Changes in score counting in UI #2322
Replies: 8 comments 12 replies
-
|
The data used for generating the previous responses are: |
Beta Was this translation helpful? Give feedback.
-
|
I'm confused. It would be good if those tests would be in the trustify repo, so that we could find and fix such discrepancies when making backend changes. But I see the point that the UI needs tests too. What I find weird is that the Just peeking at the first, |
Beta Was this translation helpful? Give feedback.
-
|
For I did notice however, that the base score between the vulnerability and the "status" differs by the fact that one seems to include the ADP, while the other doesn't. |
Beta Was this translation helpful? Give feedback.
-
|
The modified date is indeed interesting, as this is the modification date from an ADP entry. which shouldn't affect the entry at all. |
Beta Was this translation helpful? Give feedback.
-
|
@carlosthe19916 which version did you compare? I assume "new" is the most recent main. What is "old"? |
Beta Was this translation helpful? Give feedback.
-
|
What exactly is the "quarkus-bom"? Is it |
Beta Was this translation helpful? Give feedback.
-
|
I just reproduced the setup. Ingesting all advisories. Ingesting I'd like to understand how you ingest documents. As something seems off. |
Beta Was this translation helpful? Give feedback.
-
|
This looks to me like a data issue. The test set contains a CVE file twice for the same CVE:
Depending on the order of ingestion, the tests fail or not. A CVE project file however should not he there twice. But should be ingested in the correct order of being updated. That is ensured by the way CVE projects files are distributed. My recommendation would be to fix the test data, and then test again, in order to verify. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Context:
UI e2e tests consequences:
Testing of quarkus-bom vulnerability count changed:
0 critical, 2 high, 13 medium, 1 low, 0 none, 0 unknown0 critical, 3 high, 10 medium, 1 low, 0 none, 2 unknownOld request:
GET /api/v2/sbom/{id}/advisoryresponse: old.jsonNew request:
GET /api/v3/sbom/{id}/advisorynew.jsonAPI Response Diff:
old.jsonvsnew.json1.
base_scoreisnullfor 3 itemsThese items had
average_score/average_severityvalues in the old format but havebase_score: nullin the new:CVE-2024-26308#CVE-2023-0044#CVE-2023-332012. Score/Severity Value Differences
For 5 items, the
base_scorevalues differ from the oldaverage_score/average_severity:GHSA-j288-q9x7-2f5vGHSA-prj3-ccx8-p6x4#CVE-2023-24815#CVE-2023-2976#CVE-2023-34455This suggests the old
average_scorewas computed (e.g., averaging across all CVSS scores), while the newbase_scorepicks a specific score (likely the highest-versioned CVSS or a designated "base").3. One
modifiedDate ChangeCVE-2024-26308status modified date changed:2025-03-27T19:10:43.565Z→2024-08-02T00:07:19.215Z(went backwards).Beta Was this translation helpful? Give feedback.
All reactions