Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

VULNERABILITY.SEVERITY should be updated in database #2474 #3151

Closed
wants to merge 25 commits into from
Closed

VULNERABILITY.SEVERITY should be updated in database #2474 #3151

wants to merge 25 commits into from

Conversation

mge-mm
Copy link
Contributor

@mge-mm mge-mm commented Oct 27, 2023 •
edited
Loading

Description

The severity value of a vulnerability is now calculated before creating the vulnerability. With this change, it is impossible that the severity field of a vulnverabilty is null in the database when a vulnerability is created.

This PR added a upgrade script (v4110) which recomputes all database severity values with value NULL of a vulnerability and updates them in the database. This is necessary because there are existing vulnerabilities in the database which have a severity value of NULL. These vulnerabilities are not effected by the changes above and their severity values have to be recalculated separately.

Addressed Issue

#2474

Checklist

  • I have read and understand the contributing guidelines
    - [ ] This PR fixes a defect, and I have provided tests to verify that the fix is effective
    - [ ] This PR implements an enhancement, and I have provided tests to verify that it works as intended
  • This PR introduces changes to the database model, and I have added corresponding update logic
    - [ ] This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

@mge-mm mge-mm force-pushed the dependency-track-2474 branch from 2115578 to fbc1e0f Compare October 27, 2023 11:01
@mge-mm mge-mm changed the title Dependency track 2474 VULNERABILITY.SEVERITY should be updated in database #2474 Oct 27, 2023
@rkg-mm rkg-mm mentioned this pull request Oct 27, 2023
Merged
2 tasks
@mge-mm mge-mm force-pushed the dependency-track-2474 branch from a45b10c to 4a131c6 Compare November 3, 2023 11:57
@nscuro
Copy link
Member

nscuro commented Nov 3, 2023

Thanks for the PR @mge-mm, I'll get this reviewed over the weekend.

This PR added a upgrade script (v4110) which recomputes all database severity values with value NULL of a vulnerability and updates them in the database.

Have you tested how long this takes on an instance that has the entire NVD (and / or GitHub Advisories, OSV) mirrored? Because the DB upgrades are executed before health- and liveliness checks are registered, a prolonged upgrade could cause issues with Kubernetes deployments.

@mge-mm
Copy link
Contributor Author

mge-mm commented Nov 8, 2023

Hello @nscuro,
I did not test how long it takes explicitly. While testing, the NVD DB mirroring was enabled and i could not recognize any delay in the process. If needed, I can test this again and share the amount of time taken by the DB upgrade.

nscuro and others added 8 commits November 8, 2023 15:19
@nscuro @mge-mm
Fix project cloning allowing for duplicate versions
362aec6 
Also fixed:

* services not being cloned, despite `includeServices` being set to `true`.
* ACLs not being enforced for the `/clone` endpoint

And added tests for cloning that were previously missing.

Signed-off-by: nscuro <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
test
695eed3 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
test
a4845a6 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
database-mismatch-solution
df32096 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
PR changes
5583b09 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
upgrade version change
c9a45f6 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
unit tests
668e62e 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
createVulnerabilityTest fix
e1924e3 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm mge-mm force-pushed the dependency-track-2474 branch from 832f63f to e1924e3 Compare November 8, 2023 14:20
mge-mm and others added 15 commits November 17, 2023 12:06
@mge-mm
test
0b499fd 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
test
8083cfb 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
database-mismatch-solution
7b6732c 
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
upgrade version change
605791d 
Signed-off-by: Marlon Gaethje <[email protected]>
@nscuro @mge-mm
Fix @JsonIgnore having no effect on transient fields
a8b5e58 
A (more or less intentional) regression in Jackson 2.15 causes `@JsonIgnore` annotations on `transient` fields to be ignored. As a workaround, the annotation can be added to getters and setters instead (FasterXML/jackson-databind#3909 (comment)).

Signed-off-by: nscuro <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@dependabot @mge-mm
Bump debian from 0941f9e to 3fd8144 in /src/main/docker
a00292d 
Bumps debian from `0941f9e` to `3fd8144`.

