This repository has been archived by the owner on Jan 27, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 273
same non-os vulnerability reported in github and nvdv2 namespaces #893
Milestone
Comments
nightfurys
pushed a commit
that referenced
this issue
Feb 2, 2021
…hey are reported by other namespaces Fixes #893 Signed-off-by: Swathi Gangisetty <swathi@anchore.com>
nightfurys
pushed a commit
that referenced
this issue
Feb 2, 2021
…hey are reported by other namespaces Fixes #893 Signed-off-by: Swathi Gangisetty <swathi@anchore.com>
nightfurys
pushed a commit
that referenced
this issue
Feb 2, 2021
…hey are reported by other namespaces Fixes #893 Signed-off-by: Swathi Gangisetty <swathi@anchore.com>
nightfurys
pushed a commit
that referenced
this issue
Feb 2, 2021
- prioritize vulnerabilities from other namespaces over nvd out vulnerabilities - filter duplicates Fixes #893 Signed-off-by: Swathi Gangisetty <swathi@anchore.com>
nightfurys
pushed a commit
that referenced
this issue
Feb 2, 2021
- prioritize vulnerabilities from other namespaces over nvd out vulnerabilities - filter duplicates Fixes #893 Signed-off-by: Swathi Gangisetty <swathi@anchore.com>
robertp
pushed a commit
that referenced
this issue
Feb 3, 2021
- prioritize vulnerabilities from other namespaces over nvd out vulnerabilities - filter duplicates Fixes #893 Signed-off-by: Swathi Gangisetty <swathi@anchore.com> Signed-off-by: Robert Prince <robert.prince@anchore.com>
robertp
pushed a commit
that referenced
this issue
Feb 3, 2021
- prioritize vulnerabilities from other namespaces over nvd out vulnerabilities - filter duplicates Fixes #893 Signed-off-by: Swathi Gangisetty <swathi@anchore.com> Signed-off-by: Robert Prince <robert.prince@anchore.com>
dakaneye
pushed a commit
that referenced
this issue
Mar 10, 2021
- prioritize vulnerabilities from other namespaces over nvd out vulnerabilities - filter duplicates Fixes #893 Signed-off-by: Swathi Gangisetty <swathi@anchore.com> Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com>
robertp
pushed a commit
that referenced
this issue
Mar 11, 2021
* Improve the message and description for vulnerability_data_unavailable and stale_feed_data triggers in the vulnerabilities gate. Fixes #879 Signed-off-by: Zach Hill <zach@anchore.com> * Bump version numbers for 0.9.1 Signed-off-by: Robert Prince <robert.prince@anchore.com> * Multiple policy bundle dirs (#862) * Allow for localconfig to read policy bundles from multiple dirs. Signed-off-by: Daniel Palmer <dan.palmer@anchore.com> * Expect fully-qualifed policy bundle dirs. Signed-off-by: Daniel Palmer <dan.palmer@anchore.com> * Reload policy bundle from file whenever a new bundle dir is added. Signed-off-by: Daniel Palmer <dan.palmer@anchore.com> * Linting Signed-off-by: Daniel Palmer <dan.palmer@anchore.com> * Linting, again. Signed-off-by: Daniel Palmer <dan.palmer@anchore.com> * Linting commas Signed-off-by: Daniel Palmer <dan.palmer@anchore.com> * Fix test. Signed-off-by: Daniel Palmer <dan.palmer@anchore.com> * Code review comments, add some extra logging and another test. Signed-off-by: Daniel Palmer <dan.palmer@anchore.com> * Linting Signed-off-by: Daniel Palmer <dan.palmer@anchore.com> * Fix method name to match parent class Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com> * Removed ui from swagger url Signed-off-by: Zane Burstein <zane.burstein@anchore.com> * Add ability to support multiple grant types for the oauth client Signed-off-by: Zach Hill <zach@anchore.com> * Update Dockerfile to use UBI 8.3. Fixes #888 Signed-off-by: Zach Hill <zach@anchore.com> * Update CHANGELOG.md for 0.9.1 Signed-off-by: Zach Hill <zach@anchore.com> * Fix confusing typo in changelog Signed-off-by: Zach Hill <zach@anchore.com> * Update syft to v0.12.5 Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * add bundles/ dir to anchore_service_dir Signed-off-by: Brady Todhunter <bradyt@anchore.com> * Updates to vulnerability listing dedup logic - prioritize vulnerabilities from other namespaces over nvd out vulnerabilities - filter duplicates Fixes #893 Signed-off-by: Swathi Gangisetty <swathi@anchore.com> * Set the python package location according to the package key, which is the absolute path (#895) Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com> * Update the scanner config method in policy engine for providing overr… (#896) * Update the scanner config method in policy engine for providing overridable functions for vuln and cpe results. Adds use of that in the vulnerability policy gate Signed-off-by: Zach Hill <zach@anchore.com> * first draft at a dedup pass Signed-off-by: Swathi Gangisetty <swathi@anchore.com> * Try to load Policy Engine ImageCpes from syft generated cpes, with fallback to fuzzy matching Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com> * Add unit test for loader paths Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com> * include update and meta into cpe comparison Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com> * fix return type Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com> * Unit tests for cpe comparisons used for vulnerability dedup Signed-off-by: Swathi Gangisetty <swathi@anchore.com> * Downgrade empty content log message to debug level Signed-off-by: Swathi Gangisetty <swathi@anchore.com> * tests: change previous invalid schema for integers/floats According to draft-6 which the new jsonschema supports 1.0 is considered an integer. Relevant doc from the draft: In draft-04, "integer" is listed as a primitive type and defined as “a JSON number without a fraction or exponent part”; in draft-06, "integer" is not considered a primitive type and is only defined in the section for keyword "type" as “any number with a zero fractional part”; 1.0 is thus not a valid "integer" type in draft-04 and earlier, but is a valid "integer" type in draft-06 and later; note that both drafts say that integers SHOULD be encoded in JSON without fractional parts Link https://json-schema.org/draft-06/json-schema-release-notes.html Signed-off-by: Alfredo Deza <adeza@anchore.com> (cherry picked from commit 2f859a1) * requirements: bump jsonschema to avoid legacy validator import issues Signed-off-by: Alfredo Deza <adeza@anchore.com> (cherry picked from commit 99dcb10) * Update syft to 0.12.7 to fix analysis failure due to syft parsing issue. Fixes #910 Signed-off-by: Zach Hill <zach@anchore.com> * Update cryptography lib to 3.3.2 from 3.3.1. Fixes #909 Signed-off-by: Zach Hill <zach@anchore.com> * add package filtering by relationships Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * Fix the client metadata merge process during oauth init. Fixes #931 Signed-off-by: Zach Hill <zach@anchore.com> * Bump version Signed-off-by: Robert Prince <robert.prince@anchore.com> * Add default admin pw to e2e test values file Signed-off-by: Robert Prince <robert.prince@anchore.com> * Make sure to return content correctly for manifest and dockerfile content types Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com> * [docs] 0.9.2 release notes and changelog updates. includes missing release notes for 0.9.1 (#939) Updates CHANGELOG for 0.9.2 and adds 0.9.1 and 0.9.2 release notes Also fixes ordering problem in release notes page Signed-off-by: Zach Hill <zach@anchore.com> * Update Quickstart Docker-Compose image tag to v0.9.2 Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com> * Iterate API patch version 0.1.16->0.1.17 Signed-off-by: Samuel Dacanay <sam.dacanay@anchore.com> * Add distro mapping from "redhat" to "rhel" for vuln matching Signed-off-by: Zach Hill <zach@anchore.com> * Adds distro mapper in import path to ensure rhel instead of redhat distro name Signed-off-by: Zach Hill <zach@anchore.com> * Fix integration tests that used redhat as a negative test example Signed-off-by: Zach Hill <zach@anchore.com> Co-authored-by: Zach Hill <zach@anchore.com> Co-authored-by: Dan Palmer <dan.palmer@anchore.com> Co-authored-by: Samuel Dacanay <sam.dacanay@anchore.com> Co-authored-by: Zane Burstein <zane.burstein@anchore.com> Co-authored-by: Dan Luhring <dan.luhring@anchore.com> Co-authored-by: Brady Todhunter <bradyt@anchore.com> Co-authored-by: Swathi Gangisetty <swathi@anchore.com> Co-authored-by: Alfredo Deza <adeza@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
A recent change to the dedup logic is causing the same CVE to be listed both in nvdv2 and githubu namespace. This is a regression from 0.9.0
The text was updated successfully, but these errors were encountered: