Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add Rust ecosystem from GHSA and disable from OSV #241

Merged
merged 7 commits into from
Oct 25, 2022

Conversation

afdesk
Copy link
Contributor

@afdesk afdesk commented Aug 25, 2022

Description

Trivy DB should contain data from GitHub Advisory Database for Rust ecosystem: https://github.com/advisories?query=type%3Areviewed+ecosystem%3Arust

Related PRs

@afdesk afdesk marked this pull request as ready for review August 29, 2022 12:56
@afdesk afdesk requested a review from knqyf263 as a code owner August 29, 2022 12:56
Copy link
Collaborator

@knqyf263 knqyf263 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like you added a JSON file, but not the expected value in DB.

{
Key: []string{"vulnerability-detail", "CVE-2019-19745", ghsaDir},
Value: types.VulnerabilityDetail{
ID: "CVE-2019-19745",
Title: "Unrestricted file uploads in Contao",
Description: "### Impact\n\nA back end user with access to the form generator can upload arbitrary files and execute them on the server.\n\n### Patches\n\nUpdate to Contao 4.4.46 or 4.8.6.\n\n### Workarounds\n\nConfigure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.\n\n### References\n\nhttps://contao.org/en/security-advisories/unrestricted-file-uploads.html\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).",
References: []string{
"https://github.com/contao/contao/security/advisories/GHSA-wjx8-cgrm-hh8p",
"https://nvd.nist.gov/vuln/detail/CVE-2019-19745",
"https://contao.org/en/news.html",
"https://contao.org/en/security-advisories/unrestricted-file-uploads.html",
"https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19745.yaml",
"https://github.com/advisories/GHSA-wjx8-cgrm-hh8p",
},
Severity: types.SeverityHigh,
CvssScoreV3: 8.8,
CvssVectorV3: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
},
},

@CLAassistant
Copy link

CLAassistant commented Sep 2, 2022

CLA assistant check
All committers have signed the CLA.

@afdesk
Copy link
Contributor Author

afdesk commented Sep 2, 2022

Looks like you added a JSON file, but not the expected value in DB.

yea, you're right. added

@afdesk afdesk requested a review from knqyf263 September 5, 2022 12:58
@afdesk afdesk changed the title feat: add Rust ecosystem from GitHub Advisory Database feat: add Rust ecosystem from GHSA and disable from OSV Oct 24, 2022
@knqyf263 knqyf263 merged commit 3199f3a into main Oct 25, 2022
@knqyf263 knqyf263 deleted the feat/add-rust-ghsa branch October 25, 2022 08:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants