dependency-check / dependency-check/DependencyCheck

OSSIndexAnalyzer cannot parse some CVSS vector strings

Open
#8,763 1 comment 2 reactions 1 assignee Claimed by @chadlwilson View on GitHub
ossindex
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Describe the bug**
At time of writing OSSIndex/Guide results for this library cannot be parsed.

```

Failed to fetch component-report for: pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE
java.lang.IllegalArgumentException: L
at io.github.jeremylong.openvulnerability.client.nvd.ValueMappable.getOrThrow(ValueMappable.java:60)
at io.github.jeremylong.openvulnerability.client.nvd.VectorMappable.lambda$create$1(VectorMappable.java:53)
at io.github.jeremylong.openvulnerability.client.nvd.CvssV2Data$CiaType.fromValue(CvssV2Data.java:631)
at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.transform(OssIndexAnalyzer.java:399)
at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.lambda$enrich$0(OssIndexAnalyzer.java:335)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:214)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1716)
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:570)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:560)
at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:153)
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:176)
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:265)
at java.base/java.util.stream.ReferencePipeline.forEachOrdered(ReferencePipeline.java:637)
at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.enrich(OssIndexAnalyzer.java:336)
at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.analyzeDependency(OssIndexAnalyzer.java:204)
at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131)
```

**Version of dependency-check used**
13.0.0 via Gradle

**To Reproduce**
Will attach better steps later, but scan a POm with the above dependency in it with OSSindex credentials set should be enough.

**Expected behavior**
Vulns should be able to be parsed

**Additional context**
The code seems to be falling back to a CVSS2 parse and then seeing an L for CIA type, which is invalid. Probably need to check the raw response and figure out if the data is bad, or the parsing is bad.

https://github.com/dependency-check/DependencyCheck/blob/02bb473c96a26353804d875f2bd39f35c9d96558/core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java#L378-L396

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.