feat: enhance products with no identified vulnerabilities #3254
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ffontaine
force-pushed
the
enhance-products-no-identified-vulns
branch
from
0633d82 to
3c49231
Compare
ffontaine
changed the title
Codecov Report
@@ Coverage Diff @@
## main #3254 +/- ##
==========================================
- Coverage 80.94% 75.63% -5.32%
==========================================
Files 724 724
Lines 11299 11301 +2
Branches 1525 1527 +2
==========================================
- Hits 9146 8547 -599
- Misses 1740 2420 +680
+ Partials 413 334 -79
Flags with carried forward coverage won't be shown. Click here to find out more.
... and 22 files with indirect coverage changes 📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
Currently, cve-bin-tool will return gnu:zlib in "Products with No Identified Vulnerabilities" if zlib is found but not affected by CVE-2016-9842 (i.e. zlib >= 1.2.9) because NVD NIST database contains two CPE IDs for zlib (gnu:zlib and zlib:zlib) With this update, product with multiple vendors will not be displayed under above section if a CVE is found with one of the vendor. Fix intel#3169 Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>
ffontaine
force-pushed
the
enhance-products-no-identified-vulns
branch
from
91d66f4 to
60d75ef
Compare
|
What a simple and elegant solution to the problem. It looks good at a glance; I'll be back after the tests have run and I'm sure it won't cause any surprise failures. |
terriko
approved these changes
Aug 17, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, cve-bin-tool will return
gnu:zlibin "Products with No Identified Vulnerabilities" if zlib is found but not affected by CVE-2016-9842 (i.e. zlib >= 1.2.9) because NVD NIST database contains two CPE IDs for zlib (gnu:zlibandzlib:zlib)With this update, product with multiple vendors will not be displayed under above section if a CVE is found with one of the vendor.
Fix #3169