fix(scanner): expand curated github CPE map (golang/go, davegamble/cjson) - #747
Merged
Conversation
Several maven groupIds pass enrich-maven-cpe.py's generic org.apache.* rule but land on the wrong NVD product (e.g. org.apache.sshd -> apache:sshd, but NVD files it under mina_sshd), or fall through with no CPE at all (single-segment groups like log4j, rhino). Add 17 curated MAVEN_CPE_MAP entries, each verified against NVD's own cpeMatch data and confirmed to recover the real CVE via a local grype CPE lookup.
…son) Two new GITHUB_CPE_MAP entries confirmed against NVD and recovered via a local grype CPE lookup. golang/go needed a version-prefix strip: its git tags are "go1.24.2" but NVD's version field has no "go" prefix, and feeding the raw tag in makes grype's version comparator fail to parse it, flooding every Go CVE ever as a false positive instead of just missing the real match.
…pansion # Conflicts: # docker/lib/enrich-github-cpe.py # tests/test-postprocess.sh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GITHUB_CPE_MAPentries:golang/go->golang:goanddavegamble/cjson->davegamble:cjson, both confirmed against NVD and recovered via a local grype CPE lookup.golang/goneeded a newstrip_prefixmechanism inenrich-github-cpe.py: Go's git tags arego1.24.2but NVD's version field has nogoprefix. Feeding the raw tag into the CPE makes grype's version comparator fail to parse it, which floods every Go CVE ever as a false positive rather than just missing the intended match — confirmed directly (150+ spurious matches with the raw tag vs. the single correct one once stripped).Test plan
tests/test-postprocess.sh(extendsF-1c4) — new fixtures cover the strip_prefix path, the already-bare-version no-op case, the no-strip-needed cjson case, and a live grype CVE-recovery + false-positive-flood check for golang/gopython3 -m py_compile docker/lib/enrich-github-cpe.pyshellcheck --severity=warning tests/test-postprocess.sh(clean, matches CI's invocation)