dependency-check / dependency-check/DependencyCheck
OSSIndexAnalyzer cannot parse some CVSS vector strings
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Describe the bug**
At time of writing OSSIndex/Guide results for this library cannot be parsed.
```
Failed to fetch component-report for: pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE
java.lang.IllegalArgumentException: L
at io.github.jeremylong.openvulnerability.client.nvd.ValueMappable.getOrThrow(ValueMappable.java:60)
at io.github.jeremylong.openvulnerability.client.nvd.VectorMappable.lambda$create$1(VectorMappable.java:53)
at io.github.jeremylong.openvulnerability.client.nvd.CvssV2Data$CiaType.fromValue(CvssV2Data.java:631)
at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.transform(OssIndexAnalyzer.java:399)
at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.lambda$enrich$0(OssIndexAnalyzer.java:335)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:214)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1716)
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:570)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:560)
at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:153)
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:176)
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:265)
at java.base/java.util.stream.ReferencePipeline.forEachOrdered(ReferencePipeline.java:637)
at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.enrich(OssIndexAnalyzer.java:336)
at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.analyzeDependency(OssIndexAnalyzer.java:204)
at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131)
```
**Version of dependency-check used**
13.0.0 via Gradle
**To Reproduce**
Will attach better steps later, but scan a POm with the above dependency in it with OSSindex credentials set should be enough.
**Expected behavior**
Vulns should be able to be parsed
**Additional context**
The code seems to be falling back to a CVSS2 parse and then seeing an L for CIA type, which is invalid. Probably need to check the raw response and figure out if the data is bad, or the parsing is bad.
https://github.com/dependency-check/DependencyCheck/blob/02bb473c96a26353804d875f2bd39f35c9d96558/core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java#L378-L396
Contributor guide
Assessment
This issue has not been assessed yet.