├── tools ├── __init__.py ├── redhat │ ├── __init__.py │ ├── redhat_osv │ │ ├── __init__.py │ │ ├── convert_redhat_test.py │ │ ├── osv_test.py │ │ └── csaf_test.py │ ├── .gitignore │ ├── .style.yapf │ ├── .pylintrc │ ├── Pipfile │ ├── setup.py │ ├── convert_redhat.py │ ├── README.md │ └── testdata │ │ └── OSV │ │ └── RHSA-2024_4546.json ├── debian │ ├── .style.yapf │ ├── Pipfile │ ├── README.md │ └── first_package_finder.py ├── ghsa │ ├── .style.yapf │ ├── .pylintrc │ ├── Pipfile │ ├── README.md │ ├── testdata │ │ ├── greater_than_equals_no_patch.json │ │ ├── greater_than_equals_no_patch.osv.json │ │ ├── equals_no_patch.osv.json │ │ ├── multiple_ranges_in_package.osv.json │ │ ├── equals_no_patch.json │ │ ├── less_than_equals_no_patch.osv.json │ │ ├── multiple_ranges_in_package.json │ │ ├── less_than_equals_no_patch.json │ │ ├── withdrawn.osv.json │ │ ├── npm_greater_than.osv.json │ │ ├── npm_greater_than.json │ │ ├── less_than_equals_with_patch.json │ │ ├── less_than_equals_with_patch.osv.json │ │ ├── withdrawn.json │ │ ├── equals_with_patch.osv.json │ │ ├── equals_with_patch.json │ │ ├── maven_greater_than.osv.json │ │ ├── full_ranges.json │ │ ├── maven_greater_than.json │ │ ├── pypi_normalize.json │ │ ├── pypi_normalize.osv.json │ │ └── full_ranges.osv.json │ ├── convert_ghsa_test.py │ └── dump_ghsa.py └── osv-linter │ ├── internal │ ├── checks │ │ ├── schema_test.go │ │ ├── ranges_test.go │ │ ├── schema.go │ │ ├── packages_test.go │ │ ├── ranges.go │ │ ├── checks.go │ │ ├── record.go │ │ └── packages.go │ ├── faulttolerant │ │ └── http.go │ └── pkgchecker │ │ ├── packagist.go │ │ ├── package_check.go │ │ └── ecosystems.go │ ├── go.mod │ ├── testdata │ ├── GO-2020-0001.json │ ├── nopackage-GHSA-9v2f-6vcg-3hgv.json │ ├── GHSA-9v2f-6vcg-3hgv.json │ ├── MAL-2024-10238.json │ ├── GO-2024-2963.json │ ├── nointroduced-CVE-2023-41045.json │ ├── CVE-2023-41045.json │ ├── PYSEC-2023-74.json │ └── RHSA-2022_0216.json │ ├── cmd │ └── osv │ │ └── main.go │ ├── go.sum │ └── README.md ├── docs ├── _data │ ├── authors.yml │ ├── navigation.yml │ ├── licenses.yml │ ├── variables.yml │ └── locale.yml ├── schema.json ├── .bundle │ └── config ├── .gitignore ├── images │ └── git_graph.png ├── Gemfile └── _config.yml ├── .bundle └── config ├── schema.md ├── .gitignore ├── bindings ├── go │ ├── go.mod │ ├── go.sum │ └── osvconstants │ │ └── constants.go └── build.sh ├── .editorconfig ├── validation └── README.md ├── RELEASING.md ├── .github └── workflows │ ├── ospsSecurityAssesssment.yml │ └── checks.yml ├── security-insights.yml ├── scripts ├── validate-schema-table.py └── update-ecosystems-lists.py ├── CONTRIBUTING.md ├── CHANGELOG.md ├── CODE_OF_CONDUCT.md ├── GUIDING_PRINCIPLES.md └── README.md /tools/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /docs/_data/authors.yml: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /tools/redhat/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /tools/redhat/redhat_osv/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /docs/_data/navigation.yml: -------------------------------------------------------------------------------- 1 | header: [] 2 | -------------------------------------------------------------------------------- /docs/schema.json: -------------------------------------------------------------------------------- 1 | ../validation/schema.json -------------------------------------------------------------------------------- /.bundle/config: -------------------------------------------------------------------------------- 1 | --- 2 | BUNDLE_PATH: "vendor/bundle" 3 | -------------------------------------------------------------------------------- /docs/.bundle/config: -------------------------------------------------------------------------------- 1 | --- 2 | BUNDLE_PATH: "vendor/bundle" 3 | -------------------------------------------------------------------------------- /schema.md: -------------------------------------------------------------------------------- 1 | Moved to . 2 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | go.work 2 | go.work.sum 3 | .vscode/settings.json 4 | -------------------------------------------------------------------------------- /tools/redhat/.gitignore: -------------------------------------------------------------------------------- 1 | redhat_osv.egg-info/ 2 | __pycache__/ 3 | -------------------------------------------------------------------------------- /docs/.gitignore: -------------------------------------------------------------------------------- 1 | _site 2 | .sass-cache 3 | .jekyll-cache 4 | .jekyll-metadata 5 | vendor 6 | -------------------------------------------------------------------------------- /docs/images/git_graph.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ossf/osv-schema/HEAD/docs/images/git_graph.png -------------------------------------------------------------------------------- /bindings/go/go.mod: -------------------------------------------------------------------------------- 1 | module github.com/ossf/osv-schema/bindings/go 2 | 3 | go 1.24.4 4 | 5 | require google.golang.org/protobuf v1.36.10 6 | -------------------------------------------------------------------------------- /tools/debian/.style.yapf: -------------------------------------------------------------------------------- 1 | [style] 2 | based_on_style = yapf 3 | column_limit = 80 4 | indent_width = 2 5 | split_before_named_assigns = true 6 | -------------------------------------------------------------------------------- /tools/ghsa/.style.yapf: -------------------------------------------------------------------------------- 1 | [style] 2 | based_on_style = pep8 3 | column_limit = 80 4 | indent_width = 4 5 | split_before_named_assigns = true 6 | -------------------------------------------------------------------------------- /tools/redhat/.style.yapf: -------------------------------------------------------------------------------- 1 | [style] 2 | based_on_style = pep8 3 | column_limit = 80 4 | indent_width = 4 5 | split_before_named_assigns = true 6 | -------------------------------------------------------------------------------- /tools/ghsa/.pylintrc: -------------------------------------------------------------------------------- 1 | [MESSAGES CONTROL] 2 | disable= 3 | broad-except, 4 | fixme, 5 | too-few-public-methods, 6 | too-many-branches, 7 | too-many-locals, 8 | unspecified-encoding, 9 | -------------------------------------------------------------------------------- /tools/redhat/.pylintrc: -------------------------------------------------------------------------------- 1 | [MESSAGES CONTROL] 2 | disable= 3 | broad-except, 4 | fixme, 5 | too-few-public-methods, 6 | too-many-branches, 7 | too-many-locals, 8 | unspecified-encoding, 9 | -------------------------------------------------------------------------------- /docs/Gemfile: -------------------------------------------------------------------------------- 1 | source "https://rubygems.org" 2 | 3 | gem "github-pages", "~> 228", group: :jekyll_plugins 4 | group :jekyll_plugins do 5 | gem "jekyll-feed", "~> 0.12" 6 | end 7 | 8 | gem "webrick", "~> 1.7" 9 | -------------------------------------------------------------------------------- /tools/debian/Pipfile: -------------------------------------------------------------------------------- 1 | [[source]] 2 | url = "https://pypi.python.org/simple" 3 | verify_ssl = true 4 | name = "pypi" 5 | 6 | [packages] 7 | osv = "*" 8 | markdownify = "*" 9 | pandas = "*" 10 | python-dateutil = "*" 11 | 12 | [dev-packages] 13 | pylint = "*" 14 | yapf = "*" 15 | -------------------------------------------------------------------------------- /tools/ghsa/Pipfile: -------------------------------------------------------------------------------- 1 | [[source]] 2 | url = "https://pypi.python.org/simple" 3 | verify_ssl = true 4 | name = "pypi" 5 | 6 | [packages] 7 | requests = "*" 8 | osv = "*" 9 | 10 | [dev-packages] 11 | pylint = "*" 12 | yapf = "*" 13 | 14 | [requires] 15 | python_version = "3.13" 16 | -------------------------------------------------------------------------------- /bindings/go/go.sum: -------------------------------------------------------------------------------- 1 | github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= 2 | github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= 3 | google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= 4 | google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= 5 | -------------------------------------------------------------------------------- /tools/redhat/Pipfile: -------------------------------------------------------------------------------- 1 | [[source]] 2 | url = "https://pypi.python.org/simple" 3 | verify_ssl = true 4 | name = "pypi" 5 | 6 | [dev-packages] 7 | setuptools = "*" 8 | pylint = "*" 9 | yapf = "*" 10 | redhat_osv = {path = "."