feat(scanner): split org.apache.activemq CPE by artifactId (Classic vs Artemis) - #749
Closed
haksungjang wants to merge 1 commit into
Closed
feat(scanner): split org.apache.activemq CPE by artifactId (Classic vs Artemis)#749haksungjang wants to merge 1 commit into
haksungjang wants to merge 1 commit into
Conversation
…s Artemis) org.apache.activemq is shared by two different NVD products: Artemis (artifactIds prefixed "artemis-") and Classic ActiveMQ (everything else). The generic rule already derives apache:activemq correctly for Classic, but every Artemis artifact was getting the same wrong CPE. MAVEN_CPE_MAP entries can now be a dict keyed by artifactId prefix instead of a flat (vendor, product) tuple, with "" as the catch-all default. Investigated org.glassfish for the same treatment (also flagged as a shared-groupId gap): every org.glassfish/* artifact actually observed in the corpus is a generic Jakarta/Java EE API jar, not the GlassFish server itself, so there is no artifactId prefix to route on safely. Left uncurated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
org.apache.activemqis shared by two different NVD products: Artemis (artifactIds prefixedartemis-) and Classic ActiveMQ (everything else). Every Artemis artifact was getting the Classic product'sapache:activemqCPE via the generic rule.MAVEN_CPE_MAPentries can now be a dict keyed by artifactId prefix (longest wins,""is the catch-all default) instead of a flat(vendor, product)tuple, so a shared groupId can route to more than one NVD product.org.glassfishfor the same treatment: everyorg.glassfish/*artifact actually observed in the supplier corpus is a generic Jakarta/Java EE API jar (javax.annotation,jakarta.el,servlet-api, ...), not the GlassFish server itself, so there is no artifactId prefix to route on safely — left uncurated rather than risk attaching a GlassFish-server CVE to an unrelated API jar.Stacked on #745/#748 (this depends on
derive_cpe()'s alternates-tuple shape from #748).Test plan
tests/test-postprocess.sh(533 assertions, 0 failed) — newF-1c8section covers the artemis-* routing, the non-artemis fallback, idempotency, and confirmsapache:artemisis a real distinct NVD product on the local grype DBpython3 -m py_compile docker/lib/enrich-maven-cpe.pyshellcheck --severity=warning tests/test-postprocess.sh(clean, matches CI's invocation)