New feature: VulnDB Aliases! #3588
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In this commit, we have introduced a new feature that computes and synchronizes CVE Aliases for vulnerabilities sourced from VulnDB. By extracting paired CVE information from the nvdAdditionalInfo, we are able to set an Alias. Signed-off-by: Andres Tito <andres.tito@rohde-schwarz.com>
…y-track into VulnDB_Aliases
-Use metric.cveId if nvdAdditionalInfo() is null -There is no need to add a new column in the vulnerability table -Changes were done after a code review. -setAliases in vulndb/ModelConverter.java instead of VulnDbSyncTask. Signed-off-by: Andres Tito <andres.tito@rohde-schwarz.com>
cveId was receiving the value from source and vice versa Signed-off-by: Andres Tito <andres.tito@rohde-schwarz.com>
Signed-off-by: Andres Tito <andres.tito@rohde-schwarz.com>
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferencesYou may notice some variations in coverage metrics with the latest Coverage engine update. For more details, visit the documentation |
nscuro
requested changes
Apr 2, 2024
src/main/java/org/dependencytrack/parser/common/resolver/CveResolver.java
Outdated
Show resolved
Hide resolved
src/main/java/org/dependencytrack/parser/common/resolver/CveResolver.java
Outdated
Show resolved
Hide resolved
src/main/java/org/dependencytrack/parser/vulndb/ModelConverter.java
Outdated
Show resolved
Hide resolved
src/main/java/org/dependencytrack/parser/vulndb/ModelConverter.java
Outdated
Show resolved
Hide resolved
nscuro
added
enhancement
Signed-off-by: Andres Tito <andres.tito@rohde-schwarz.com>
nscuro
approved these changes
Apr 7, 2024
2 tasks
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
VulnDB vulnerabilities now include an Aliases function.
Description
VulnDB is an important vulnerability database that provides great benefit to Dependency Track. Although we can see the assigned CVE ID in the References section, it is not used as an alias.
This PR takes paired CVE and added as an VulnDB Alias.
I am also introducing a ModelConverterTest, which is important to demonstrate the correct conversion between a VulnDB vulnerability object and a Dependency-Track vulnerability object.
Addressed Issue
This PR address the Issue #3580
Additional Details
It is important to verify that the string provided as "CVE" is correct. That is why the getValidCveId function was created and tested. Regex will match any introduced string with the correct CVE pattern.
VulnDB vulnerabilities come with two sources of information: the CVSS and nvdAdditionalInfo fields. The last source will always be preferred over the others. However, in case that field is empty, the cveId from the CVSS fields will be used.
Checklist