l3montree-dev / l3montree-dev/devguard
Searching for CVE does not return result if CVE is an alias
Open
Nobody has claimed this yet.
bug
- Dominant language
- Go
- Stars
- 161
- Forks
- 43
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 37
Description
Describe the bug
When searching with a CVE there is no result when the CVE is only an alias for risk.
Example:
- Risk: GHSA-86p9-x5pw-94qx
- Alias: CVE-2017-9096
Searching for: GHSA-86p9-x5pw-94qx -> 1 result
Searching for: CVE-2017-9096 -> no result
Screenshots
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the two searches using GHSA-86p9-x5pw-94qx and its alias CVE-2017-9096, then trace the backend search entry point and how vulnerability aliases are indexed or matched. Done means searching by the CVE alias returns the same risk result as searching by the GHSA identifier.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, search, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100