectInternal(ExecutionContextImpl.java:2077)
at org.datanucleus.ExecutionContext.persistObjectInternal(ExecutionContext.java:320)
at org.datanucleus.ExecutionContextImpl.persistObjectWork(ExecutionContextImpl.java:1925)
at org.datanucleus.ExecutionContextImpl.persistObjects(ExecutionContextImpl.java:1870)
at org.datanucleus.api.jdo.JDOPersistenceManager.makePersistentAll(JDOPersistenceManager.java:748)
... 12 common frames omitted
Caused by: org.postgresql.util.PSQLException: ERROR: could not read block 32372 in file "base/16384/16886": Invalid argument
at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2734)
at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2421)
at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:372)
at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:518)
at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:435)
at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:196)
at org.postgresql.jdbc.PgPreparedStatement.executeUpdate(PgPreparedStatement.java:157)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeUpdate(ProxyPreparedStatement.java:61)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeUpdate(HikariProxyPreparedStatement.java)
at org.datanucleus.store.rdbms.SQLController.doExecuteStatementUpdate(SQLController.java:465)
at org.datanucleus.store.rdbms.SQLController.executeStatementUpdateDeferRowCountCheckForBatching(SQLController.java:415)
at org.datanucleus.store.rdbms.request.InsertRequest.execute(InsertRequest.java:532)
... 21 common frames omitted
```
Observed in postgres container log:
```
2025-10-22 15:07:12.835 CEST [179] ERROR: could not read block 32372 in file "base/16384/16886": Invalid argument
2025-10-22 15:07:12.835 CEST [179] STATEMENT: INSERT INTO "VULNERABLESOFTWARE" ("CPE22","CPE23","EDITION","LANGUAGE","OTHER","PART","PRODUCT","PURL","PURL_NAME","PURL_NAMESPACE","PURL_QUALIFIERS","PURL_SUBPATH","PURL_TYPE","PURL_VERSION","SWEDITION","TARGETHW","TARGETSW","UPDATE","UUID","VENDOR","VERSION","VERSIONENDEXCLUDING","VERSIONENDINCLUDING","VERSIONSTARTEXCLUDING","VERSIONSTARTINCLUDING","VULNERABLE") VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26)
RETURNING "ID"
2025-10-22 15:07:12.840 CEST [179] ERROR: current transaction is aborted, commands ignored until end of transaction block
2025-10-22 15:07:12.840 CEST [179] STATEMENT: INSERT INTO "VULNERABLESOFTWARE" ("CPE22","CPE23","EDITION","LANGUAGE","OTHER","PART","PRODUCT","PURL","PURL_NAME","PURL_NAMESPACE","PURL_QUALIFIERS","PURL_SUBPATH","PURL_TYPE","PURL_VERSION","SWEDITION","TARGETHW","TARGETSW","UPDATE","UUID","VENDOR","VERSION","VERSIONENDEXCLUDING","VERSIONENDINCLUDING","VERSIONSTARTEXCLUDING","VERSIONSTARTINCLUDING","VULNERABLE") VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26)
[... many entries with the same error on the same thread ...]
```
### Steps to Reproduce
1. Container deployment with separate PostgreSQL container
2. Turn on Google OSV Advisory mirroring with Ubuntu ecosystem enabled
### Expected Behavior
Send correct SQL queries to db
### Dependency-Track Version
4.13.5
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
15.14
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.