Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added config option to allow CVE matches without version constraints #1292

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

jstucke
Copy link
Collaborator

@jstucke jstucke commented Nov 11, 2024

CPEs without version constraints (and therefore also related CVEs) were previously ignored due to the high risk of false positives. This PR adds a config option to enable matching those entries (disabled by default)

resolves #1290

@jstucke jstucke self-assigned this Nov 11, 2024
@jstucke jstucke force-pushed the cpe-without-version-constraints branch from 4bdc111 to 770a7f5 Compare December 11, 2024 08:55
@codecov-commenter
Copy link

codecov-commenter commented Dec 11, 2024

Codecov Report

Attention: Patch coverage is 75.00000% with 2 lines in your changes missing coverage. Please review.

Project coverage is 91.83%. Comparing base (2aa83a0) to head (770a7f5).

Files with missing lines Patch % Lines
src/plugins/analysis/cve_lookup/internal/lookup.py 66.66% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1292      +/-   ##
==========================================
- Coverage   92.34%   91.83%   -0.51%     
==========================================
  Files         379      378       -1     
  Lines       23465    20972    -2493     
==========================================
- Hits        21669    19260    -2409     
+ Misses       1796     1712      -84     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Detecting lack of CVE in openssh
2 participants