Skip to content

Add Vulntotal CLI #801

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
pombredanne merged 0 commits into from
Nov 19, 2022
Merged

Add Vulntotal CLI #801

pombredanne merged 0 commits into from
Nov 19, 2022

Conversation

@keshav-space
Copy link
Member

@keshav-space keshav-space commented Jul 19, 2022 •
edited
Loading 

❯ python vulntotal/vulntotal_cli.py --help

Usage: vulntotal_cli.py [OPTIONS] [PURL]

  Runs the PURL through all the available  DataSources and group vulnerability
  by CVEs. Use the special '-' file name to print JSON or YAML results on
  screen/stdout.

Options:
  -l, --list   Lists all the available DataSources.
  --json FILE  Write output as pretty-printed JSON to FILE.
  --yaml FILE  Write output as YAML to FILE.
  -h, --help   Show this message and exit.


Along with some advanced hidden options especially useful for debugging and development. 
Options:
  -e, --enable                    Enable these datasource/s only.
  -d, --disable                   Disable these datasource/s.
  --ecosystem                     Lists ecosystem supported by active DataSources
  --raw                           List of all the raw response from DataSources.
  --no-threading                  Run DataSources sequentially.
  -p, --pagination                Enable default pagination.
  --no-group                      Don't group by CVE.

@keshav-space keshav-space added the VulnTotal Tool for cross-validating vulnerability label Jul 19, 2022
@keshav-space keshav-space self-assigned this Jul 19, 2022
@keshav-space keshav-space force-pushed the vulntotal_cli branch 2 times, most recently from daa8a1c to d6b3998 Compare July 19, 2022 23:32
@keshav-space
Copy link
Member Author

keshav-space commented Jul 19, 2022 •
edited
Loading 

❯ python vulntotal/vulntotal_cli.py 'pkg:pypi/jinja2@2.4.1'
PURL: pkg:pypi/jinja2@2.4.1
Active DataSources: DEPS, GITHUB, GITLAB, OSS, OSV, SNYK, VULNERABLECODE

+----------------+----------------+----------------+----------------+---------------+
|      CVE       |   DATASOURCE   |    ALIASES     |    AFFECTED    |     FIXED     |
+================+================+================+================+===============+
| CVE-2020-28493 | SNYK           | CVE-2020-28493 | (,2.11.3)      | 2.11.3        |
|                |                | SNYK-PYTHON-   |                |               |
|                |                | JINJA2-1012994 |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2020-28493 | VULNERABLECODE | CVE-2020-28493 | 2.10.1-3       | 1.11.3-r0     |
|                |                | GHSA-g3rq-g295 | 2.10.3-6       | 1.11.3-r0     |
|                |                | -4j3m          | 2.7.0-12       | 1.11.3-r0     |
|                |                |                | 2.7.18-3       | 1.11.3-r0     |
|                |                |                | 2.8-5  4.4.1-7 | 1.11.3-r0     |
|                |                |                | 0.9.6-10       | 1.11.3-r0     |
|                |                |                | 1.5-5          | 1.11.3-r0     |
|                |                |                | 19.3.1-2       | 1.11.3-r0     |
|                |                |                | 2.6-16         | 1.11.3-r0     |
|                |                |                | 1.25.7-7       | 1.11.3-r0     |
|                |                |                | 3.8.11-2       | 1.11.3-r0     |
|                |                |                | 2.0rc1  2.0    | 1.11.3-r0     |
|                |                |                | 2.1  2.1.1     | 1.11.3-r0     |
|                |                |                | 2.2  2.2.1     | 1.11.3-r0     |
|                |                |                | 2.3  2.3.1     | 1.11.3-r0     |
|                |                |                | 2.4  2.4.1     | 1.11.3-r0     |
|                |                |                | 2.5  2.5.1     | 1.11.3-r0     |
|                |                |                | 2.5.2  2.5.3   | 1.11.3-r0     |
|                |                |                | 2.5.4  2.5.5   | 1.11.3-r0     |
|                |                |                | 2.6  2.7       | 1.11.3-r0     |
|                |                |                | 2.7.1  2.7.2   | 1.11.3-r0     |
|                |                |                | 2.7.3  2.8     | 1.11.3-r0     |
|                |                |                | 2.8.1  2.9     | 1.11.3-r0     |
|                |                |                | 2.9.1  2.9.2   | 1.11.3-r0     |
|                |                |                | 2.9.3  2.9.4   | 1.11.3-r0     |
|                |                |                | 2.9.5  2.9.6   | 1.11.3-r0     |
|                |                |                | 2.10  2.10.1   | 1.11.3-r0     |
|                |                |                | 2.10.2  2.10.3 | 1.11.3-r0     |
|                |                |                | 2.11.0  2.11.1 | 2.11.3        |
|                |                |                | 2.11.2         |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2020-28493 | DEPS           | CVE-2020-28493 | 2.0.0          | 2.11.3  3.0.0 |
|                |                |                | 2.0.0rc1       | 3.0.0a1       |
|                |                |                | 2.1.0  2.1.1   | 3.0.0rc1      |
|                |                |                | 2.10.0  2.10.1 | 3.0.0rc2      |
|                |                |                | 2.10.2  2.10.3 | 3.0.1  3.0.2  |
|                |                |                | 2.11.0  2.11.1 | 3.0.3  3.1.0  |
|                |                |                | 2.11.2  2.2.0  | 3.1.1  3.1.2  |
|                |                |                | 2.2.1  2.3.0   |               |
|                |                |                | 2.3.1  2.4.0   |               |
|                |                |                | 2.4.1  2.5.0   |               |
|                |                |                | 2.5.1  2.5.2   |               |
|                |                |                | 2.5.3  2.5.4   |               |
|                |                |                | 2.5.5  2.6.0   |               |
|                |                |                | 2.7.0  2.7.1   |               |
|                |                |                | 2.7.2  2.7.3   |               |
|                |                |                | 2.8.0  2.8.1   |               |
|                |                |                | 2.9.0  2.9.1   |               |
|                |                |                | 2.9.2  2.9.3   |               |
|                |                |                | 2.9.4  2.9.5   |               |
|                |                |                | 2.9.6          |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2020-28493 | GITHUB         | CVE-2020-28493 | <2.11.3        | 2.11.3        |
|                |                | GHSA-g3rq-g295 |                |               |
|                |                | -4j3m          |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2020-28493 | GITLAB         | CVE-2020-28493 | <2.11.3        | 2.11.3        |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2020-28493 | OSV            | CVE-2020-28493 | 0  2.0  2.0rc1 | 2.11.3        |
|                |                | GHSA-g3rq-g295 | 2.1  2.1.1     |               |
|                |                | -4j3m          | 2.10  2.10.1   |               |
|                |                |                | 2.10.2  2.10.3 |               |
|                |                |                | 2.11.0  2.11.1 |               |
|                |                |                | 2.11.2  2.2    |               |
|                |                |                | 2.2.1  2.3     |               |
|                |                |                | 2.3.1  2.4     |               |
|                |                |                | 2.4.1  2.5     |               |
|                |                |                | 2.5.1  2.5.2   |               |
|                |                |                | 2.5.3  2.5.4   |               |
|                |                |                | 2.5.5  2.6     |               |
|                |                |                | 2.7  2.7.1     |               |
|                |                |                | 2.7.2  2.7.3   |               |
|                |                |                | 2.8  2.8.1     |               |
|                |                |                | 2.9  2.9.1     |               |
|                |                |                | 2.9.2  2.9.3   |               |
|                |                |                | 2.9.4  2.9.5   |               |
