Skip to content

Commit db0e601

Browse files
ziadhanyziadhany
committed
Fix OSV to handel affected_packages correctly
Add support to collect commits Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent 32d9724 commit db0e601

23 files changed

+1849
-5
lines changed

‎vulnerabilities/importers/osv_v2.py‎

Lines changed: 420 additions & 0 deletions
Large diffs are not rendered by default.

‎vulnerabilities/pipelines/v2_importers/github_osv_importer.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
from fetchcode.vcs import fetch_via_vcs
1515

1616
from vulnerabilities.importer import AdvisoryData
17+
from vulnerabilities.importers.osv_v2 import parse_advisory_data_v3
1718
from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
1819
from vulnerabilities.utils import get_advisory_url
1920

@@ -72,7 +73,7 @@ def collect_advisories(self) -> Iterable[AdvisoryData]:
7273
with open(file) as f:
7374
raw_data = json.load(f)
7475
advisory_text = file.read_text()
75-
yield parse_advisory_data_v2(
76+
yield parse_advisory_data_v3(
7677
raw_data=raw_data,
7778
supported_ecosystems=supported_ecosystems,
7879
advisory_url=advisory_url,

‎vulnerabilities/pipelines/v2_importers/oss_fuzz.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
from fetchcode.vcs import fetch_via_vcs
1515

1616
from vulnerabilities.importer import AdvisoryData
17+
from vulnerabilities.importers.osv_v2 import parse_advisory_data_v3
1718
from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
1819
from vulnerabilities.utils import get_advisory_url
1920

@@ -56,7 +57,7 @@ def collect_advisories(self) -> Iterable[AdvisoryData]:
5657
)
5758
advisory_text = advisory.read_text()
5859
advisory_dict = saneyaml.load(advisory_text)
59-
yield parse_advisory_data_v2(
60+
yield parse_advisory_data_v3(
6061
raw_data=advisory_dict,
6162
supported_ecosystems=["generic"],
6263
advisory_url=advisory_url,

‎vulnerabilities/pipelines/v2_importers/pypa_importer.py‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
from fetchcode.vcs import fetch_via_vcs
1515

1616
from vulnerabilities.importer import AdvisoryData
17+
from vulnerabilities.importers.osv_v2 import parse_advisory_data_v3
1718
from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
1819
from vulnerabilities.utils import get_advisory_url
1920

@@ -46,8 +47,6 @@ def advisories_count(self):
4647
return sum(1 for _ in vulns_directory.rglob("*.yaml"))
4748

4849
def collect_advisories(self) -> Iterable[AdvisoryData]:
49-
from vulnerabilities.importers.osv import parse_advisory_data_v2
50-
5150
base_directory = Path(self.vcs_response.dest_dir)
5251
vulns_directory = base_directory / "vulns"
5352

@@ -59,7 +58,7 @@ def collect_advisories(self) -> Iterable[AdvisoryData]:
5958
)
6059
advisory_text = advisory.read_text()
6160
advisory_dict = saneyaml.load(advisory_text)
62-
yield parse_advisory_data_v2(
61+
yield parse_advisory_data_v3(
6362
raw_data=advisory_dict,
6463
supported_ecosystems=["pypi"],
6564
advisory_url=advisory_url,

‎vulnerabilities/tests/test_data/osv_test/github/github-1.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hjr-vmf3-xwvp",
4+
"modified": "2024-07-26T14:18:08Z",
5+
"published": "2024-07-26T06:30:47Z",
6+
"aliases": [
7+
"CVE-2023-49921"
8+
],
9+
"summary": "Elasticsearch Insertion of Sensitive Information into Log File",
10+
"details": "An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
15+
},
16+
{
17+
"type": "CVSS_V4",
18+
"score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "Maven",
25+
"name": "org.elasticsearch:elasticsearch"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "7.17.16"
36+
}
37+
]
38+
}
39+
]
40+
},
41+
{
42+
"package": {
43+
"ecosystem": "Maven",
44+
"name": "org.elasticsearch:elasticsearch"
45+
},
46+
"ranges": [
47+
{
48+
"type": "ECOSYSTEM",
49+
"events": [
50+
{
51+
"introduced": "8.0.0"
52+
},
53+
{
54+
"fixed": "8.11.2"
55+
}
56+
]
57+
}
58+
]
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49921"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179"
69+
},
70+
{
71+
"type": "PACKAGE",
72+
"url": "https://github.com/elastic/elasticsearch"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-532"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2024-07-26T14:18:08Z",
82+
"nvd_published_at": "2024-07-26T05:15:10Z"
83+
}
84+
}

