search

nix-community / vulnix

Vulnerability (CVE) scanner for Nix/NixOS.
BSD 3-Clause "New" or "Revised" License
476 stars 36 forks source link

Incorrect processing of "until" field in whitelist #43

Closed ckauhaus closed 5 years ago

ckauhaus commented 6 years ago

vulnix finds advisories against libtiff-4.0.9 today (2018-07-26):

$ vulnix --system
libtiff-4.0.9

CVEs:
        CVE-2017-17095
        CVE-2017-17942
        CVE-2018-10126
        CVE-2018-10963
        CVE-2018-5784
        CVE-2018-7456
        CVE-2018-8905

I would expect that a whitelist entry like

["libtiff"]
cve = ["CVE-2017-17942"]
issue_url = "https://fb.flyingcircus.io/f/cases/104752/"
until = "2018-08-30"

would make the second listed CVE disappear, but it does not do anything. After removing the until clause, everything works as expected.