Skip to content

Commit d707b2a

Browse files
tatianabtatianab
committed
internal/report: add YAML field "source"
Adds a new field, source, which holds metadata about the original source of the report. For now, it is either a CVE, a GHSA, or the Go team. This is not required and is not published to OSV, but will assist in our automation efforts. Change-Id: Ief5ea6eca35d8799655b3a86e7a22cf8ff49d4e5 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/576999 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
1 parent bbf0d71 commit d707b2a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+162
-27
lines changed

‎cmd/vulnreport/create.go

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"fmt"
1212
"strconv"
1313
"strings"
14+
"time"
1415

1516
"golang.org/x/vulndb/cmd/vulnreport/log"
1617
"golang.org/x/vulndb/internal/cveclient"
@@ -210,13 +211,7 @@ func reportFromAliases(ctx context.Context, id, modulePath string, aliases []str
210211
}
211212
} else {
212213
log.Infof("no alias found, creating basic report for %s", id)
213-
r = &report.Report{
214-
ID: id,
215-
Modules: []*report.Module{
216-
{
217-
Module: modulePath,
218-
},
219-
}}
214+
r = basicReport(id, modulePath)
220215
}
221216

222217
// Ensure all source aliases are added to the report.
@@ -248,6 +243,11 @@ func reportFromAliases(ctx context.Context, id, modulePath string, aliases []str
248243
}
249244
}
250245

246+
if r.Source != nil {
247+
now := time.Now()
248+
r.Source.Created = &now
249+
}
250+
251251
return r, nil
252252
}
253253

@@ -344,6 +344,9 @@ func basicReport(id, modulePath string) *report.Report {
344344
Module: modulePath,
345345
},
346346
},
347+
Source: &report.Source{
348+
ID: report.SourceGoTeam,
349+
},
347350
}
348351
}
349352

‎internal/genericosv/report.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ func (osv *Entry) ToReport(goID string, pc *proxy.Client) *report.Report {
2828
ID: goID,
2929
Summary: report.Summary(osv.Summary),
3030
Description: report.Description(osv.Details),
31+
Source: &report.Source{
32+
ID: osv.ID,
33+
},
3134
}
3235
addAlias := func(alias string) {
3336
switch {

‎internal/genericosv/testdata/yaml/GHSA-28r2-q6m8-9hpx.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,5 @@ references:
4040
- web: https://github.com/hashicorp/go-getter/releases
4141
notes:
4242
- lint: 'summary: too long (found 115 characters, want <=100)'
43+
source:
44+
id: GHSA-28r2-q6m8-9hpx

‎internal/genericosv/testdata/yaml/GHSA-33m6-q9v5-62r7.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,3 +59,5 @@ notes:
5959
- lint: 'modules[0] "github.com/apptainer/sif": 2 versions do not exist: 1.2.1-0.20180103161547-0ef6afb2f6cd, 1.2.1-0.20180404165556-75cca531ea76'
6060
- lint: 'modules[1] "github.com/satori/go.uuid": vulnerable_at: 1.2.0 is not inside vulnerable range'
6161
- lint: 'summary: must begin with a capital letter'
62+
source:
63+
id: GHSA-33m6-q9v5-62r7

‎internal/genericosv/testdata/yaml/GHSA-3hwm-922r-47hw.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,5 @@ references:
2222
- web: https://github.com/42Atomys/stud42/commit/a70bfc72fba721917bf681d72a58093fb9deee17
2323
notes:
2424
- lint: 'modules[0] "atomys.codes/stud42": version 0.23.0 does not exist'
25+
source:
26+
id: GHSA-3hwm-922r-47hw

‎internal/genericosv/testdata/yaml/GHSA-3wq5-3f56-v5xc.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,5 @@ references:
2727
notes:
2828
- lint: 'modules[0] "github.com/mattermost/mattermost-server": 6 versions do not exist: 7.1.0, 7.1.6, 7.7.0, 7.7.2, 7.8.0, 7.8.1'
2929
- lint: 'modules[1] "github.com/mattermost/mattermost-server/v6": version 7.1.6 does not exist'
30+
source:
31+
id: GHSA-3wq5-3f56-v5xc