‎vulnerabilities/tests/test_data/osv_test/github/github-2.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2jm2-2p35-rp3j",
4+
"modified": "2025-11-19T21:55:33Z",
5+
"published": "2025-11-19T21:00:37Z",
6+
"aliases": [
7+
"CVE-2025-65103"
8+
],
9+
"summary": "OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter",
10+
"details": "### Summary\nAn authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the `display` parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise.\n\n### Details\nThe vulnerability is located in the `retrieve()` method within `src/API/Manager.php`.\n\nUser input from the `display` GET parameter is processed without proper validation. The code strips the surrounding brackets `[]`, splits the string by commas, and then passes each resulting element directly into the `selectRaw()` function of the query builder.\n\n```php\n// User input from 'display' is taken without sanitization.\n$select = !empty($request['display']) ? explode(',', substr((string) $request['display'], 1, -1)) : null;\n\n// ...\n\n// The unsanitized input is passed directly to `selectRaw()`.\nforeach ($select as $s) {\n $query->selectRaw($s);\n}\n```\n\nSince `selectRaw()` is designed to execute raw SQL expressions, it executes any malicious SQL code provided in the `display` parameter.\n\n### PoC\n1. Log in to an OpenSTAManager instance as any user.\n2. Navigate to the user's profile page to obtain their personal API Token.\n3. Use this API token to send a specially crafted GET request to the API endpoint.\n\n**Time-Based Blind Injection Test:**\n\nReplace `<your_host>`, `<your_token>`, and `<resource_name>` with your actual values. `anagrafiche` is a valid resource.\n\n```bash\ncurl \"http://<your_host>/openstamanager/api?token=<your_token>&resource=anagrafiche&display=[1,SLEEP(5)]\"\n```\n\nThe server will delay its response by approximately 5 seconds, confirming the `SLEEP(5)` command was executed by the database.\n\n### Impact\nThis is a critical SQL Injection vulnerability. Any authenticated user, even those with the lowest privileges, can exploit this vulnerability to:\n\n* **Exfiltrate all data** from the database (e.g., user credentials, customer information, invoices, internal data).\n* **Modify or delete data**, compromising data integrity.\n* Potentially achieve further system compromise, depending on the database user's privileges and system configuration.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "devcode-it/openstamanager"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.9.5"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.9.4"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2jm2-2p35-rp3j"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65103"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/devcode-it/openstamanager"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-89"
58+
],
59+
"severity": "HIGH",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2025-11-19T21:00:37Z",
62+
"nvd_published_at": "2025-11-19T20:15:54Z"
63+
}
64+
}

‎vulnerabilities/tests/test_data/osv_test/github/github-expected-1.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"advisory_id": "GHSA-2hjr-vmf3-xwvp",
3+
"aliases": [
4+
"CVE-2023-49921"
5+
],
6+
"summary": "Elasticsearch Insertion of Sensitive Information into Log File\nAn issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.",
7+
"affected_packages": [
8+
{
9+
"package": {
10+
"type": "maven",
11+
"namespace": "org.elasticsearch",
12+
"name": "elasticsearch",
13+
"version": "",
14+
"qualifiers": "",
15+
"subpath": ""
16+
},
17+
"affected_version_range": "vers:maven/>=0|<7.17.16",
18+
"fixed_version_range": "vers:maven/7.17.16",
19+
"introduced_by_commit_patches": [],
20+
"fixed_by_commit_patches": []
21+
},
22+
{
23+
"package": {
24+
"type": "maven",
25+
"namespace": "org.elasticsearch",
26+
"name": "elasticsearch",
27+
"version": "",
28+
"qualifiers": "",
29+
"subpath": ""
30+
},
31+
"affected_version_range": "vers:maven/>=8.0.0|<8.11.2",
32+
"fixed_version_range": "vers:maven/8.11.2",
33+
"introduced_by_commit_patches": [],
34+
"fixed_by_commit_patches": []
35+
}
36+
],
37+
"references_v2": [
38+
{
39+
"reference_id": "",
40+
"reference_type": "",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49921"
42+
},
43+
{
44+
"reference_id": "",
45+
"reference_type": "",
46+
"url": "https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179"
47+
},
48+
{
49+
"reference_id": "",
50+
"reference_type": "",
51+
"url": "https://github.com/elastic/elasticsearch"
52+
}
53+
],
54+
"patches": [],
55+
"severities": [
56+
{
57+
"system": "cvssv3.1",
58+
"value": "5.2",
59+
"scoring_elements": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
60+
},
61+
{
62+
"system": "cvssv4",
63+
"value": "4.1",
64+
"scoring_elements": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
65+
},
66+
{
67+
"system": "generic_textual",
68+
"value": "MODERATE",
69+
"scoring_elements": ""
70+
}
71+
],
72+
"date_published": "2024-07-26T06:30:47+00:00",
73+
"weaknesses": [
74+
532
75+
],
76+
"url": "https://test.com"
77+
}

