google / google/osv-scanner

Scan `status` files used by Ubuntu

Open
#1,293 21 comments 0 reactions 0 assignees View on GitHub
enhancement V2 Wishlist
Dominant language
Go
Stars
11k
Forks
792
Avg merge
1d 20h
Merged PRs (30d)
48

Description

**Description**
With the large amount of OSV data from Ubuntu on osv.dev, is there a plan to support `/var/lib/dpkg/status` "lockfiles" on Ubuntu?

For example, using this simplified `/var/lib/dpkg/status` file on a Debian 12 host:
```
Package: base-files
Status: install ok installed
Version: 12.4+deb12u7

Package: openvpn
Status: install ok installed
Version: 2.6.3-1+deb12u2
```
we receive the following vulnerability report when running `$ osv-scanner scan --lockfile 'dpkg-status:/var/lib/dpkg/status'` :
```
╭────────────────────────────────┬──────┬───────────┬─────────┬─────────────────┬────────────────────────────╮
│ OSV URL │ CVSS │ ECOSYSTEM │ PACKAGE │ VERSION │ SOURCE │
├────────────────────────────────┼──────┼───────────┼─────────┼─────────────────┼────────────────────────────┤
│ https://osv.dev/CVE-2024-28882 │ │ Debian:12 │ openvpn │ 2.6.3-1+deb12u2 │ ../var/lib/dpkg/status │
╰────────────────────────────────┴──────┴───────────┴─────────┴─────────────────┴────────────────────────────╯
```

But when we run an equivalent scan on an Ubuntu 24.04 host with the following simplified `/var/lib/dpkg/status` file:
```
Package: base-files
Status: install ok installed
Version: 13ubuntu10.1

Package: openvpn
Status: install ok installed
Version: 2.6.9-1ubuntu4
```
we receive:
```
No issues found
```

What I would like to retrieve is a report like:
```
╭───────────────────────────────────────┬──────┬──────────────────┬─────────┬────────────────┬────────────────────────────╮
│ OSV URL │ CVSS │ ECOSYSTEM │ PACKAGE │ VERSION │ SOURCE │
├───────────────────────────────────────┼──────┼──────────────────┼─────────┼────────────────┼────────────────────────────┤
│ https://osv.dev/UBUNTU-CVE-2024-28882 │ │ Ubuntu:24.04:LTS │ openvpn │ 2.6.9-1ubuntu4 │ ../var/lib/dpkg/status │
╰───────────────────────────────────────┴──────┴──────────────────┴─────────┴────────────────┴────────────────────────────╯
```

Is this functionality able to integrated into osv-scanner?

**To Reproduce**
Steps to reproduce the behaviour:
Run the commands above and check the output.

**Expected behaviour**
The following data should be retrieved:
https://osv.dev/vulnerability/UBUNTU-CVE-2024-28882

cc: @dodys

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.