|                |                |                | 2.9.6          |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2020-28493 | OSV            | CVE-2020-28493 | 0  2.0  2.0rc1 | 2.11.3        |
|                |                | GHSA-g3rq-g295 | 2.1  2.1.1     |               |
|                |                | -4j3m          | 2.10  2.10.1   |               |
|                |                | PYSEC-2021-66  | 2.10.2  2.10.3 |               |
|                |                | SNYK-PYTHON-   | 2.11.0  2.11.1 |               |
|                |                | JINJA2-1012994 | 2.11.2  2.2    |               |
|                |                |                | 2.2.1  2.3     |               |
|                |                |                | 2.3.1  2.4     |               |
|                |                |                | 2.4.1  2.5     |               |
|                |                |                | 2.5.1  2.5.2   |               |
|                |                |                | 2.5.3  2.5.4   |               |
|                |                |                | 2.5.5  2.6     |               |
|                |                |                | 2.7  2.7.1     |               |
|                |                |                | 2.7.2  2.7.3   |               |
|                |                |                | 2.8  2.8.1     |               |
|                |                |                | 2.9  2.9.1     |               |
|                |                |                | 2.9.2  2.9.3   |               |
|                |                |                | 2.9.4  2.9.5   |               |
|                |                |                | 2.9.6          |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2020-28493 | OSS            | CVE-2020-28493 |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2019-10906 | SNYK           | CVE-2019-10906 | (,2.10.1)      | 2.10.1        |
|                |                | SNYK-PYTHON-   |                |               |
|                |                | JINJA2-174126  |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2019-10906 | VULNERABLECODE | CVE-2019-10906 | 2.0rc1  2.0    | 2.10.1        |
|                |                | GHSA-462w-v97r | 2.1  2.1.1     |               |
|                |                | -4m45          | 2.2  2.2.1     |               |
|                |                |                | 2.3  2.3.1     |               |
|                |                |                | 2.4  2.4.1     |               |
|                |                |                | 2.5  2.5.1     |               |
|                |                |                | 2.5.2  2.5.3   |               |
|                |                |                | 2.5.4  2.5.5   |               |
|                |                |                | 2.6  2.7       |               |
|                |                |                | 2.7.1  2.7.2   |               |
|                |                |                | 2.7.3  2.8     |               |
|                |                |                | 2.8.1  2.9     |               |
|                |                |                | 2.9.1  2.9.2   |               |
|                |                |                | 2.9.3  2.9.4   |               |
|                |                |                | 2.9.5  2.9.6   |               |
|                |                |                | 2.10           |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2019-10906 | GITHUB         | CVE-2019-10906 | <2.10.1        | 2.10.1        |
|                |                | GHSA-462w-v97r |                |               |
|                |                | -4m45          |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2019-10906 | GITLAB         | CVE-2019-10906 | <2.10.1        | 2.10.1        |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2019-10906 | OSV            | CVE-2019-10906 | 0  2.0  2.0rc1 | 2.10.1        |
|                |                | GHSA-462w-v97r | 2.1  2.1.1     |               |
|                |                | -4m45          | 2.10  2.2      |               |
|                |                |                | 2.2.1  2.3     |               |
|                |                |                | 2.3.1  2.4     |               |
|                |                |                | 2.4.1  2.5     |               |
|                |                |                | 2.5.1  2.5.2   |               |
|                |                |                | 2.5.3  2.5.4   |               |
|                |                |                | 2.5.5  2.6     |               |
|                |                |                | 2.7  2.7.1     |               |
|                |                |                | 2.7.2  2.7.3   |               |
|                |                |                | 2.8  2.8.1     |               |
|                |                |                | 2.9  2.9.1     |               |
|                |                |                | 2.9.2  2.9.3   |               |
|                |                |                | 2.9.4  2.9.5   |               |
|                |                |                | 2.9.6          |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2019-10906 | OSV            | CVE-2019-10906 | 0  2.0  2.0rc1 | 2.10.1        |
|                |                | GHSA-462w-v97r | 2.1  2.1.1     |               |
|                |                | -4m45          | 2.10  2.2      |               |
|                |                | PYSEC-2019-217 | 2.2.1  2.3     |               |
|                |                |                | 2.3.1  2.4     |               |
|                |                |                | 2.4.1  2.5     |               |
|                |                |                | 2.5.1  2.5.2   |               |
|                |                |                | 2.5.3  2.5.4   |               |
|                |                |                | 2.5.5  2.6     |               |
|                |                |                | 2.7  2.7.1     |               |
|                |                |                | 2.7.2  2.7.3   |               |
|                |                |                | 2.8  2.8.1     |               |
|                |                |                | 2.9  2.9.1     |               |
|                |                |                | 2.9.2  2.9.3   |               |
|                |                |                | 2.9.4  2.9.5   |               |
|                |                |                | 2.9.6          |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2014-1402  | SNYK           | CVE-2014-1402  | (,2.7.2)       | 2.7.2         |
|                |                | SNYK-PYTHON-   |                |               |