‎internal/genericosv/testdata/yaml/GHSA-54q4-74p3-mgcw.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,5 @@ notes:
2121
- lint: 'modules[0] "github.com/zhaojh329/rttys": unsupported_versions: found 1 (want none)'
2222
- lint: 'modules[0] "github.com/zhaojh329/rttys": version 4.0.0 does not exist'
2323
- lint: 'summary: must begin with a capital letter'
24+
source:
25+
id: GHSA-54q4-74p3-mgcw

‎internal/genericosv/testdata/yaml/GHSA-5m6c-jp6f-2vcv.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,5 @@ references:
2222
notes:
2323
- lint: 'description: possible markdown formatting (found ### )'
2424
- lint: 'modules[0] "github.com/oauth2-proxy/oauth2-proxy": 2 versions do not exist: 5.1.1, 6.0.0'
25+
source:
26+
id: GHSA-5m6c-jp6f-2vcv

‎internal/genericosv/testdata/yaml/GHSA-627p-rr78-99rj.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,5 @@ notes:
7171
- lint: 'modules[0] "github.com/concourse/concourse": 4 versions do not exist: 6.3.0, 6.3.1, 6.4.0, 6.4.1'
7272
- lint: 'modules[1] "github.com/concourse/dex": 4 versions do not exist: 6.3.0, 6.3.1, 6.4.0, 6.4.1'
7373
- lint: 'summary: too long (found 115 characters, want <=100)'
74+
source:
75+
id: GHSA-627p-rr78-99rj

‎internal/genericosv/testdata/yaml/GHSA-66p8-j459-rq63.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,5 @@ notes:
4646
- lint: 'description: possible markdown formatting (found [`GHSA-p8r3-83r8-jwj5`](https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5))'
4747
- lint: 'description: possible markdown formatting (found `GHSA-p8r3-83r8-jwj5`)'
4848
- lint: 'summary: too long (found 163 characters, want <=100)'
49+
source:
50+
id: GHSA-66p8-j459-rq63

‎internal/genericosv/testdata/yaml/GHSA-69v6-xc2j-r2jf.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,5 @@ notes:
4444
- lint: 'description: possible markdown formatting (found `dataCopy` (at `0x00...04`)'
4545
- lint: 'modules[1] "github.com/ethereum/go-ethereum": packages[0] "github.com/ethereum/go-ethereum/core/vm": at least one of vulnerable_at and skip_fix must be set'
4646
- lint: 'modules[1] "github.com/ethereum/go-ethereum": version 1.19.7 does not exist'
47+
source:
48+
id: GHSA-69v6-xc2j-r2jf

‎internal/genericosv/testdata/yaml/GHSA-6qfg-8799-r575.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,5 @@ references:
3333
- report: https://github.com/kubernetes/kubernetes/issues/87773
3434
- fix: https://github.com/kubernetes/kubernetes/pull/82143
3535
- web: https://groups.google.com/d/msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ
36+
source:
37+
id: GHSA-6qfg-8799-r575

‎internal/genericosv/testdata/yaml/GHSA-6rg3-8h8x-5xfv.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,5 @@ references:
3030
notes:
3131
- lint: 'description: possible markdown formatting (found ### )'
3232
- lint: 'summary: too long (found 142 characters, want <=100)'
33+
source:
34+
id: GHSA-6rg3-8h8x-5xfv

‎internal/genericosv/testdata/yaml/GHSA-7943-82jg-wmw5.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,3 +132,5 @@ notes:
132132
- lint: 'description: possible markdown formatting (found `--dex-server`)'
133133
- lint: 'modules[0] "github.com/argoproj/argo-cd": version 2.2.11 does not exist'
134134
- lint: 'summary: too long (found 108 characters, want <=100)'
135+
source:
136+
id: GHSA-7943-82jg-wmw5

