aboutcode-org / aboutcode-org/vulnerablecode

Handle Gitlab false positive

Offen
#1,447 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
data-quality
Vorherrschende Sprache
Python
Sterne
702
Forks
328
Ø Merge
3 T. 8 Std.
Gemergte PRs (30 T.)
3

Beschreibung

This https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.owasp.antisamy/antisamy/CVE-2023-49093.yml started as an advisory and then became a "False positive"
Gitlab updates the description and title in these cases, and there are 150+ such advisories.

The outcome is invalid data. We should support these and update accordingly

See https://public.vulnerablecode.io/packages/pkg:maven/org.owasp.antisamy/antisamy@1.7.4?search=antisamy

There https://public.vulnerablecode.io/vulnerabilities/VCID-zx5k-4m3n-aaaj does NOT apply to antisamy

![Screenshot 2024-03-26 at 12-38-37 VulnerableCode Package Details - pkg maven_org owasp antisamy_antisamy@1 7 4](https://github.com/nexB/vulnerablecode/assets/675997/03f0f950-c716-4511-9a90-245272f43e33)

See attached for a list of patterns found in GitLab advisories
[fp.txt](https://github.com/nexB/vulnerablecode/files/14757642/fp.txt)

@julianthome gentle ping... do you know if there is a list of patterns we can track? Thanks!

In the same domain, we should also find is there are other related unstructured patterns in GitLab and also:
- [ ] Handle "Disputed" markers in CVEs texts
- [ ] Handle "Awaiting Analysis" in CVEs

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.