Ability to blacklist CPE patterns for specific Nixpkgs packages?

[primeos]

I've just noticed a few false positives, basically a all duplicates of the following two issues:

• Vulnerability roundup 84: git-2.26.2: 4 advisories NixOS/nixpkgs#88303
• Vulnerability roundup 84: fuse-3.9.1: 1 advisory NixOS/nixpkgs#88295

Because e.g. cpe:2.3:a:jenkins:git:*:*:*:*:*:jenkins:*:* matched for Git (while it's for the Jenkins Git plugin) and cpe:2.3:a:redhat:fuse:*:*:*:*:*:*:*:* matched for fuse (while it's for Red Hat Fuse instead of libfuse).

There will obviously always be some false positive but I was wondering if we could do something about these two cases. Either by changing the matching algorithm or maintaining a blacklist (e.g. jenkins:git != git (there's also gitFull so maybe using pname would actually be better))?

(Note: I'm unfortunately not familiar with the current implementation.)

[ckauhaus]

Interesting idea. Need to think about how to extend vulnix' matching code.

[ckauhaus]

See also NixOS/nixpkgs#75974

[ckauhaus]

See also https://nvd.nist.gov/vuln/detail/CVE-2019-11644 (from NixOS/nixpkgs#88393)

[ckauhaus]

See also NixOS/nixpkgs#88405 (comment)

[ckauhaus]

See also NixOS/nixpkgs#88371

[ckauhaus]

Another instance: NixOS/nixpkgs#90831 (comment)

[ckauhaus]

And NixOS/nixpkgs#90950

[ckauhaus]

NixOS/nixpkgs#90835

[ckauhaus]

NixOS/nixpkgs#90838

[ckauhaus]

NixOS/nixpkgs#91036

[ckauhaus]

NixOS/nixpkgs#90777

[ckauhaus]

NixOS/nixpkgs#90953

[ckauhaus]

NixOS/nixpkgs#90902

[ckauhaus]

NixOS/nixpkgs#91039

[ckauhaus]

NixOS/nixpkgs#90944

[ckauhaus]

NixOS/nixpkgs#92032

[ckauhaus]

NixOS/nixpkgs#92029

[ckauhaus]

NixOS/nixpkgs#92062

[ckauhaus]

NixOS/nixpkgs#92871

[ckauhaus]

NixOS/nixpkgs#92864 - disregard gitlab enterprise edition

[ckauhaus]

NixOS/nixpkgs#93270 (comment)

[ckauhaus]

NixOS/nixpkgs#92068 (comment)

[ckauhaus]

Misinterpretation of terraform-provide-aws NixOS/nixpkgs#96829

[ckauhaus]

flyingcircusio/nixpkgs#620

[ckauhaus]

NixOS/nixpkgs#88280

[ckauhaus]

NixOS/nixpkgs#99825 (comment)

[ckauhaus]

NixOS/nixpkgs#100314 (comment)

[ckauhaus]

Need to disambiguate between firefox and firefox_esr, e.g. in https://nvd.nist.gov/vuln/detail/CVE-2020-15655

Seen in NixOS/nixpkgs#101152

[ckauhaus]

Jenkins InfluxDB plugin: NixOS/nixpkgs#102795

[ckauhaus]

Jenkins Kanboard plugin: NixOS/nixpkgs#102798

[ckauhaus]

KeystoneJS NixOS/nixpkgs#102800

[ckauhaus]

MySQL component of Oracle SQL: NixOS/nixpkgs#102883

[ckauhaus]

matrix-synapse: NixOS/nixpkgs#102901

[ckauhaus]

Jetbrains Scala project (plugin) NixOS/nixpkgs#100322

[ckauhaus]

Styx: Java reverse proxy (https://github.com/HotelsDotCom/styx) vs static site generator: NixOS/nixpkgs#90985

[ckauhaus]

HP/Aruba airwave vs Airwave media player: NixOS/nixpkgs#99730 (comment)

[ckauhaus]

diamond-0.8.36: cryptocurrency vs bioinformatics NixOS/nixpkgs#90781

[ckauhaus]

connect-1.105: proxy vs Adobe product NixOS/nixpkgs#90741

[ckauhaus]

unicode-2.6: nodejs vs Python lib

[ckauhaus]

st-0.8.3: node.js app vs. terminal emulator

[ckauhaus]

gatling-0.15: Jenkins plugin vs webserver

[ckauhaus]

fastjson-0.99.8: Java vs C library

[ckauhaus]

drive-0.3.8.1: Synology app vs Google drive client

[ckauhaus]

drill-0.6.0: Apache drill vs. Rust-based load tester

[ckauhaus]

gogs-0.12.3: Jenkins plugin vs standalone Go app

[ckauhaus]

openssl C library vs Ruby gem: NixOS/nixpkgs#106218 (comment)

[ckauhaus]

Aviatrix OpenVPN client vs. openvpn core: NixOS/nixpkgs#106219 (comment)

[ckauhaus]

Jenkins findbugs plugin: NixOS/nixpkgs#106190 (comment)

[ckauhaus]

Jenkins InfluxDB plugin: NixOS/nixpkgs#106198 (comment)

[ckauhaus]

built-in php calendar extension vs. PECL calendera extension: NixOS/nixpkgs#106226 (comment)

[ckauhaus]

GNOME Orca vs. Spinnaker Orca: NixOS/nixpkgs#106220 (comment)

[LeSuisse]

HashiCorp Vault vs. TIBCO Managed File Transfer Internet Server: NixOS/nixpkgs#109227 (comment)

[ckauhaus]

A lot of stuff. I've been tinkering with this issues for a while now and my current idea is not to use a blacklist but to include a cpe metadata field directly in the derivation for all cases where an implicit default like cpe:2.3:a:*:${pname}:${version}::::::: doesn't get it. Quite short on time ftm, but things will relax soon.

[ckauhaus]

firefox ESR/regular, Linux/Android: NixOS/nixpkgs#113435 (comment)

[ztzg]

A lot of stuff. I've been tinkering with this issues for a while now and my current idea is not to use a blacklist but to include a cpe metadata field directly in the derivation for all cases where an implicit default like cpe:2.3:a:*:${pname}:${version}::::::: doesn't get it. Quite short on time ftm, but things will relax soon.

Was pondering the same. Have you discussed this possibility with Eelco and/or other Nixpkgs contributors? "Polluting" Nixpkgs might not be the nicest thing, but meta seems to be the best place to set/override some of the CPE attributes.