|                |                | JINJA2-40028   |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2014-1402  | VULNERABLECODE | CVE-2014-1402  | 2.0rc1  2.0    | 2.7.2         |
|                |                | GHSA-8r7q-cvjq | 2.1  2.1.1     |               |
|                |                | -x353          | 2.2  2.2.1     |               |
|                |                |                | 2.3  2.3.1     |               |
|                |                |                | 2.4  2.4.1     |               |
|                |                |                | 2.5  2.5.1     |               |
|                |                |                | 2.5.2  2.5.3   |               |
|                |                |                | 2.5.4  2.5.5   |               |
|                |                |                | 2.6  2.7       |               |
|                |                |                | 2.7.1          |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2014-1402  | GITHUB         | CVE-2014-1402  | <2.7.2         | 2.7.2         |
|                |                | GHSA-8r7q-cvjq |                |               |
|                |                | -x353          |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2014-1402  | GITLAB         | CVE-2014-1402  | <=2.7.1        | 2.7.2         |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2014-1402  | OSV            | CVE-2014-1402  | 0  2.0  2.0rc1 | 2.7.2         |
|                |                | GHSA-8r7q-cvjq | 2.1  2.1.1     |               |
|                |                | -x353          | 2.2  2.2.1     |               |
|                |                |                | 2.3  2.3.1     |               |
|                |                |                | 2.4  2.4.1     |               |
|                |                |                | 2.5  2.5.1     |               |
|                |                |                | 2.5.2  2.5.3   |               |
|                |                |                | 2.5.4  2.5.5   |               |
|                |                |                | 2.6  2.7       |               |
|                |                |                | 2.7.1          |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2014-1402  | OSV            | CVE-2014-1402  | 0  2.0  2.0rc1 | 2.7.2         |
|                |                | PYSEC-2014-8   | 2.1  2.1.1     |               |
|                |                |                | 2.2  2.2.1     |               |
|                |                |                | 2.3  2.3.1     |               |
|                |                |                | 2.4  2.4.1     |               |
|                |                |                | 2.5  2.5.1     |               |
|                |                |                | 2.5.2  2.5.3   |               |
|                |                |                | 2.5.4  2.5.5   |               |
|                |                |                | 2.6  2.7       |               |
|                |                |                | 2.7.1          |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2014-1402  | OSS            | CVE-2014-1402  |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2016-10745 | VULNERABLECODE | GHSA-          | 2.0rc1  2.0    | 2.8.1         |
|                |                | hj2j-77xm-mc5v | 2.1  2.1.1     |               |
|                |                | CVE-2016-10745 | 2.2  2.2.1     |               |
|                |                |                | 2.3  2.3.1     |               |
|                |                |                | 2.4  2.4.1     |               |
|                |                |                | 2.5  2.5.1     |               |
|                |                |                | 2.5.2  2.5.3   |               |
|                |                |                | 2.5.4  2.5.5   |               |
|                |                |                | 2.6  2.7       |               |
|                |                |                | 2.7.1  2.7.2   |               |
|                |                |                | 2.7.3  2.8     |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2016-10745 | GITHUB         | CVE-2016-10745 | <2.8.1         | 2.8.1         |
|                |                | GHSA-          |                |               |
|                |                | hj2j-77xm-mc5v |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2016-10745 | GITLAB         | GHSA-          | <2.8.1         | 2.8.1         |
|                |                | hj2j-77xm-mc5v |                |               |
|                |                | CVE-2016-10745 |                |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2016-10745 | OSV            | CVE-2016-10745 | 0  2.0  2.0rc1 | 2.8.1         |
|                |                | GHSA-          | 2.1  2.1.1     |               |
|                |                | hj2j-77xm-mc5v | 2.2  2.2.1     |               |
|                |                |                | 2.3  2.3.1     |               |
|                |                |                | 2.4  2.4.1     |               |
|                |                |                | 2.5  2.5.1     |               |
|                |                |                | 2.5.2  2.5.3   |               |
|                |                |                | 2.5.4  2.5.5   |               |
|                |                |                | 2.6  2.7       |               |
|                |                |                | 2.7.1  2.7.2   |               |
|                |                |                | 2.7.3  2.8     |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2016-10745 | OSV            | CVE-2016-10745 | 0  2.0  2.0rc1 | 9b53045c34e61 |
|                |                | GHSA-          | 2.1  2.1.1     | 013dc8f09b7e5 |
|                |                | hj2j-77xm-mc5v | 2.2  2.2.1     | 2a555fa16bed1 |
|                |                | PYSEC-2019-220 | 2.3  2.3.1     | 6             |
|                |                |                | 2.4  2.4.1     |               |
|                |                |                | 2.5  2.5.1     |               |
|                |                |                | 2.5.2  2.5.3   |               |
|                |                |                | 2.5.4  2.5.5   |               |
|                |                |                | 2.6  2.7       |               |
|                |                |                | 2.7.1  2.7.2   |               |
|                |                |                | 2.7.3  2.8     |               |
+----------------+----------------+----------------+----------------+---------------+
| CVE-2016-10745 | OSS            | CVE-2016-10745 |                |               |
+----------------+----------------+----------------+----------------+---------------+

