feat(scanner): split org.apache.activemq CPE by artifactId (Classic vs Artemis) - #755
Merged
Conversation
Several maven groupIds pass enrich-maven-cpe.py's generic org.apache.* rule but land on the wrong NVD product (e.g. org.apache.sshd -> apache:sshd, but NVD files it under mina_sshd), or fall through with no CPE at all (single-segment groups like log4j, rhino). Add 17 curated MAVEN_CPE_MAP entries, each verified against NVD's own cpeMatch data and confirmed to recover the real CVE via a local grype CPE lookup.
Some projects have NVD-filed CVEs under more than one CPE vendor across their history (a rename or corporate acquisition), and a CycloneDX component's cpe field can only hold one. Confirmed for Spring Framework (SpringSource -> Pivotal -> VMware) and Jetty's pre-Eclipse org.mortbay.jetty groupId, each via a direct grype CPE lookup showing CVEs one vendor alone would miss. MAVEN_CPE_MAP entries can now list extra (vendor, product) alternates, recorded on the component as bomlens:cpeAlternates and looked up by scan-nvd-cpe.py as individual bare-CPE grype queries merged into the same match list, so they get identical NVD-verify/severity handling with no duplicate (purl, cve) rows against the primary match.
…s Artemis) org.apache.activemq is shared by two different NVD products: Artemis (artifactIds prefixed "artemis-") and Classic ActiveMQ (everything else). The generic rule already derives apache:activemq correctly for Classic, but every Artemis artifact was getting the same wrong CPE. MAVEN_CPE_MAP entries can now be a dict keyed by artifactId prefix instead of a flat (vendor, product) tuple, with "" as the catch-all default. Investigated org.glassfish for the same treatment (also flagged as a shared-groupId gap): every org.glassfish/* artifact actually observed in the corpus is a generic Jakarta/Java EE API jar, not the GlassFish server itself, so there is no artifactId prefix to route on safely. Left uncurated.
…cpe-split # Conflicts: # docker/lib/enrich-maven-cpe.py # tests/test-postprocess.sh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces #749, which GitHub auto-closed when its stacked base branch was deleted on merge. Same content, rebased onto current main.