False-Positive: CVE-2021-39913 about dep-scan HOT 7 OPEN

@almaz045, 5.6.7 trims down a bit but not a lot. 6.0.1 will be used by depscan v6 which might reduce the false positives a bit more.

The fundamental issue we are dealing with is the need for aliases to match the NVD data which surprisingly has correct information for a few CVEs that are missed by both OSV and GHSA. These aliases are also resulting in false positives.

from dep-scan.

It's matching gitlab:gitlab. We recently added an exclusion to match numpy:numpy for python. Since gitlab itself is developed in ruby, this list is acceptable for pkg:gem. Let me see what could be done to sharpen the alias logic.

from dep-scan.

This commit trims some false positives using sw_edition attributes but not a lot since many NVD entries lack a value for this attribute.

81c980c

from dep-scan.

On vdb6, it works fine since no aliases are involved.

python vdb/cli.py --search "pkg:pypi/[email protected]"

from dep-scan.

I can't run this way:)

vulnerability-db-6.0.1/vdb$ python cli.py --search "pkg:pypi/[email protected]"
Traceback (most recent call last):
  File "/home/user/Desktop/Programs/vulnerability-db-6.0.1/vdb/cli.py", line 15, in <module>
    from vdb.lib import config, db6 as db_lib, search
ImportError: cannot import name 'db6' from 'vdb.lib' (/home/user/.local/lib/python3.10/site-packages/vdb/lib/__init__.py)

When try to install dependencies:

$ poetry install

[tool.poetry] section not found in /home/user/Desktop/Programs/vulnerability-db-6.0.1/pyproject.toml

from dep-scan.

@almaz045, use the pypi version

pip install appthreat-vulnerability-db[all]
vdb --download-image
vdb --bom bomfile

from dep-scan.

$ vdb --search "pkg:pypi/[email protected]"

             ___
  /\  ._  ._  | |_  ._ _   _. _|_
 /--\ |_) |_) | | | | (/_ (_|  |_
      |   |

          VDB Results          
┏━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━┓
┃ CVE ┃ Locator ┃ Description ┃
┡━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━┩
└─────┴─────────┴─────────────┘

Now it works well. Now I need to update vdb to 5.6.7 to avoid the previously noted FPs or does this only work for 6.0.1?

from dep-scan.