-
Notifications
You must be signed in to change notification settings - Fork 147
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add Rust ecosystem from GHSA and disable from OSV #241
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
knqyf263
reviewed
Sep 1, 2022
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks like you added a JSON file, but not the expected value in DB.
trivy-db/pkg/vulnsrc/ghsa/ghsa_test.go
Lines 38 to 56 in 49b1399
{ | |
Key: []string{"vulnerability-detail", "CVE-2019-19745", ghsaDir}, | |
Value: types.VulnerabilityDetail{ | |
ID: "CVE-2019-19745", | |
Title: "Unrestricted file uploads in Contao", | |
Description: "### Impact\n\nA back end user with access to the form generator can upload arbitrary files and execute them on the server.\n\n### Patches\n\nUpdate to Contao 4.4.46 or 4.8.6.\n\n### Workarounds\n\nConfigure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.\n\n### References\n\nhttps://contao.org/en/security-advisories/unrestricted-file-uploads.html\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).", | |
References: []string{ | |
"https://github.com/contao/contao/security/advisories/GHSA-wjx8-cgrm-hh8p", | |
"https://nvd.nist.gov/vuln/detail/CVE-2019-19745", | |
"https://contao.org/en/news.html", | |
"https://contao.org/en/security-advisories/unrestricted-file-uploads.html", | |
"https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19745.yaml", | |
"https://github.com/advisories/GHSA-wjx8-cgrm-hh8p", | |
}, | |
Severity: types.SeverityHigh, | |
CvssScoreV3: 8.8, | |
CvssVectorV3: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", | |
}, | |
}, |
yea, you're right. added |
afdesk
changed the title
feat: add Rust ecosystem from GitHub Advisory Database
feat: add Rust ecosystem from GHSA and disable from OSV
Oct 24, 2022
knqyf263
approved these changes
Oct 25, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Trivy DB should contain data from GitHub Advisory Database for Rust ecosystem: https://github.com/advisories?query=type%3Areviewed+ecosystem%3Arust
Related PRs