search

github / advisory-database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Creative Commons Attribution 4.0 International
1.72k stars 327 forks source link

Reporting Inaccurate Affected Components in GitHub Advisory Database #2467

Closed catch22out closed 10 months ago

catch22out commented 1 year ago

Dear maintainers of github advisory-database:

We thank GitHub Advisory for providing valuable data to the public. We are utilizing this database for security purposes, and we greatly appreciate the contribution.

During our analysis of the CVE entries, we have identified an issue with the accuracy of the "package" field where the listed affected components does not align with the actual affected components. It can either be incomplete or incorrect.

For instance, in the first entry, CVE-2019-15477 https://github.com/github/advisory-database/blob/6ea0ea8bbfd74f67b7b60b86aac2d0cfe8a6152d/advisories/github-reviewed/2019/08/GHSA-f5f4-m7qp-w6gc/GHSA-f5f4-m7qp-w6gc.json, the database states that the affected component is io.jooby:jooby. However, upon further investigation, we have found that the correct affected component should be org.jooby:jooby, as evidenced by the patch available at https://github.com/jooby-project/jooby/pull/1368/commits/34856a738829d8fedca4ed27bd6ff413af87186f.

Another example is CVE-2018-20094 https://github.com/github/advisory-database/blob/6ea0ea8bbfd74f67b7b60b86aac2d0cfe8a6152d/advisories/github-reviewed/2018/12/GHSA-8j39-fgfp-vxh8/GHSA-8j39-fgfp-vxh8.json, where the same discrepancy occurs. As mentioned in the poc (https://github.com/xuxueli/xxl-conf/issues/61), the ConfController.java line 150 is affected, and this method is located in https://github.com/xuxueli/xxl-conf/blob/6726dfe7979ea6d8fb983771471cde69789de632/xxl-conf-admin/src/main/java/com/xxl/conf/admin/controller/ConfController.java, the affected scope can be more specific: com.xuxueli:xxl-conf-admin.

After thorough examination, we have discovered a total of 64 CVE that contain incorrect or incomplete affected component information. In order to prevent misleading information to end users or false alarms from tools built upon this database, we chose to report these issues to you.

Attached csv document contains 64 records of the erroneous components in the vulnerability database. The fields in the csv file are explained as follows:

For further details, please refer to the attached csv file. We hope our findings are beneficial to the community security.

Attached CSV File: Github.Inaccurate.Affected.Components.csv

If you have any questions or require additional information, please do not hesitate to reach out to us. We kindly request your feedback on the accuracy of our analysis and look forward to receiving your input.

catch22out commented 1 year ago

@taladrane @KateCatlin @shelbyc We thank GitHub Advisory for the valuable data provided. While analyzing CVE entries, we found inaccuracies in the "package" field, with affected components not aligning with the actual ones, possibly being incomplete or incorrect.

The timely and accurate vulnerability information can significantly enhance open-source security. We raised this concern several weeks ago, and now we are considering whether using pull requests instead of issues would be more effective(maybe 64 PRs?)

shelbyc commented 1 year ago

Hi @catch22out, Thank you for bringing these advisories to our attention. At the moment, we're working with reduced staff but can still review each advisory individually. If you're interested in being credited if we find the proposed changes to be accurate, you can make one community contribution pull request for each GHSA. Otherwise, we can go through the CSV when we can and let you know in this issue what we find with respect to each affected product.

catch22out commented 1 year ago

Hi @shelbyc, We've submitted several pull requests, but unfortunately, they haven't been merged into the main branch and the problem of inaccurate components still persists within those GHSA. Consequently, we've shifted our approach to open this issue.

We've also identified inaccuracies in affected components within GitLab. Most of the components we reported were accepted. Recently, we manually pickup the overlap of our reporting between GitHub and GitLab, and we've provided a list of 29 GHSA that have been confirmed by GitLab. The fields "GitLab Feedback" and "GitLab Reference" are introduced to indicate GitLab's acceptance status and acceptance evidence.

We believe this can reduce your workload. If you have any questions or run into any issues, please don't hesitate to contact us. We kindly request your feedback on the accuracy of our analysis and look forward to receiving your input~

taladrane commented 1 year ago

hi @catch22out 👋 thank you so much for your patience on this as we work through it. I want to share an update about this work and ask for some additional information on a few advisories. We've updated the following advisories to match your suggestions:

The following advisories are ones that we either have additional questions about or currently disagree with your feedback:

KateCatlin commented 1 year ago

Hi @catch22out, thank you again for your assistance in finding these errors!

Did this resolve this for you or are there any errors persisting? If it's all resolve, I'll go ahead and close this issue!

catch22out commented 11 months ago

Thank you for all your efforts! You have collectively complete disagree with https://github.com/advisories/GHSA-3448-vfvv-xp9g and https://github.com/advisories/GHSA-grc3-8q8m-4j7c. For the first one, we agree with your decision, SQLite3Parser also appear in tika-parser-sqlite3-module but not vulnerable. For the second one, there are still some questions. The repository is changed and the artifact of accumulo-manager is deleted currently. When roll back to the patched version, the modified vulnerable file is server/manager/src/main/java/org/apache/accumulo/master/MasterClientServiceHandler.java and the pom.xml file in https://github.com/apache/accumulo/blob/64c176eaa29703031e6a4fce9e8d883c6b41424e/server/manager/pom.xml pointed to accumulo-manager. In all, we would like to express our sincere gratitude to GitHub for your recognition and support of our work. We are also very appreciative of your willingness to take the time to address these issues and look forward to making further contributions to the open-source ecosystem in the future🙂.

catch22out commented 11 months ago

Currently, we have discovered some additional inaccuracies in affected components for Ten GHSAs. We also kindly request your attention to these inaccuracies.

taladrane commented 11 months ago

hi @catch22out 👋 thank you for the feedback! We've reviewed and agree with your suggestions for those 10 GHSAs and have made the appropriate updates. Following up on CVE-2020-17533 / GHSA-grc3-8q8m-4j7c, where we still disagree, here is our reasoning:

KateCatlin commented 10 months ago

@catch22out any other questions here or shall we close this issue out?

catch22out commented 10 months ago

Thank you for the discussion. I agree with the conclusion of @taladrane. I believe all aspects of the issue have been addressed. I don't have any further questions at the moment. Let's go ahead and close this issue. Thanks again for your review!