Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerability filter #271

Open
wants to merge 18 commits into
base: master
Choose a base branch
from

Conversation

Steppenw01f
Copy link

@Steppenw01f Steppenw01f commented Mar 13, 2023

fixes #184 and #204

This is the improvement of #232

This pull request contains following improvements:

  • The CVE gets a list of vulnerable vendors/products
  • The users can decide if they would like to get all activities in CVE, where their subscriptions are referenced or only the ones, where the subscriptions are marked as source of vulnerability
  • The dashboard offers a view, where only the activities are listed of subscriptions that are marked as source of vulnerability in a CVE

This approach is designed to work without changes of the database, but this would result in the identification of vulnerable vendors/products for changed or new CVEs.
-> If possible, the opencve import-data command should be used to guaranty completeness of the data.

This approach uses does not change the functionality of the current System, only enhances it. The solution of the identification of sources of vulnerabilities are solved by creating duplicates with identifiers for the vulnerability. With the example proposed in this comment, the resulting vendors object would look like:

['lexmark',
'$VULN$lexmark',
'lexmark$PRODUCT$b2236_firmware',
'$VULN$lexmark$PRODUCT$b2236_firmware',
'lexmark$PRODUCT$b2236']

In the processing and the creation of vendors and products, the ones with the '$VULN$' Separator get ignored, so that no further vendors and products get created and the CVE entries can be filtered by the source of vulnerability.

@Steppenw01f Steppenw01f reopened this Mar 14, 2023
@Steppenw01f
Copy link
Author

The tests have been adapted and code-style changed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Products are mainly associated with a vulnerabilty and not vulnerable
1 participant