Skip to content

feat: support ubutnu severity type #2076

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hogo6002 merged 5 commits into from
Jul 16, 2025
Merged

feat: support ubutnu severity type #2076

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e0bdce7
feat: support ubutnu severity type
hogo6002 Jul 15, 2025
0c803bb
add unwanted vuln into toml
hogo6002 Jul 15, 2025
a70e9f7
Merge remote-tracking branch 'upstream/main' into fix_ubuntu_severity
hogo6002 Jul 15, 2025
c7f0f93
update snaps due to new vulns and new upstream added
hogo6002 Jul 15, 2025
ba74167
also check empty tag
hogo6002 Jul 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
167 changes: 92 additions & 75 deletions cmd/osv-scanner/scan/image/__snapshots__/command_test.snap
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ require (
github.com/jedib0t/go-pretty/v6 v6.6.7
github.com/muesli/reflow v0.3.0
github.com/opencontainers/go-digest v1.0.0
github.com/ossf/osv-schema/bindings/go v0.0.0-20250701001340-180f03cc6901
github.com/ossf/osv-schema/bindings/go v0.0.0-20250715064423-7310c9ec4b2a
github.com/owenrumney/go-sarif/v3 v3.2.1
github.com/package-url/packageurl-go v0.1.3
github.com/pandatix/go-cvss v0.6.2
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,8 +306,8 @@ github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU
github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
github.com/ossf/osv-schema/bindings/go v0.0.0-20250701001340-180f03cc6901 h1:WqiL5LXnCYjEgibZc+M8+jamka8gi1ySjNiuqFWWKEE=
github.com/ossf/osv-schema/bindings/go v0.0.0-20250701001340-180f03cc6901/go.mod h1:lILztSxHU7VsdlYqCnwgxSDBhbXMf7iEQWtldJCDXPo=
github.com/ossf/osv-schema/bindings/go v0.0.0-20250715064423-7310c9ec4b2a h1:eff71rMluaulxKV/PaG70M0DWvw79AuEXa4K8mHJkuk=
github.com/ossf/osv-schema/bindings/go v0.0.0-20250715064423-7310c9ec4b2a/go.mod h1:lILztSxHU7VsdlYqCnwgxSDBhbXMf7iEQWtldJCDXPo=
github.com/owenrumney/go-sarif/v3 v3.2.1 h1:Dogf2wkOxxRkG3O/B9T6dokyDSl36q19tlMYtXOTThE=
github.com/owenrumney/go-sarif/v3 v3.2.1/go.mod h1:S2sdyDnv0sxN5x+M8iFZIzZE2+uTX/1uXlwTRx0efT0=
github.com/package-url/packageurl-go v0.1.3 h1:4juMED3hHiz0set3Vq3KeQ75KD1avthoXLtmE3I0PLs=
Expand Down
5 changes: 5 additions & 0 deletions internal/image/fixtures/ubuntu20-04-unimportant-config.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,3 +67,8 @@ ignore = true
name = "gnutls28"
Comment thread
hogo6002 marked this conversation as resolved.
reason = "Just want to test only unimportant vulns"
ignore = true

[[PackageOverrides]]
name = "tar"
reason = "Just want to test only unimportant vulns"
ignore = true
2 changes: 2 additions & 0 deletions internal/utility/severity/severity.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,8 @@ func CalculateScore(severity osvschema.Severity) (float64, string, error) {
score = vec.Score()
rating, err = gocvss40.Rating(score)
}
case osvschema.SeverityUbuntu:
rating = severity.Score
}

return score, rating, err
Expand Down
13 changes: 10 additions & 3 deletions pkg/osvscanner/vulnerability_result.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,7 @@ func buildVulnerabilityResults(
// within their respective groups' experimental analysis.
func setUnimportant(pkg *models.PackageVulns) {
for _, vuln := range pkg.Vulnerabilities {
if !isUnimportant(vuln.Affected) {
if !isUnimportant(vuln) {
continue
}
for i, group := range pkg.Groups {
Expand All @@ -211,11 +211,18 @@ func setUnimportant(pkg *models.PackageVulns) {
// isUnimportant checks if a Debian-based vulnerability is tagged as unimportant
// Debian: https://security-team.debian.org/security_tracker.html#severity-levels
// Ubuntu: https://ubuntu.com/security/cves/about#priority
func isUnimportant(affectedPackages []osvschema.Affected) bool {
for _, affected := range affectedPackages {
func isUnimportant(vuln osvschema.Vulnerability) bool {
for _, severity := range vuln.Severity {
if strings.HasPrefix(vuln.ID, "UBUNTU-CVE-") && severity.Type == osvschema.SeverityUbuntu {
return severity.Score == "negligible"
}
}

for _, affected := range vuln.Affected {
if affected.EcosystemSpecific["urgency"] == "unimportant" {
return true
}
// TODO (gongh@): Remove this once Ubuntu has fully moved all priority tags into the severity field.
if affected.EcosystemSpecific["ubuntu_priority"] == "negligible" {
return true
}
Expand Down
Loading