‎internal/genericosv/testdata/yaml/GHSA-7fxj-fr3v-r9gj.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,5 @@ references:
2626
notes:
2727
- lint: 'modules[0] "github.com/pingcap/tidb": unsupported_versions: found 2 (want none)'
2828
- lint: 'modules[0] "github.com/pingcap/tidb": version 6.2.0 does not exist'
29+
source:
30+
id: GHSA-7fxj-fr3v-r9gj

‎internal/genericosv/testdata/yaml/GHSA-9689-rx4v-cqgc.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,5 @@ references:
2727
notes:
2828
- lint: 'modules[0] "github.com/concourse/concourse": 5 versions do not exist: 5.2.8, 5.3.0, 5.5.10, 5.6.0, 5.8.1'
2929
- lint: 'modules[0] "github.com/concourse/concourse": packages[0] "github.com/concourse/concourse/skymarshal/skyserver": at least one of vulnerable_at and skip_fix must be set'
30+
source:
31+
id: GHSA-9689-rx4v-cqgc

‎internal/genericosv/testdata/yaml/GHSA-cf7g-cm7q-rq7f.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,5 @@ references:
2020
notes:
2121
- lint: 'description: possible markdown formatting (found ### )'
2222
- lint: 'modules[0] "github.com/drakkan/sftpgo": version 2.3.5 does not exist'
23+
source:
24+
id: GHSA-cf7g-cm7q-rq7f

‎internal/genericosv/testdata/yaml/GHSA-fv82-r8qv-ch4v.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,5 @@ notes:
3838
- lint: 'description: possible markdown formatting (found ### )'
3939
- lint: 'description: possible markdown formatting (found [pomerium](http://github.com/pomerium/pomerium))'
4040
- lint: 'summary: must begin with a capital letter'
41+
source:
42+
id: GHSA-fv82-r8qv-ch4v

‎internal/genericosv/testdata/yaml/GHSA-g5gj-9ggf-9vmq.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,5 @@ references:
2525
- web: https://www.debian.org/security/2022/dsa-5041
2626
notes:
2727
- lint: 'description: possible markdown formatting (found ## )'
28+
source:
29+
id: GHSA-g5gj-9ggf-9vmq

‎internal/genericosv/testdata/yaml/GHSA-g9wh-3vrx-r7hg.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,5 @@ references:
2525
notes:
2626
- lint: 'description: possible markdown formatting (found ## )'
2727
- lint: 'summary: too long (found 108 characters, want <=100)'
28+
source:
29+
id: GHSA-g9wh-3vrx-r7hg

‎internal/genericosv/testdata/yaml/GHSA-hjv9-hm2f-rpcj.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,5 @@ references:
3131
- web: https://security.netapp.com/advisory/ntap-20230413-0001/
3232
notes:
3333
- lint: 'modules[0] "github.com/grafana/grafana": 6 versions do not exist: 8.1.0, 8.5.21, 9.0.0, 9.2.13, 9.3.0, 9.3.8'
34+
source:
35+
id: GHSA-hjv9-hm2f-rpcj

‎internal/genericosv/testdata/yaml/GHSA-hmfx-3pcx-653p.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,3 +70,5 @@ notes:
7070
- lint: 'description: possible markdown formatting (found ### )'
7171
- lint: 'description: possible markdown formatting (found [containerd](https://github.com/containerd/containerd/issues/new/choose))'
7272
- lint: 'description: possible markdown formatting (found `"USER $USERNAME"`)'
73+
source:
74+
id: GHSA-hmfx-3pcx-653p

‎internal/genericosv/testdata/yaml/GHSA-hv53-vf5m-8q94.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,5 @@ notes:
5757
- lint: 'description: possible markdown formatting (found [C#](https://github.com/advisories/GHSA-qv8q-v995-72gr))'
5858
- lint: 'modules[0] "github.com/personnummer/go": version 3.0.1 does not exist'
5959
- lint: 'summary: must begin with a capital letter'
60+
source:
61+
id: GHSA-hv53-vf5m-8q94

