Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Github action still reports aliases of suppressed vulnerabilities #634

Closed
maxfisher-g opened this issue Nov 2, 2023 · 0 comments · Fixed by #647
Closed

Github action still reports aliases of suppressed vulnerabilities #634

maxfisher-g opened this issue Nov 2, 2023 · 0 comments · Fixed by #647
Assignees
@another-rex
Labels
bug Something isn't working

Comments

@maxfisher-g
Copy link

After adding the OSV-Scanner github action to Package Analysis, (PR action config, scheduled action config), the action picked up the CVE-2020-8911 vulnerability.

Since this does not actually affect us, we followed the suggested remediation steps and suppressed it using this osv-scanner.toml config.

However, the OSV-scanner job still fails on subsequent workflow runs and reports the presence of GO-2022-0646, which is an alias of CVE-2020-8911.
@cuixq cuixq added the bug Something isn't working label Nov 2, 2023
@maxfisher-g maxfisher-g mentioned this issue Nov 6, 2023
Merged
@another-rex another-rex mentioned this issue Nov 6, 2023
Merged
another-rex added a commit that referenced this issue Nov 27, 2023
@another-rex
Fix filter ids (#647)
7712ad4 
Fixes #634 

The actual change is just adding an `Aliases` field to the Group output,
that combines all the IDs and aliases together. A lot of fixtures had to
be updated though.

Added an additional test for this in `main_test`, and also modified a
test in `osvscanner_internal_tests.go`

Also added `omitempty` tag to `PackageInfo.commit` which it should have
contained in the first place.
@BrewTestBot BrewTestBot mentioned this issue Dec 6, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@another-rex another-rex

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix filter ids another-rex/osv-scanner
3 participants
@cuixq @another-rex @maxfisher-g