@keshav-space
Copy link
Member Author

keshav-space commented Jul 25, 2022 •
edited
Loading

Now CLI also supports the listing of supported ecosystems

❯ python vulntotal/vulntotal_cli.py --ecosystem
Active DataSources: DEPS, GITHUB, GITLAB, OSS, OSV, SNYK, VULNERABLECODE

Ecosystem supported by active datasources
ALPINE
ANDROID
CARGO
COCOAPODS
COMPOSER
CONAN
CONDA
CRAN
CRATES.IO
DEB
DEBIAN
ERLANG
GEM
GOLANG
HEX
LINUX
MAVEN
NGINX
NPM
NUGET
OPENSSL
OSS-FUZZ
PYPI
RPM
RUBYGEMS
RUST
SWIFT
UNMANAGED

pombredanne
pombredanne requested changes Aug 2, 2022
View reviewed changes
Copy link
Member

@pombredanne pombredanne left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! LGTM very nice... Do you mind to use click may be rather than argparse? Also I think there should be only two user-visible options: --purl and --list all the other options are debugging options. The user should not be able routinely to select/enable/disable validators at all. This means that we have not done the right job.

@pombredanne
Copy link
Member

pombredanne commented Aug 2, 2022

IMHO we should also find a way to report some JSON output.

@pombredanne
Copy link
Member

pombredanne commented Aug 2, 2022

Some example of CLI could be https://github.com/nexB/python-inspector/blob/main/src/python_inspector/resolve_cli.py

@keshav-space keshav-space marked this pull request as draft August 26, 2022 18:54
This was linked to issues Aug 28, 2022
Streamline CLI #882
Closed
support file output and group by CVE in VulnTotal CLI #884
Closed
@keshav-space keshav-space marked this pull request as ready for review August 29, 2022 18:59
@TG1999
Copy link
Contributor

TG1999 commented Sep 5, 2022

Add doctsrings for all the functions and also add doctests/ unit tests for functions which have not been tested at all

@armijnhemel
Copy link
Contributor

armijnhemel commented Sep 12, 2022 

| CVE-2020-28493 | VULNERABLECODE | CVE-2020-28493 | 2.10.1-3       | 1.11.3-r0     |
|                |                | GHSA-g3rq-g295 | 2.10.3-6       | 1.11.3-r0     |
|                |                | -4j3m          | 2.7.0-12       | 1.11.3-r0     |
|                |                |                | 2.7.18-3       | 1.11.3-r0     |

That looks like an odd result as I don't think that version 1.11.3-r0 actually exists. Maybe a bug in the VulnerableCode data? I would have expected to see 2.11.3-r0

@TG1999
Copy link
Contributor

TG1999 commented Sep 12, 2022 •
edited
Loading 

| CVE-2020-28493 | VULNERABLECODE | CVE-2020-28493 | 2.10.1-3       | 1.11.3-r0     |
|                |                | GHSA-g3rq-g295 | 2.10.3-6       | 1.11.3-r0     |
|                |                | -4j3m          | 2.7.0-12       | 1.11.3-r0     |
|                |                |                | 2.7.18-3       | 1.11.3-r0     |

