refactor: add warning if severity not from vendor (or NVD or GH) is used #6726
Conversation
pkg/vulnerability/vulnerability.go
Outdated
| @@ -130,6 +130,7 @@ func (c Client) getVendorSeverity(vulnID string, vuln *dbTypes.Vulnerability, so | |||
| return dbTypes.SeverityUnknown.String(), "" | |||
| } | |||
|
|
|||
| log.Warn("Vendor and NVD don't have severity level. Severity from another vendor is used (see `VendorSeverity` in `json` format).", log.String("CVE", vulnID)) | |||
There was a problem hiding this comment.
It's not necessarily CVE-ID.
| log.Warn("Vendor and NVD don't have severity level. Severity from another vendor is used (see `VendorSeverity` in `json` format).", log.String("CVE", vulnID)) | |
| log.Warn("Vendor and NVD don't have severity level. Severity from another vendor is used (see `VendorSeverity` in `json` format).", log.String("vulnerability-id", vulnID)) |
There was a problem hiding this comment.
Vendor is unclear. We may want to show the source (dbTypes.SourceID).
There was a problem hiding this comment.
I thought about this, but there is 1 problem with this.
We fill severity filed in trivy-db:
https://github.com/aquasecurity/trivy-db/blob/b8fe1376ffcdc69fe454f0a8a481ab485e47aea5/pkg/vulnsrc/vulnerability/vulnerability.go#L92-L108
Therefore, we don't have info about vendor for this severity.
We can only check vendorSeverity and detect vendor with same severity.
But if 2 vendors use this severity, we may make mistake in our choice
There was a problem hiding this comment.
I mean, we should say "Debian and NVD don't have severity" when scanning a Debian image and "Ubuntu and NVD don't have severity" when scanning an Ubuntu image. We need to consider what should be displayed with language-specific packages, though.
There was a problem hiding this comment.
I understand you now.
We can use dataSource.Name (see :
It also works for language-specific packages
Co-authored-by: Teppei Fukuda <knqyf263@gmail.com>
…ndor-severity-missing-log
Description
See #6714 (comment)
Example:
Related issues
nvdandsourcedon't have severity for vulnerability #6714Checklist