feat(vulnfeeds): Enable git resolution for affected versions field CVEList #3951
Conversation
This reverts commit c56e9d5.
jess-lowe
changed the title
| years = flag.String("years", "2022,2023,2024,2025", "A comma-separated list of years to process.") | ||
| workers = flag.Int("workers", 30, "The number of concurrent workers to use for processing CVEs.") | ||
| cnas = flag.String("cnas", "Linux", "A comma-separated list of CNAs to process.") | ||
| cnas = flag.String("cnas", "Linux,GitHub_M", "A comma-separated list of CNAs to process.") |
There was a problem hiding this comment.
The EEF CNA is reporting GIT Versions. Can we be added to this list? Example CVE: https://cna.erlef.org/cves/cve-2025-48042.html
There was a problem hiding this comment.
Hey @maennchen, thanks for your enthusiasm with the CVE5 conversion! I tried running the converter with EEF scoped vulns and unfortunately in its current state it's not able to convert EEF vulns effectively, as the data layout differs from the more common expressions I've seen across Linux/GitHub_M/MITRE vulns. Looking a little more into it, it looks like the vulns are generated using Vulnogram, in which case, I'll consider adding an extension to handle Vulnogram generated vulns in a future PR :).
For a more timely ingestion of EEF vulns into OSV, we would highly appreciate Erlang publishing natively in the OSV format for us to ingest (also removes the layer of abstraction from going through the CVE Program to publish changes, and waiting for us to ingest those vulns).
Breaking #3951 into smaller PRs. Metrics being global caused some concurrency issues in the output of the metrics file.
This PR:
database_specificand stores failed version conversions in theaffecteddatabase_specific