---
updated-dependencies:
- dependency-name: debian
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@nscuro @mge-mm
Bump Alpine to 2.2.3
ae38a8a 
Signed-off-by: Niklas <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@nscuro @mge-mm
Add API key prefix odt_
7a5eb05 
Overriding the default `alpine_` prefix. Support for API key prefixes was added in stevespringett/Alpine#496

Signed-off-by: nscuro <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@nscuro @mge-mm
Remove misleading configuration options
df497ea 
Removes `alpine.enforce.authentication` and `alpine.enforce.authorization` from `application.properties` and documentation. Settings those values to `false` is not supported.

Fixes DependencyTrack#3043

Signed-off-by: nscuro <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@nscuro @mge-mm
Add alpine.api.key.prefix to documentation
4429a69 
Signed-off-by: nscuro <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@dependabot @mge-mm
Bump actions/checkout from 4.0.0 to 4.1.0
ed354e7 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.0.0...v4.1.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@dependabot @mge-mm
Bump actions/setup-java from 3.12.0 to 3.13.0
0d9671b 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 3.12.0 to 3.13.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v3.12.0...v3.13.0)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@nscuro @mge-mm
Fix VEX export erroneously containing dependency graph
010ecec 
VEX documents are scoped to projects, and do not contain individual components. It makes no sense to include the dependency graph.

This was a regression introduced in DependencyTrack#2657

Signed-off-by: nscuro <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@nscuro @mge-mm
Fix NPE in doesProjectExist when project version is null
4f03d44 
Regression introduced in DependencyTrack#2966

Signed-off-by: nscuro <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@nscuro @mge-mm
Bump temurin base image to 17.0.8.1_1
bfaf392 
Signed-off-by: nscuro <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
msymons and others added 2 commits November 17, 2023 12:21
@msymons @mge-mm
Update cyclonedx-core-java
f4562d6 
Update cyclonedx-core-java to 8.0.0.  Previous version used was SNAPSHOT, so changes have already been tested.

Signed-off-by: Mark Symons <[email protected]>
Signed-off-by: Marlon Gaethje <[email protected]>
@mge-mm
Merge branch 'master' into dependency-track-2474
9fd0b2a 
Signed-off-by: mge-mm <[email protected]>
@mge-mm
Copy link
Contributor Author

mge-mm commented Nov 22, 2023

Hi @nscuro,
to give you a quick update about

Have you tested how long this takes on an instance that has the entire NVD (and / or GitHub Advisories, OSV) mirrored? Because the DB upgrades are executed before health- and liveliness checks are registered, a prolonged upgrade could cause issues with Kubernetes deployments.

It takes about 15 secs to upgrade all Null severities with entire NVD mirrored.

@rkg-mm rkg-mm mentioned this pull request Dec 3, 2023
Open
2 tasks
@nscuro
Copy link
Member

nscuro commented Dec 8, 2023 •
edited
Loading

Thanks @mge-mm! Could you perhaps rebase your changes on top of the current master?

I think during commit sign-off there have been some unwanted modifications of unrelated commits, which I'm afraid I cannot merge like this.

@nscuro nscuro added this to the 4.11 milestone Dec 8, 2023
@nscuro nscuro mentioned this pull request Dec 8, 2023
Merged
5 tasks
This was referenced Dec 10, 2023
Closed
Closed
@rkg-mm
Copy link
Contributor

rkg-mm commented Dec 10, 2023

@nscuro I had to recreate this changes on a new branch. Neither IntelliJ norTortoiseGit was able to reset Marlons branch to a clean state to work from or properly rebase it on the latest master. This was the most buggy rebase i ever saw when I tried :D . Please close this PR and instead check the new PR #3287.

@mge-mm mge-mm closed this Dec 13, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jan 13, 2024
@nscuro nscuro removed this from the 4.11 milestone Jan 24, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@mge-mm @nscuro @rkg-mm @msymons