‎internal/genericosv/testdata/yaml/GHSA-jh36-q97c-9928.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,5 @@ references:
3131
- web: https://github.com/kubernetes/kubernetes/issues/113757
3232
- web: https://groups.google.com/g/kubernetes-security-announce/c/VyPOxF7CIbA
3333
- web: https://security.netapp.com/advisory/ntap-20230505-0007/
34+
source:
35+
id: GHSA-jh36-q97c-9928

‎internal/genericosv/testdata/yaml/GHSA-jmp2-wc4p-wfh2.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,3 +62,5 @@ notes:
6262
- lint: 'description: possible markdown formatting (found [CVE-2003-0069](https://nvd.nist.gov/vuln/detail/CVE-2003-0069))'
6363
- lint: 'description: possible markdown formatting (found `list`)'
6464
- lint: 'summary: too long (found 144 characters, want <=100)'
65+
source:
66+
id: GHSA-jmp2-wc4p-wfh2

‎internal/genericosv/testdata/yaml/GHSA-pg5p-wwp8-97g8.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,5 @@ notes:
6464
- lint: 'description: possible markdown formatting (found [Slack](https://docs.cilium.io/en/latest/community/community/#slack))'
6565
- lint: 'modules[0] "github.com/cilium/cilium": unsupported_versions: found 1 (want none)'
6666
- lint: 'modules[0] "github.com/cilium/cilium": versions: introduced and fixed versions must alternate'
67+
source:
68+
id: GHSA-pg5p-wwp8-97g8

‎internal/genericosv/testdata/yaml/GHSA-pmfr-63c2-jr5c.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,5 @@ notes:
7171
- lint: 'description: possible markdown formatting (found [Singularity Slack Channel](https://bit.ly/2m0g3lX))'
7272
- lint: 'description: possible markdown formatting (found `legacyinsecure`)'
7373
- lint: 'modules[0] "github.com/sylabs/singularity": version 3.6.0 does not exist'
74+
source:
75+
id: GHSA-pmfr-63c2-jr5c

‎internal/genericosv/testdata/yaml/GHSA-vp35-85q5-9f25.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,3 +112,5 @@ notes:
112112
- lint: 'description: possible markdown formatting (found ### )'
113113
- lint: 'description: possible markdown formatting (found [Open an issue](https://github.com/moby/moby/issues/new))'
114114
- lint: 'description: possible markdown formatting (found `git+<protocol>://...`)'
115+
source:
116+
id: GHSA-vp35-85q5-9f25

‎internal/genericosv/testdata/yaml/GHSA-w4xh-w33p-4v29.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,5 @@ notes:
3232
- lint: 'modules[0] "github.com/git-lfs/git-lfs": version 2.1.1-0.20170519163204-f913f5f9c7c6 does not exist'
3333
- lint: 'modules[1] "github.com/git-lfs/git-lfs": packages[0] "github.com/git-lfs/git-lfs/lfsapi": at least one of vulnerable_at and skip_fix must be set'
3434
- lint: 'modules[1] "github.com/git-lfs/git-lfs": version 2.1.1-0.20170519163204-f913f5f9c7c6 does not exist'
35+
source:
36+
id: GHSA-w4xh-w33p-4v29

‎internal/genericosv/testdata/yaml/GHSA-wx8q-rgfr-cf6v.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,5 @@ references:
2929
notes:
3030
- lint: 'description: possible markdown formatting (found ### )'
3131
- lint: 'summary: too long (found 106 characters, want <=100)'
32+
source:
33+
id: GHSA-wx8q-rgfr-cf6v

