stevespringett
commented
3 years ago Looks like GitHub isn't correlating vulnerability identifiers properly. This is a defect in GitHub and should be resolved by them.
As an example, I will take npm advisory 1673 which affects lodash.
Pagination of npm advisories will return the following snippet (currently accessible at https://registry.npmjs.org/-/npm/v1/security/advisories?perPage=20&page=4)
{
"access": "public",
"created": "2021-05-06T16:14:39.514Z",
"cves": [
"CVE-2021-23337"
],
"cwe": "CWE-77",
"deleted": null,
"found_by": {
"email": "",
"link": "",
"name": "Anonymous"
},
"id": 1673,
"metadata": {
"affected_components": "",
"exploitability": 7,
"module_type": ""
},
"module_name": "lodash",
"overview": "`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
"patched_versions": ">=4.17.21",
"recommendation": "Upgrade to version 4.17.21 or later",
"references": "- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23337)\n- [GitHub Advisory](https://github.com/advisories/GHSA-35jh-r3h4-6jhm)\n- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-LODASH-1040724)",
"reported_by": {
"email": "",
"link": "",
"name": "Anonymous"
},
"severity": "high",
"title": "Command Injection",
"updated": "2021-05-06T16:24:12.299Z",
"vulnerable_versions": "<4.17.21"
}However, when performing an npm audit against lodash 4.17.15, the following snippet is returned:
"1002847": {
"access": "public",
"created": "2021-10-07T07:31:50.564Z",
"cves": [
"CVE-2021-23337"
],
"cwe": "CWE-77",
"deleted": null,
"findings": [
{
"paths": [
"lodash"
],
"version": "4.17.15"
}
],
"found_by": null,
"github_advisory_id": "GHSA-35jh-r3h4-6jhm",
"id": 1002847,
"metadata": null,
"module_name": "lodash",
"npm_advisory_id": null,
"overview": "`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
"patched_versions": ">=4.17.21",
"recommendation": "Upgrade to version 4.17.21 or later",
"references": "- https://nvd.nist.gov/vuln/detail/CVE-2021-23337\n- https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"reported_by": null,
"severity": "high",
"title": "Command Injection in lodash",
"updated": "2021-03-31T23:59:26.000Z",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"vulnerable_versions": "<4.17.21"
}Dependency-Track mirrors the contents of NPM Advisories and when performing an npm audit, Dependency-Track will look up ID 1002847 but that record does not exist, because that ID does not exist when performing the mirror.
Inserting another record into the DT database will result in duplicate vulnerabilities. In order for me to properly fix this, GitHub needs to ensure the value of npm_advisory_id matches what the previous npm advisory ID was. In this case it was 1673. Once this is resolved, I can create a proper fix on my end. Until then, I would recommend disabling the NPM Advisory analyzer and ensure the OSS Index analyzer is enabled.
Mario-Hofstaetter
StyleT
ddurham2
iamrahul127
github-actions[bot]
See https://github.blog/2021-10-07-github-advisory-database-now-powers-npm-audit/
Current Behavior:
Steps to Reproduce:
Upload NPM project with vulnerabilities to DTrack
Expected Behavior:
Should be working as normal
Environment:
Additional Details:
Commit wit temp fix: https://github.com/StyleT/dependency-track/commit/205ab0a66d59fa0f8cb799de8923b7489468aaee
But generally - we need to remove
NpmAdvisoryMirrorTask(now it's useless), and createGithubAdvisoryMirrorTaskwhich would work not only for NPM projects (see API here).