Failed to Generate Vulnerability Signature
- Dominant language
- Python
- Stars
- 364
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
Hello, I would like to add support for GitHub commit signature generation by enhancing the `code_extractor`. Before proceeding, I tested the command:
```bash
$ ./bazel-bin/sign_generator_runner --vulnerability_file_name=/mnt/d/vanir/test/tty1.json --signature_file_name=/mnt/d/vanir/test/op.json
```
The content of `tty1.json` is:
```json
[
{
"id": "ASB-A-244395411",
"details": "In pipe_resize_results of pipe.c, there is a possible UAF bug caused by a race condition. This could lead to local denial of service and local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. ",
"aliases": [
"A-244395411",
"CVE-2022-2959"
],
"modified": "2024-11-06T12:16:03.231308Z",
"published": "2023-01-01T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://source.android.com/security/bulletin/2023-01-01"
},
{
"type": "FIX",
"url": "https://android.googlesource.com/kernel/common/+/a2c2b6c91475908e2ac90a3d70f5d12ae86b8033"
}
],
"affected": [
{
"package": {
"name": ":linux_kernel:",
"ecosystem": "Android"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": ":0"
},
{
"fixed": ":2023-01-05"
}
]
}
],
"versions": [
"Kernel"
],
"database_specific": {
"source": "https://storage.googleapis.com/android-osv/ASB-A-244395411.json"
}
}
],
"schema_version": "1.6.0"
}]
```
However, this operation did not output the signature for the vulnerability. Instead, it only added an empty `"ecosystem_specific": {}` under `affected`. Could this be due to an incorrect usage on my part?
Contributor guide
Assessment
This issue has not been assessed yet.