aboutcode-org / aboutcode-org/vulnerablecode
Handle Gitlab false positive
- Ngôn ngữ chính
- Python
- Star
- 702
- Fork
- 328
- Merge trung bình
- 3 ngày 8 giờ
- Pull request đã merge (30 ngày)
- 3
Mô tả
This https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.owasp.antisamy/antisamy/CVE-2023-49093.yml started as an advisory and then became a "False positive"
Gitlab updates the description and title in these cases, and there are 150+ such advisories.
The outcome is invalid data. We should support these and update accordingly
See https://public.vulnerablecode.io/packages/pkg:maven/org.owasp.antisamy/antisamy@1.7.4?search=antisamy
There https://public.vulnerablecode.io/vulnerabilities/VCID-zx5k-4m3n-aaaj does NOT apply to antisamy
See attached for a list of patterns found in GitLab advisories
[fp.txt](https://github.com/nexB/vulnerablecode/files/14757642/fp.txt)
@julianthome gentle ping... do you know if there is a list of patterns we can track? Thanks!
In the same domain, we should also find is there are other related unstructured patterns in GitLab and also:
- [ ] Handle "Disputed" markers in CVEs texts
- [ ] Handle "Awaiting Analysis" in CVEs
Hướng dẫn đóng góp
Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này
Đánh giá
Issue này chưa được đánh giá.