{"action":"created","issue":{"url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-vscode-extension/issues/203","repository_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-vscode-extension","labels_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-vscode-extension/issues/203/labels{/name}","comments_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-vscode-extension/issues/203/comments","events_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-vscode-extension/issues/203/events","html_url":"https://github.com/fabric8-analytics/fabric8-analytics-vscode-extension/issues/203","id":369814857,"node_id":"MDU6SXNzdWUzNjk4MTQ4NTc=","number":203,"title":"Why aren't all CVEs reported?","user":{"login":"fbricon","id":148698,"node_id":"MDQ6VXNlcjE0ODY5OA==","avatar_url":"https://avatars3.githubusercontent.com/u/148698?v=4","gravatar_id":"","url":"https://api.github.com/users/fbricon","html_url":"https://github.com/fbricon","followers_url":"https://api.github.com/users/fbricon/followers","following_url":"https://api.github.com/users/fbricon/following{/other_user}","gists_url":"https://api.github.com/users/fbricon/gists{/gist_id}","starred_url":"https://api.github.com/users/fbricon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fbricon/subscriptions","organizations_url":"https://api.github.com/users/fbricon/orgs","repos_url":"https://api.github.com/users/fbricon/repos","events_url":"https://api.github.com/users/fbricon/events{/privacy}","received_events_url":"https://api.github.com/users/fbricon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-10-13T15:54:40Z","updated_at":"2018-11-28T09:22:08Z","closed_at":null,"author_association":"NONE","body":"It seems only some CVEs are reported but not others, I'm not sure if there's a severity threshold under which vulnerabilities are ignored.\r\n\r\n- it should be made clear, in the project's readme at least, what the scope of this analysis is, i.e. what's vulnerability criteria are used to flag a vulnerable dependency,\r\n- if there's indeed a threshold, then, it should be made user configurable, and different vulns could be reported with different diagnostic severities (warning, info for lower severities)\r\n\r\nExamples of ignored vulns in pom.xml:\r\n```\r\n<dependency>\r\n  <groupId>org.apache.poi</groupId>\r\n  <artifactId>poi</artifactId>\r\n  <version>3.16</version> <!-- https://www.cvedetails.com/cve/CVE-2017-12626/ -->\r\n</dependency>\r\n<dependency>\r\n  <groupId>org.springframework.amqp</groupId>\r\n  <artifactId>spring-amqp</artifactId>\r\n  <version>1.4.4.RELEASE</version><!-- https://www.cvedetails.com/cve/CVE-2016-2173/ -->\r\n</dependency>\r\n<dependency>\r\n  <groupId>org.springframework</groupId>\r\n  <artifactId>spring-webmvc</artifactId>\r\n  <version>3.2.3.RELEASE</version> <!-- https://www.cvedetails.com/cve/CVE-2013-7315/ -->\r\n</dependency>\r\n```\r\n\r\nAll those dependencies are flagged as critically vulnerable in https://search.maven.org/ "},"comment":{"url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-vscode-extension/issues/comments/442377097","html_url":"https://github.com/fabric8-analytics/fabric8-analytics-vscode-extension/issues/203#issuecomment-442377097","issue_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-vscode-extension/issues/203","id":442377097,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjM3NzA5Nw==","user":{"login":"msrb","id":3759039,"node_id":"MDQ6VXNlcjM3NTkwMzk=","avatar_url":"https://avatars0.githubusercontent.com/u/3759039?v=4","gravatar_id":"","url":"https://api.github.com/users/msrb","html_url":"https://github.com/msrb","followers_url":"https://api.github.com/users/msrb/followers","following_url":"https://api.github.com/users/msrb/following{/other_user}","gists_url":"https://api.github.com/users/msrb/gists{/gist_id}","starred_url":"https://api.github.com/users/msrb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msrb/subscriptions","organizations_url":"https://api.github.com/users/msrb/orgs","repos_url":"https://api.github.com/users/msrb/repos","events_url":"https://api.github.com/users/msrb/events{/privacy}","received_events_url":"https://api.github.com/users/msrb/received_events","type":"User","site_admin":false},"created_at":"2018-11-28T09:22:08Z","updated_at":"2018-11-28T09:22:08Z","author_association":"MEMBER","body":"@fbricon there is no severity threshold for CVEs. The database that we use is still incomplete, meaning many of existing CVEs is not there yet and thus we cannot report them. We are focusing on NPM and Python CVEs at the moment as those are much easier than Maven.\r\n\r\nMaven CVEs will come later. We may try to add CVEs for Jetty, Tomcat and others sooner, but you will still find situations where GitHub reports CVEs that fabric8-analytics doesn't recognize yet. "}}
{"actor":{"display_login":"msrb"}}