search

aboutcode-org / vulnerablecode

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/
https://public.vulnerablecode.io
Apache License 2.0
526 stars 197 forks source link

Handling of locally patched packagaes #1329

Open keshav-space opened 11 months ago

keshav-space commented 11 months ago

Suppose there is a CVE that affects the package pkg:maven/org.apache.logging.log4j/log4j@2.16.0 and there is no official fix available. In this scenario, I have two options:

  1. Patch the library locally to create a modified version, such as pkg:maven/org.apache.logging.log4j/log4j@2.16.0-patched but do not publish it publicly.

  2. Patch the library and then republish it to maven under new namespace, like pkg:maven/com.example/org.apache.logging.log4j@2.16.0-patched

The second option, for all practical purposes, creates a separate package. However, if I choose the first option and at a later stage, I'm trying to identify vulnerable packages in my project, pkg:maven/org.apache.logging.log4j/log4j@2.16.0-patched should not be reported as vulnerable to the same CVE.

Hritik14 commented 11 months ago

Adding for completeness

>>> original = PackageURL.from_string('pkg:maven/org.apache.logging.log4j/log4j@2.16.0')
>>> patched = PackageURL.from_string('pkg:maven/org.apache.logging.log4j/log4j@2.16.0-patched')

>>> affected_version_range = VersionRange.from_string('vers:maven/>2|<3')
>>> MavenVersion(original.version) in affected_version_range
True
>>> MavenVersion(patched.version) in affected_version_range
True

Perhaps the affected version range will have to be changed on the vulnerablecode client to exclude -patched

>>> affected_version_range = VersionRange.from_string('vers:maven/>2|<3|!=2.16.0-patched')
>>> MavenVersion(original.version) in affected_version_range
True
>>> MavenVersion(patched.version) in affected_version_range
False

This could be achieved by having a user-created advisory with higher confidence.