aboutcode-org / aboutcode-org/vulnerablecode

Handle Gitlab false positive

Ouverte
#1,447 2 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
data-quality
Langage dominant
Python
Étoiles
702
Forks
328
Merge moyen
3 j 8 h
PR mergées (30 j)
3

Description

This https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.owasp.antisamy/antisamy/CVE-2023-49093.yml started as an advisory and then became a "False positive"
Gitlab updates the description and title in these cases, and there are 150+ such advisories.

The outcome is invalid data. We should support these and update accordingly

See https://public.vulnerablecode.io/packages/pkg:maven/org.owasp.antisamy/antisamy@1.7.4?search=antisamy

There https://public.vulnerablecode.io/vulnerabilities/VCID-zx5k-4m3n-aaaj does NOT apply to antisamy

![Screenshot 2024-03-26 at 12-38-37 VulnerableCode Package Details - pkg maven_org owasp antisamy_antisamy@1 7 4](https://github.com/nexB/vulnerablecode/assets/675997/03f0f950-c716-4511-9a90-245272f43e33)

See attached for a list of patterns found in GitLab advisories
[fp.txt](https://github.com/nexB/vulnerablecode/files/14757642/fp.txt)

@julianthome gentle ping... do you know if there is a list of patterns we can track? Thanks!

In the same domain, we should also find is there are other related unstructured patterns in GitLab and also:
- [ ] Handle "Disputed" markers in CVEs texts
- [ ] Handle "Awaiting Analysis" in CVEs

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.