google / google/vanir

the option --package_version not working as expected

Open
#15 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
364
Forks
40
PR merge metrics
No merged PRs in 30d

Description

The flag exposed in vanir as "package_version" defined in vanir/detector_common_flags.py as:

```
One or more package versions your target code is under (e.g. for Android,
this can be "11", "12L", etc.). When given, signatures that are specific
to those versions will be used; signatures specific to other versions
will be ignored. If not given, no versions-specific signatures will be
used...
```
But when called with this flag( --package_version=10,11) as:

`./bazel-bin/detector_runner --target_selection_strategy all_files offline_directory_scanner /srv/scratch/sipp/idcevo-samsung_v9x0-pu2511/Android/packages/services/Telephony/src/com/android/phone/settings/ --vulnerability_file_name ../CVE-2025-32346.json --package_version=10,11`

, it still flags CVE-2025-32346 as unpatched (although the two "versions" in the "affected" entry of the OSV json file (downloaded from https://osv.dev/vulnerability/ASB-A-337785563) is defined as '16' and '16-next'). Which means the option --package_version is not working or not properly implemented

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.