‎internal/genericosv/testdata/yaml/GHSA-xmg8-99r8-jc2j.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,3 +74,5 @@ notes:
7474
- lint: 'description: possible markdown formatting (found ### )'
7575
- lint: 'description: possible markdown formatting (found [discussions](https://github.com/argoproj/argo-cd/discussions))'
7676
- lint: 'modules[0] "github.com/argoproj/argo-cd": version 2.1.15 does not exist'
77+
source:
78+
id: GHSA-xmg8-99r8-jc2j

‎internal/genericosv/testdata/yaml/GHSA-xx9w-464f-7h6f.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,5 @@ notes:
4545
- lint: 'description: possible markdown formatting (found ### )'
4646
- lint: 'modules[0] "github.com/goharbor/harbor": version 1.0.0 does not exist'
4747
- lint: 'summary: too long (found 105 characters, want <=100)'
48+
source:
49+
id: GHSA-xx9w-464f-7h6f

‎internal/report/cve.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,9 @@ func cveToReport(c *cveschema.CVE, id, modulePath string) *Report {
8282
Description: description,
8383
Credits: credits,
8484
References: refs,
85+
Source: &Source{
86+
ID: c.Metadata.ID,
87+
},
8588
}
8689
r.addCVE(c.Metadata.ID, getCWE(c), isGoCNA(c))
8790
return r
@@ -142,6 +145,9 @@ func cve5ToReport(c *cveschema5.CVERecord, id, modulePath string) *Report {
142145
Description: description,
143146
Credits: credits,
144147
References: refs,
148+
Source: &Source{
149+
ID: c.Metadata.ID,
150+
},
145151
}
146152

147153
r.addCVE(c.Metadata.ID, getCWE5(&cna), isGoCNA5(&cna))

‎internal/report/ghsa.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ func GHSAToReport(sa *ghsa.SecurityAdvisory, modulePath string, pc *proxy.Client
1717
r := &Report{
1818
Summary: Summary(sa.Summary),
1919
Description: Description(sa.Description),
20+
Source: &Source{
21+
ID: sa.ID,
22+
},
2023
}
2124
var cves, ghsas []string
2225
for _, id := range sa.Identifiers {

‎internal/report/ghsa_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ func TestGHSAToReport(t *testing.T) {
5858
GHSAs: []string{"G1"},
5959
CVEs: []string{"C1"},
6060
References: []*Reference{{Type: "REPORT", URL: "https://github.com/permalink/to/issue/12345"}},
61+
Source: &Source{ID: "G1_blah"},
6162
},
6263
},
6364
{
@@ -78,6 +79,7 @@ func TestGHSAToReport(t *testing.T) {
7879
GHSAs: []string{"G1"},
7980
CVEs: []string{"C1"},
8081
References: []*Reference{{Type: "REPORT", URL: "https://github.com/permalink/to/issue/12345"}},
82+
Source: &Source{ID: "G1_blah"},
8183
},
8284
},
8385
} {

‎internal/report/report.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,20 @@ type Report struct {
238238
// creating the report, outstanding issues, or anything else worth
239239
// mentioning.
240240
Notes []*Note `yaml:",omitempty"`
241+
242+
// Metadata about how this report was generated.
243+
// Not published to OSV.
244+
Source *Source `yaml:",omitempty"`
245+
}
246+
247+
const SourceGoTeam = "go-security-team"
248+
249+
type Source struct {
250+
// The ID (GHSA or CVE) of the original source of this report.
251+
// If created by a human, this is "go-security-team".
252+
ID string `yaml:",omitempty"`
253+
// The time the original auto-generated report was created.
254+
Created *time.Time `yaml:",omitempty"`
241255
}
242256

243257
type Summary string

‎internal/report/testdata/cve/TestCVE5ToReport/CVE-2020-9283.txtar

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright 2023 The Go Authors. All rights reserved.
1+
Copyright 2024 The Go Authors. All rights reserved.
22
Use of this source code is governed by a BSD-style
33
license that can be found in the LICENSE file.
44