‎vulnerabilities/tests/test_data/osv_test/github/github-expected-2.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"advisory_id": "GHSA-2jm2-2p35-rp3j",
3+
"aliases": [
4+
"CVE-2025-65103"
5+
],
6+
"summary": "OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter\n### Summary\nAn authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the `display` parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise.\n\n### Details\nThe vulnerability is located in the `retrieve()` method within `src/API/Manager.php`.\n\nUser input from the `display` GET parameter is processed without proper validation. The code strips the surrounding brackets `[]`, splits the string by commas, and then passes each resulting element directly into the `selectRaw()` function of the query builder.\n\n```php\n// User input from 'display' is taken without sanitization.\n$select = !empty($request['display']) ? explode(',', substr((string) $request['display'], 1, -1)) : null;\n\n// ...\n\n// The unsanitized input is passed directly to `selectRaw()`.\nforeach ($select as $s) {\n $query->selectRaw($s);\n}\n```\n\nSince `selectRaw()` is designed to execute raw SQL expressions, it executes any malicious SQL code provided in the `display` parameter.\n\n### PoC\n1. Log in to an OpenSTAManager instance as any user.\n2. Navigate to the user's profile page to obtain their personal API Token.\n3. Use this API token to send a specially crafted GET request to the API endpoint.\n\n**Time-Based Blind Injection Test:**\n\nReplace `<your_host>`, `<your_token>`, and `<resource_name>` with your actual values. `anagrafiche` is a valid resource.\n\n```bash\ncurl \"http://<your_host>/openstamanager/api?token=<your_token>&resource=anagrafiche&display=[1,SLEEP(5)]\"\n```\n\nThe server will delay its response by approximately 5 seconds, confirming the `SLEEP(5)` command was executed by the database.\n\n### Impact\nThis is a critical SQL Injection vulnerability. Any authenticated user, even those with the lowest privileges, can exploit this vulnerability to:\n\n* **Exfiltrate all data** from the database (e.g., user credentials, customer information, invoices, internal data).\n* **Modify or delete data**, compromising data integrity.\n* Potentially achieve further system compromise, depending on the database user's privileges and system configuration.",
7+
"affected_packages": [],
8+
"references_v2": [
9+
{
10+
"reference_id": "",
11+
"reference_type": "",
12+
"url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2jm2-2p35-rp3j"
13+
},
14+
{
15+
"reference_id": "",
16+
"reference_type": "",
17+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65103"
18+
},
19+
{
20+
"reference_id": "",
21+
"reference_type": "",
22+
"url": "https://github.com/devcode-it/openstamanager"
23+
}
24+
],
25+
"patches": [],
26+
"severities": [
27+
{
28+
"system": "cvssv3.1",
29+
"value": "8.8",
30+
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
31+
},
32+
{
33+
"system": "generic_textual",
34+
"value": "HIGH",
35+
"scoring_elements": ""
36+
}
37+
],
38+
"date_published": "2025-11-19T21:00:37+00:00",
39+
"weaknesses": [
40+
89
41+
],
42+
"url": "https://test.com"
43+
}

‎vulnerabilities/tests/test_data/osv_test/oss-fuzz/oss-fuzz-1.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
affected:
2+
- ecosystem_specific:
3+
severity: LOW
4+
package:
5+
ecosystem: OSS-Fuzz
6+
name: apache-commons-configuration
7+
purl: pkg:generic/apache-commons-configuration
8+
ranges:
9+
- events:
10+
- introduced: 4117b2050ab011f131d5a81c824bf89ddde303d4
11+
repo: https://gitbox.apache.org/repos/asf/commons-configuration.git
12+
type: GIT
13+
versions:
14+
- commons-configuration-2.10.0-RC1
15+
- commons-configuration-2.10.1-RC1
16+
- commons-configuration-2.9.0-RC1
17+
- rel/commons-configuration-2.10.0
18+
- rel/commons-configuration-2.10.1
19+
- rel/commons-configuration-2.9.0
20+
- commons-configuration-2.11.0-RC1
21+
- rel/commons-configuration-2.11.0
22+
- commons-configuration-2.11.1-RC1
23+
- commons-configuration-2.12.0-RC1
24+
- commons-configuration-2.12.0
25+
- rel/commons-configuration-2.12.0
26+
- commons-configuration-2.13.0-RC1
27+
- rel/commons-configuration-2.13.0
28+
details: |
29+
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66703
30+
31+
```
32+
Crash type: Security exception
33+
Crash state:
34+
java.base/java.util.stream.AbstractPipeline.evaluate
35+
java.base/java.util.stream.ReferencePipeline.collect
36+
org.apache.commons.configuration2.AbstractYAMLBasedConfiguration.parseCollection
37+
```
38+
id: OSV-2024-269
39+
modified: '2025-11-29T14:27:29.156170Z'
40+
published: '2024-04-18T00:04:02.456948Z'
41+
references:
42+
- type: REPORT
43+
url: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66703
44+
schema_version: 1.6.0
45+
summary: Security exception in java.base/java.util.stream.AbstractPipeline.evaluate

0 commit comments

Comments
 (0)