Skip to content

Commit 4fa2fa4

Browse files
hogo6002hogo6002
authored
filter out unimportant vulnerabilities from vuln group (#1072)
#968 only filters out unimportant vulnerabilities from `pkgVulns.Vulnerabilities` but not from `pkgVulns.Groups`. This causes some unimportant vulnerabilities to still appear in the scanner output. Fixing this issue by ignoring all unimportant vulnerability groups.
1 parent e619fcc commit 4fa2fa4

File tree

2 files changed

+15
-25
lines changed

2 files changed

+15
-25
lines changed

‎cmd/osv-scanner/__snapshots__/main_test.snap

-18
Original file line numberDiff line numberDiff line change
@@ -1045,7 +1045,6 @@ Filtered 15 vulnerabilities from output
10451045
| https://osv.dev/DSA-4685-1 | | Debian | apt | 1.4.11 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10461046
| https://osv.dev/DSA-4808-1 | | Debian | apt | 1.4.11 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10471047
| https://osv.dev/CVE-2016-2781 | 6.5 | Debian | coreutils | 8.26-3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1048-
| https://osv.dev/CVE-2017-18018 | 4.7 | Debian | coreutils | 8.26-3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10491048
| https://osv.dev/DLA-3482-1 | | Debian | debian-archive-keyring | 2017.5+deb9u2 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10501049
| https://osv.dev/DLA-3022-1 | | Debian | dpkg | 1.18.25 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10511050
| https://osv.dev/DSA-5147-1 | | Debian | dpkg | 1.18.25 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
@@ -1058,12 +1057,9 @@ Filtered 15 vulnerabilities from output
10581057
| https://osv.dev/GHSA-xr7r-f8xq-vfvv | 8.6 | Go | github.com/opencontainers/runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10591058
| https://osv.dev/GHSA-p782-xgp4-8hr8 | 5.3 | Go | golang.org/x/sys | v0.0.0-20210817142637-7d9622a276b7 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10601059
| https://osv.dev/DSA-5122-1 | | Debian | gzip | 1.6-5+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1061-
| https://osv.dev/CVE-2018-1000654 | 5.5 | Debian | libtasn1-6 | 4.10-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10621060
| https://osv.dev/DLA-3263-1 | | Debian | libtasn1-6 | 4.10-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10631061
| https://osv.dev/CVE-2017-18258 | 6.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10641062
| https://osv.dev/CVE-2018-14404 | 7.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1065-
| https://osv.dev/CVE-2020-24977 | 6.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1066-
| https://osv.dev/CVE-2024-34459 | | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10671063
| https://osv.dev/DLA-3012-1 | | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10681064
| https://osv.dev/DLA-3172-1 | | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10691065
| https://osv.dev/DLA-3405-1 | | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
@@ -1098,10 +1094,6 @@ Filtered 15 vulnerabilities from output
10981094
| https://osv.dev/DLA-3651-1 | | Debian | postgresql-11 | 11.15-1.pgdg90+1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
10991095
| https://osv.dev/DLA-3764-1 | | Debian | postgresql-11 | 11.15-1.pgdg90+1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11001096
| https://osv.dev/DSA-5135-1 | | Debian | postgresql-11 | 11.15-1.pgdg90+1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1101-
| https://osv.dev/CVE-2005-2541 | | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1102-
| https://osv.dev/CVE-2019-9923 | 7.5 | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1103-
| https://osv.dev/CVE-2021-20193 | 5.5 | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1104-
| https://osv.dev/CVE-2022-48303 | 5.5 | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11051097
| https://osv.dev/DLA-3755-1 | | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11061098
| https://osv.dev/DLA-3051-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11071099
| https://osv.dev/DLA-3134-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
@@ -1110,7 +1102,6 @@ Filtered 15 vulnerabilities from output
11101102
| https://osv.dev/DLA-3412-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11111103
| https://osv.dev/DLA-3684-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11121104
| https://osv.dev/DLA-3788-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1113-
| https://osv.dev/CVE-2022-0563 | 5.5 | Debian | util-linux | 2.29.2-1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11141105
| https://osv.dev/DLA-3782-1 | | Debian | util-linux | 2.29.2-1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11151106
| https://osv.dev/DSA-5055-1 | | Debian | util-linux | 2.29.2-1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11161107
| https://osv.dev/DSA-5650-1 | | Debian | util-linux | 2.29.2-1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
@@ -1138,7 +1129,6 @@ Filtered 15 vulnerabilities from output
11381129
| https://osv.dev/DSA-4685-1 | | Debian | apt | 1.4.11 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11391130
| https://osv.dev/DSA-4808-1 | | Debian | apt | 1.4.11 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11401131
| https://osv.dev/CVE-2016-2781 | 6.5 | Debian | coreutils | 8.26-3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1141-
| https://osv.dev/CVE-2017-18018 | 4.7 | Debian | coreutils | 8.26-3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11421132
| https://osv.dev/DLA-3482-1 | | Debian | debian-archive-keyring | 2017.5+deb9u2 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11431133
| https://osv.dev/DLA-3022-1 | | Debian | dpkg | 1.18.25 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11441134
| https://osv.dev/DSA-5147-1 | | Debian | dpkg | 1.18.25 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
@@ -1151,12 +1141,9 @@ Filtered 15 vulnerabilities from output
11511141
| https://osv.dev/GHSA-xr7r-f8xq-vfvv | 8.6 | Go | github.com/opencontainers/runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11521142
| https://osv.dev/GHSA-p782-xgp4-8hr8 | 5.3 | Go | golang.org/x/sys | v0.0.0-20210817142637-7d9622a276b7 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11531143
| https://osv.dev/DSA-5122-1 | | Debian | gzip | 1.6-5+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1154-
| https://osv.dev/CVE-2018-1000654 | 5.5 | Debian | libtasn1-6 | 4.10-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11551144
| https://osv.dev/DLA-3263-1 | | Debian | libtasn1-6 | 4.10-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11561145
| https://osv.dev/CVE-2017-18258 | 6.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11571146
| https://osv.dev/CVE-2018-14404 | 7.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1158-
| https://osv.dev/CVE-2020-24977 | 6.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1159-
| https://osv.dev/CVE-2024-34459 | | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11601147
| https://osv.dev/DLA-3012-1 | | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11611148
| https://osv.dev/DLA-3172-1 | | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11621149
| https://osv.dev/DLA-3405-1 | | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
@@ -1191,10 +1178,6 @@ Filtered 15 vulnerabilities from output
11911178
| https://osv.dev/DLA-3651-1 | | Debian | postgresql-11 | 11.15-1.pgdg90+1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11921179
| https://osv.dev/DLA-3764-1 | | Debian | postgresql-11 | 11.15-1.pgdg90+1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11931180
| https://osv.dev/DSA-5135-1 | | Debian | postgresql-11 | 11.15-1.pgdg90+1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1194-
| https://osv.dev/CVE-2005-2541 | | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1195-
| https://osv.dev/CVE-2019-9923 | 7.5 | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1196-
| https://osv.dev/CVE-2021-20193 | 5.5 | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1197-
| https://osv.dev/CVE-2022-48303 | 5.5 | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11981181
| https://osv.dev/DLA-3755-1 | | Debian | tar | 1.29b-1.1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
11991182
| https://osv.dev/DLA-3051-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
12001183
| https://osv.dev/DLA-3134-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
@@ -1203,7 +1186,6 @@ Filtered 15 vulnerabilities from output
12031186
| https://osv.dev/DLA-3412-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
12041187
| https://osv.dev/DLA-3684-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
12051188
| https://osv.dev/DLA-3788-1 | | Debian | tzdata | 2021a-0+deb9u3 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
1206-
| https://osv.dev/CVE-2022-0563 | 5.5 | Debian | util-linux | 2.29.2-1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
12071189
| https://osv.dev/DLA-3782-1 | | Debian | util-linux | 2.29.2-1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
12081190
| https://osv.dev/DSA-5055-1 | | Debian | util-linux | 2.29.2-1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
12091191
| https://osv.dev/DSA-5650-1 | | Debian | util-linux | 2.29.2-1+deb9u1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |

‎pkg/osvscanner/osvscanner.go

+15-7
Original file line numberDiff line numberDiff line change
@@ -696,6 +696,16 @@ func filterPackageVulns(r reporter.Reporter, pkgVulns models.PackageVulns, confi
696696
return pkgVulns
697697
}
698698
ignoredVulns := map[string]struct{}{}
699+
700+
// Ignores all unimportant vulnerabilities.
701+
for _, vuln := range pkgVulns.Vulnerabilities {
702+
if isUnimportant(pkgVulns.Package.Ecosystem, vuln.Affected) {
703+
// Track the count of all unimportant vulnerabilities, including duplicate vulnerabilities from different packages.
704+
*unimportantCount++
705+
ignoredVulns[vuln.ID] = struct{}{}
706+
}
707+
}
708+
699709
// Iterate over groups first to remove all aliases of ignored vulnerabilities.
700710
var newGroups []models.GroupInfo
701711
for _, group := range pkgVulns.Groups {
@@ -718,6 +728,11 @@ func filterPackageVulns(r reporter.Reporter, pkgVulns models.PackageVulns, confi
718728

719729
break
720730
}
731+
732+
if _, unimportant := ignoredVulns[id]; unimportant {
733+
r.Verbosef("%s has been filtered out due to its unimportance.\n", id)
734+
ignore = true
735+
}
721736
}
722737
if !ignore {
723738
newGroups = append(newGroups, group)
@@ -727,13 +742,6 @@ func filterPackageVulns(r reporter.Reporter, pkgVulns models.PackageVulns, confi
727742
var newVulns []models.Vulnerability
728743
if len(newGroups) > 0 { // If there are no groups left then there would be no vulnerabilities.
729744
for _, vuln := range pkgVulns.Vulnerabilities {
730-
if isUnimportant(pkgVulns.Package.Ecosystem, vuln.Affected) {
731-
*unimportantCount++
732-
r.Verbosef("%s has been filtered out due to its unimportance.\n", vuln.ID)
733-
734-
continue
735-
}
736-
737745
if _, filtered := ignoredVulns[vuln.ID]; !filtered {
738746
newVulns = append(newVulns, vuln)
739747
}

0 commit comments

Comments
 (0)