CVE-2022-30187 is not reported for java and Python SDKs about osv.dev

[andrewpollock]

Perhaps retain the raw CPE information for NVD under database_specific and ensure both NVD and GHSA information are presented for all CVEs?

That would not help in this situation, as the original data source is the GitHub Advisory Database. The NVD was not involved in this record at all.

I have gone ahead and suggested the GitHub Advisory Database record add the missing Java and Python packages so we can close out this issue.

[andrewpollock]

Hey @prabhu

Thanks for taking a look at our data, I'd love to more broadly explore any gaps you've identified using this CPE to Purl technique you mention.

In the case of this particular CVE, I'm not seeing how there's a discrepancy?

Looking at https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-30187, I can see the following CPEs:

        "configurations": [
          {
            "nodes": [
              {
                "operator": "OR",
                "negate": false,
                "cpeMatch": [
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:.net:*:*",
                    "versionEndExcluding": "12.13.0",
                    "matchCriteriaId": "76C885A0-06D7-4573-97BA-FBCA7653F008"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:python:*:*",
                    "versionEndExcluding": "12.13.0",
                    "matchCriteriaId": "2E1A488F-D561-4005-AFF8-468860F40816"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:java:*:*",
                    "versionEndExcluding": "12.18.0",
                    "matchCriteriaId": "153D4518-8E6D-48D0-9BC5-EB482EDBF07B"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:microsoft:azure_storage_queue:*:*:*:*:*:python:*:*",
                    "versionEndExcluding": "12.4.0",
                    "matchCriteriaId": "F765F0A9-3756-4C1E-85B0-1438474B4590"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:microsoft:azure_storage_queue:*:*:*:*:*:.net:*:*",
                    "versionEndExcluding": "12.11.0",
                    "matchCriteriaId": "5444CD1F-54C8-4918-8842-5320DE43FDBC"
                  }
                ]
              }
            ]
          }
        ],

which seems to me to correlate with what is currently available for https://api.osv.dev/v1/vulns/GHSA-64x4-9hc6-r2h6:

  "affected": [
    {
      "package": {
        "name": "Azure.Storage.Queues",
        "ecosystem": "NuGet",
        "purl": "pkg:nuget/Azure.Storage.Queues"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.11.0"
            }
          ]
        }
      ],
      "versions": [
        "12.0.0",
        "12.1.0",
        "12.1.1",
        "12.10.0",
        "12.2.0",
        "12.3.0",
        "12.3.1",
        "12.3.2",
        "12.4.0",
        "12.4.1",
        "12.4.2",
        "12.5.0",
        "12.6.0",
        "12.6.1",
        "12.6.2",
        "12.7.0",
        "12.8.0",
        "12.9.0"
      ],
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-64x4-9hc6-r2h6/GHSA-64x4-9hc6-r2h6.json"
      }
    },
    {
      "package": {
        "name": "Azure.Storage.Blobs",
        "ecosystem": "NuGet",
        "purl": "pkg:nuget/Azure.Storage.Blobs"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.13.0"
            }
          ]
        }
      ],
      "versions": [
        "12.0.0",
        "12.1.0",
        "12.10.0",
        "12.11.0",
        "12.12.0",
        "12.2.0",
        "12.3.0",
        "12.4.0",
        "12.4.1",
        "12.4.2",
        "12.4.3",
        "12.4.4",
        "12.5.0",
        "12.5.1",
        "12.6.0",
        "12.7.0",
        "12.8.0",
        "12.8.1",
        "12.8.2",
        "12.8.3",
        "12.8.4",
        "12.9.0",
        "12.9.1"
      ],
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-64x4-9hc6-r2h6/GHSA-64x4-9hc6-r2h6.json"
      }
    }
  ],

i.e., I'm seeing:

• Azure.Storage.Queues
• Azure.Storage.Blobs

The CVE itself isn't converting to a first class OSV record (it's just an alias of GHSA-64x4-9hc6-r2h6 as you note), because our conversion process hasn't been able to derive a Git repository CPEs, and looking at https://github.com/scanoss/purl2cpe/tree/main/data/microsoft, which I've been using as an independent cross-reference, I'm not seeing anything particularly useful there, either.

Could you please elaborate on how the current behaviour is not aligning with what you're expecting?

[prabhu]

Thanks @andrewpollock. I will share the script once it's in good shape. It is currently buggy and unreliable.

Regarding the CPE, you can find java and python under target_sw, which is how the package ecosystem is represented. Depscan, for example, can now report these vulnerabilities for the equivalent maven and pypi packages in addition to nuget as well.

Perhaps retain the raw CPE information for NVD under database_specific and ensure both NVD and GHSA information are presented for all CVEs?

[andrewpollock]

Regarding the CPE, you can find java and python under target_sw, which is how the package ecosystem is represented.

Ah, I see. Thanks for highlighting that.

In the case of GHSA-64x4-9hc6-r2h6 specifically, any deficiencies in comprehensiveness need to be taken up with the GitHub Advisory Database, via https://github.com/advisories/GHSA-64x4-9hc6-r2h6/improve