That looks like an odd result as I don't think that version 1.11.3-r0 actually exists. Maybe a bug in the VulnerableCode data? I would have expected to see 2.11.3-r0

@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/py3-jinja2@1.11.3-r0?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl.

cc @keshav-space

@armijnhemel
Copy link
Contributor

armijnhemel commented Sep 12, 2022 

| CVE-2020-28493 | VULNERABLECODE | CVE-2020-28493 | 2.10.1-3       | 1.11.3-r0     |
|                |                | GHSA-g3rq-g295 | 2.10.3-6       | 1.11.3-r0     |
|                |                | -4j3m          | 2.7.0-12       | 1.11.3-r0     |
|                |                |                | 2.7.18-3       | 1.11.3-r0     |

That looks like an odd result as I don't think that version 1.11.3-r0 actually exists. Maybe a bug in the VulnerableCode data? I would have expected to see 2.11.3-r0

@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/py3-jinja2@1.11.3-r0?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl.

cc @keshav-space

I will open a different issue, as I have found what the bug is.

@armijnhemel armijnhemel mentioned this pull request Sep 12, 2022
Open
@keshav-space
Copy link
Member Author

keshav-space commented Sep 12, 2022

@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/py3-jinja2@1.11.3-r0?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl.

cc @keshav-space

VulnTotal is making this request.

response = requests.post(
    "http://localhost:8001/api/packages/bulk_search/",
    json={"purls": ["pkg:pypi/jinja2@2.4.1"]},
)

The point here is that if I'm making an explicit request for pypi ecosystem, why should I be getting anything from the alpine?

@TG1999
Copy link
Contributor

TG1999 commented Sep 12, 2022

@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/py3-jinja2@1.11.3-r0?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl.
cc @keshav-space

VulnTotal is making this request.

response = requests.post(
    "http://localhost:8001/api/packages/bulk_search/",
    json={"purls": ["pkg:pypi/jinja2@2.4.1"]},
)

The point here is that if I'm making an explicit request for pypi ecosystem, why should I be getting anything from the alpine?

@keshav-space which branch of vulnerablecode are you using in your local checkout? if you use the latest branch you will only get purls of pypi ecosystem

@armijnhemel
Copy link
Contributor

armijnhemel commented Sep 12, 2022 

| CVE-2020-28493 | VULNERABLECODE | CVE-2020-28493 | 2.10.1-3       | 1.11.3-r0     |
|                |                | GHSA-g3rq-g295 | 2.10.3-6       | 1.11.3-r0     |
|                |                | -4j3m          | 2.7.0-12       | 1.11.3-r0     |
|                |                |                | 2.7.18-3       | 1.11.3-r0     |

That looks like an odd result as I don't think that version 1.11.3-r0 actually exists. Maybe a bug in the VulnerableCode data? I would have expected to see 2.11.3-r0

@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/py3-jinja2@1.11.3-r0?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl.
cc @keshav-space

I will open a different issue, as I have found what the bug is.

It seems that what I found is indeed a different issue than what is currently being discussed ;-)

I have opened a separate bug report in #915

@keshav-space
Copy link
Member Author

keshav-space commented Sep 12, 2022

@keshav-space which branch of vulnerablecode are you using in your local checkout? if you use the latest branch you will only get purls of pypi ecosystem

Okay, let me try the latest branch.

@pombredanne pombredanne mentioned this pull request Oct 7, 2022
Open
@keshav-space keshav-space mentioned this pull request Oct 12, 2022
Closed
9 tasks
@pombredanne pombredanne merged commit cad9501 into aboutcode-org:vulntotal Nov 19, 2022
@pombredanne pombredanne mentioned this pull request Dec 3, 2022
Open
@keshav-space keshav-space deleted the vulntotal_cli branch January 10, 2023 11:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pombredanne pombredanne pombredanne requested changes

@Hritik14 Hritik14 Awaiting requested review from Hritik14

@sbs2001 sbs2001 Awaiting requested review from sbs2001

@TG1999 TG1999 Awaiting requested review from TG1999

Assignees

@keshav-space keshav-space

Labels

VulnTotal Tool for cross-validating vulnerability

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

support file output and group by CVE in VulnTotal CLI Streamline CLI

4 participants

@keshav-space @pombredanne @TG1999 @armijnhemel