@@ -21,3 +21,5 @@ references:
2121
- web: https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
2222
- web: https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
2323
- web: https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
24+
source:
25+
id: CVE-2020-9283

‎internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-27919.txtar

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright 2023 The Go Authors. All rights reserved.
1+
Copyright 2024 The Go Authors. All rights reserved.
22
Use of this source code is governed by a BSD-style
33
license that can be found in the LICENSE file.
44

@@ -19,3 +19,5 @@ references:
1919
- web: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G/
2020
- web: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HM7U5JNS5WU66Q3S26PFIU2ITB2ATTQ4/
2121
- web: https://security.gentoo.org/glsa/202208-02
22+
source:
23+
id: CVE-2021-27919

‎internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-3115.txtar

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright 2023 The Go Authors. All rights reserved.
1+
Copyright 2024 The Go Authors. All rights reserved.
22
Use of this source code is governed by a BSD-style
33
license that can be found in the LICENSE file.
44

@@ -20,3 +20,5 @@ references:
2020
- web: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/
2121
- web: https://security.netapp.com/advisory/ntap-20210219-0001/
2222
- web: https://security.gentoo.org/glsa/202208-02
23+
source:
24+
id: CVE-2021-3115

‎internal/report/testdata/cve/TestCVE5ToReport/CVE-2022-39213.txtar

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright 2023 The Go Authors. All rights reserved.
1+
Copyright 2024 The Go Authors. All rights reserved.
22
Use of this source code is governed by a BSD-style
33
license that can be found in the LICENSE file.
44

@@ -22,3 +22,5 @@ references:
2222
- advisory: https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx
2323
- fix: https://github.com/pandatix/go-cvss/commit/d9d478ff0c13b8b09ace030db9262f3c2fe031f4
2424
- web: https://github.com/pandatix/go-cvss/blob/master/SECURITY.md
25+
source:
26+
id: CVE-2022-39213

‎internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-29407.txtar

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright 2023 The Go Authors. All rights reserved.
1+
Copyright 2024 The Go Authors. All rights reserved.
22
Use of this source code is governed by a BSD-style
33
license that can be found in the LICENSE file.
44

@@ -32,3 +32,5 @@ references:
3232
cve_metadata:
3333
id: CVE-2023-29407
3434
cwe: 'CWE-834: Excessive Iteration'
35+
source:
36+
id: CVE-2023-29407

‎internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-44378.txtar

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright 2023 The Go Authors. All rights reserved.
1+
Copyright 2024 The Go Authors. All rights reserved.
22
Use of this source code is governed by a BSD-style
33
license that can be found in the LICENSE file.
44

@@ -22,3 +22,5 @@ references:
2222
- advisory: https://github.com/Consensys/gnark/security/advisories/GHSA-498w-5j49-vqjg
2323
- report: https://github.com/zkopru-network/zkopru/issues/116
2424
- fix: https://github.com/Consensys/gnark/commit/59a4087261a6c73f13e80d695c17b398c3d0934f
25+
source:
26+
id: CVE-2023-44378

‎internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45141.txtar

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright 2023 The Go Authors. All rights reserved.
1+
Copyright 2024 The Go Authors. All rights reserved.
22
Use of this source code is governed by a BSD-style
33
license that can be found in the LICENSE file.
44

@@ -20,3 +20,5 @@ cves:
2020
- CVE-2023-45141
2121
references:
2222
- advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p
23+
source:
24+
id: CVE-2023-45141

‎internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45283.txtar

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright 2023 The Go Authors. All rights reserved.
1+
Copyright 2024 The Go Authors. All rights reserved.
22
Use of this source code is governed by a BSD-style
33
license that can be found in the LICENSE file.
44

@@ -84,3 +84,5 @@ references:
8484
cve_metadata:
8585
id: CVE-2023-45283
8686
cwe: 'CWE-41: Improper Resolution of Path Equivalence'
87+
source:
88+
id: CVE-2023-45283

0 commit comments

Comments
 (0)