Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vuln/cmd/govulncheck: vulnerability count does not match vulnerability numbering #56177

Closed
zpavlinovic opened this issue Oct 12, 2022 · 1 comment
Closed

x/vuln/cmd/govulncheck: vulnerability count does not match vulnerability numbering #56177

zpavlinovic opened this issue Oct 12, 2022 · 1 comment
Assignees
@zpavlinovic
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. UX Issues that involve UXD/UXR input vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Milestone
vuln/2022

Comments

@zpavlinovic
Copy link
Contributor

For some projects, govulncheck will report that X vulnerabilities are found and then proceed to listing them in order with their order number. Sometimes X does not match Y, where Y is the number of the last vulnerability listed. For instance, X=11 and Y=12 below:

govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback.

Scanning for dependencies with known vulnerabilities...
Found 11 known vulnerabilities.

[...]

Vulnerability #11: GO-2020-0015
  An attacker could provide a single byte to a UTF16 decoder
  [...]

  Found in: golang.org/x/text/encoding/unicode@v0.3.1-0.20181227161524-e6919f6577db
  Fixed in: golang.org/x/text/encoding/unicode@v0.3.3
  More info: https://pkg.go.dev/vuln/GO-2020-0015

Vulnerability #12: GO-2020-0015
  An attacker could provide a single byte to a UTF16 decoder
  [...]

  Found in: golang.org/x/text/transform@v0.3.1-0.20181227161524-e6919f6577db
  Fixed in: golang.org/x/text/transform@v0.3.3
  More info: https://pkg.go.dev/vuln/GO-2020-0015

The issue is that X is the number of unique OSVs detected while Y is the total number of unique <OSV, package path> pairs detected. This can happen since an OSV can define vulnerable symbols for multiple packages.

The most promising solution is to change the numbering mechanism for Y and combine results for the same OSV. For instance, the contents of Vulnerability #11 and Vulnerability #12 can be merged under a single Vulnerability #11.
@zpavlinovic zpavlinovic added UX Issues that involve UXD/UXR input vulncheck or vulndb Issues for the x/vuln or x/vulndb repo labels Oct 12, 2022
@zpavlinovic zpavlinovic modified the milestones: Backlog, vuln/2022 Oct 12, 2022
@zpavlinovic zpavlinovic added the NeedsFix The path to resolution is known, but the work has not been done. label Oct 12, 2022
@julieqiu julieqiu mentioned this issue Oct 13, 2022
Closed
@gopherbot
Copy link

Change https://go.dev/cl/461646 mentions this issue: cmd/govulncheck: show results per (vulnerability, module) grouping

softdev050 added a commit to softdev050/Golangvuln that referenced this issue Apr 5, 2023
@softdev050
cmd/govulncheck: show results per (vulnerability, module) grouping
0af38c4 
Instead of showing results per each package whose symbols are called, we
now show vulnerabilities instead. We also break each vulnerability by
modules whose symbols have been exercised. Explicit package info is
omitted as it can be deduced from the shown call stacks.

This also fixes the issue of incorrect vulnerability counting. Other
change involve keeping things consistent between the main part and
Informational.

Updates golang/go#56207
Fixes golang/go#56177

Change-Id: I4cc12881443938cd3eb4f581e6689e53daeb28c7
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/461646
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Jonathan Amsterdam <jba@google.com>
sayjun0505 added a commit to sayjun0505/Golangvuln that referenced this issue Apr 8, 2023
@sayjun0505
cmd/govulncheck: show results per (vulnerability, module) grouping
e163b67 
Instead of showing results per each package whose symbols are called, we
now show vulnerabilities instead. We also break each vulnerability by
modules whose symbols have been exercised. Explicit package info is
omitted as it can be deduced from the shown call stacks.

This also fixes the issue of incorrect vulnerability counting. Other
change involve keeping things consistent between the main part and
Informational.

Updates golang/go#56207
Fixes golang/go#56177

Change-Id: I4cc12881443938cd3eb4f581e6689e53daeb28c7
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/461646
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Jonathan Amsterdam <jba@google.com>
stanislavkononiuk added a commit to stanislavkononiuk/Golangvuln that referenced this issue Jun 26, 2023
@stanislavkononiuk
cmd/govulncheck: show results per (vulnerability, module) grouping
bb6c25b 
Instead of showing results per each package whose symbols are called, we
now show vulnerabilities instead. We also break each vulnerability by
modules whose symbols have been exercised. Explicit package info is
omitted as it can be deduced from the shown call stacks.

This also fixes the issue of incorrect vulnerability counting. Other
change involve keeping things consistent between the main part and
Informational.

Updates golang/go#56207
Fixes golang/go#56177

Change-Id: I4cc12881443938cd3eb4f581e6689e53daeb28c7
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/461646
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Jonathan Amsterdam <jba@google.com>
@golang golang locked and limited conversation to collaborators Jan 25, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@zpavlinovic zpavlinovic

Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. UX Issues that involve UXD/UXR input vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Projects
None yet
Milestone
vuln/2022
Development

No branches or pull requests
2 participants
@zpavlinovic @gopherbot