} 11 | 12 | [packages] 13 | requests = "*" 14 | setuptools = "*" 15 | packageurl-python = "*" 16 | redhat-osv = {file = ".", editable = true} 17 | -------------------------------------------------------------------------------- /.editorconfig: -------------------------------------------------------------------------------- 1 | # EditorConfig helps developers define and maintain consistent 2 | # coding styles between different editors and IDEs 3 | # editorconfig.org 4 | 5 | root = true 6 | 7 | [*] 8 | end_of_line = lf 9 | charset = utf-8 10 | trim_trailing_whitespace = true 11 | insert_final_newline = true 12 | indent_style = space 13 | indent_size = 2 14 | 15 | [*.go] 16 | indent_style = tab 17 | -------------------------------------------------------------------------------- /tools/ghsa/README.md: -------------------------------------------------------------------------------- 1 | # GHSA to OSV converter 2 | 3 | ## Setup 4 | 5 | ```bash 6 | $ pipenv sync 7 | $ pipenv shell 8 | ``` 9 | 10 | ## Usage 11 | 12 | ```bash 13 | $ mkdir out 14 | $ python3 dump_ghsa.py --token $GITHUB_TOKEN out 15 | $ mkdir osv 16 | $ python3 convert_ghsa.py -o osv out/*.json 17 | ``` 18 | 19 | ## Unit Test 20 | 21 | ```bash 22 | $ python3 -m unittest *_test.py 23 | ``` 24 | -------------------------------------------------------------------------------- /validation/README.md: -------------------------------------------------------------------------------- 1 | # JSON Validator 2 | 3 | This directory contains a JSON schema to validate OSV entries. 4 | 5 | ## Example Usage 6 | 7 | (Any [validator](https://json-schema.org/implementations#validators) can be used, these are a couple that are known to work) 8 | 9 | ``` 10 | $ go run github.com/neilpa/yajsv@latest -s schema.json osv_to_test.json 11 | ``` 12 | 13 | ``` 14 | $ pip install check-jsonschema 15 | $ check-jsonschema --schemafile schema.json osv_to_test.json 16 | ``` 17 | -------------------------------------------------------------------------------- /tools/osv-linter/internal/checks/schema_test.go: -------------------------------------------------------------------------------- 1 | package checks_test 2 | 3 | import ( 4 | "os" 5 | "testing" 6 | 7 | "github.com/google/go-cmp/cmp" 8 | ) 9 | 10 | func TestSchemaHasBeenGenerated(t *testing.T) { 11 | t.Parallel() 12 | 13 | var err error 14 | 15 | want, err := os.ReadFile("../../../../validation/schema.json") 16 | if err != nil { 17 | t.Fatal(err) 18 | } 19 | 20 | got, err := os.ReadFile("schema_generated.json") 21 | if err != nil { 22 | t.Fatal(err) 23 | } 24 | 25 | if diff := cmp.Diff(want, got); diff != "" { 26 | t.Errorf("Schema needs to be regenerated (-want +got):\n%s", diff) 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /RELEASING.md: -------------------------------------------------------------------------------- 1 | # Releasing 2 | 3 | This document outlines the process for creating a new release of the OSV schema. 4 | 5 | ## Release Process 6 | 7 | The release process is as follows: 8 | 9 | 1. **Bump the version:** 10 | - Do a patch version bump for new ecosystems. 11 | - Do a minor version bump for non-breaking schema field changes. 12 | 13 | 2. **Update the changelog:** 14 | - Add any schema changes to the `CHANGELOG.md` file. 15 | 16 | 3. **Tag the release:** 17 | - Create and push a new git tag for the release. 18 | 19 | 4. **Publish GitHub release:** 20 | - Create a new release on GitHub with the new version number. 21 | 22 | 5. **Update GitHub Pages:** 23 | - Update the `live` branch to the new release. 24 | -------------------------------------------------------------------------------- /docs/_data/licenses.yml: -------------------------------------------------------------------------------- 1 | CC-BY-4.0: 2 | name: Attribution 4.0 International 3 | url: https://creativecommons.org/licenses/by/4.0/ 4 | image: https://i.creativecommons.org/l/by/4.0/88x31.png 5 | CC-BY-SA-4.0: 6 | name: Attribution-ShareAlike 4.0 International 7 | url: https://creativecommons.org/licenses/by-sa/4.0/ 8 | image: https://i.creativecommons.org/l/by-sa/4.0/88x31.png 9 | CC-BY-NC-4.0: 10 | name: Attribution-NonCommercial 4.0 International 11 | url: https://creativecommons.org/licenses/by-nc/4.0/ 12 | image: https://i.creativecommons.org/l/by-nc/4.0/88x31.png 13 | CC-BY-ND-4.0: 14 | name: Attribution-NoDerivatives 4.0 International 15 | url: https://creativecommons.org/licenses/by-nd/4.0/ 16 | image: https://i.creativecommons.org/l/by-nd/4.0/88x31.png 17 | -------------------------------------------------------------------------------- /bindings/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Copyright 2025 Google LLC 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | 16 | protoc --proto_path=../proto --go_out=paths=source_relative:go/osvschema vulnerability.proto 17 | (cd .. && python3 scripts/update-ecosystems-lists.py) 18 | -------------------------------------------------------------------------------- /tools/redhat/setup.py: -------------------------------------------------------------------------------- 1 | """ Convert a CSAF document to OSV format 2 | i.e. https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_4546.json 3 | """ 4 | 5 | from setuptools import setup 6 | 7 | REQUIRES = ["jsonschema", "requests", "packageurl-python"] 8 | 9 | setup( 10 | name="redhat_osv", 11 | version="1.0.0", 12 | description="Convert Red Hat CSAF documents to OSV format", 13 | author_email="jshepher@redhat.com", 14 | url="", 15 | keywords=["OSV", "CSAF"], 16 | install_requires=REQUIRES, 17 | classifiers=[ 18 | "Programming Language :: Python :: 3", 19 | ], 20 | packages=["redhat_osv"], 21 | entry_points={"console_scripts": ["convert_redhat=convert_redhat:main"]}, 22 | long_description= 23 | "The purpose of this tool is to convert from Red Hat CSAF documents to OSV", 24 | ) 25 | -------------------------------------------------------------------------------- /tools/osv-linter/go.mod: -------------------------------------------------------------------------------- 1 | module github.com/ossf/osv-schema/linter 2 | 3 | go 1.24.4 4 | 5 | require ( 6 | github.com/google/go-cmp v0.7.0 7 | github.com/google/osv-scalibr v0.3.5-0.20251007022113-0f405599e232 8 | github.com/package-url/packageurl-go v0.1.3 9 | github.com/sethvargo/go-retry v0.2.4 10 | github.com/tidwall/gjson v1.18.0 11 | github.com/urfave/cli/v2 v2.27.2 12 | github.com/xeipuuv/gojsonschema v1.2.0 13 | golang.org/x/mod v0.25.0 14 | golang.org/x/sync v0.16.0 15 | golang.org/x/term v0.32.0 16 | ) 17 | 18 | require ( 19 | github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect 20 | github.com/russross/blackfriday/v2 v2.1.0 // indirect 21 | github.com/stretchr/testify v1.6.1 // indirect 22 | github.com/tidwall/match v1.1.1 // indirect 23 | github.com/tidwall/pretty v1.2.0 // indirect 24 | github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect 25 | github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect 26 | github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 // indirect 27 | golang.org/x/sys v0.33.0 // indirect 28 | ) 29 | -------------------------------------------------------------------------------- /tools/osv-linter/testdata/GO-2020-0001.json: -------------------------------------------------------------------------------- 1 | {"schema_version":"1.3.1","id":"GO-2020-0001","modified":"2024-05-20T16:03:47Z","published":"2021-04-14T20:04:52Z","aliases":["CVE-2020-36567","GHSA-6vm3-jj99-7229"],"summary":"Arbitrary log line injection in github.com/gin-gonic/gin","details":"The default Formatter for the Logger middleware (LoggerConfig.Formatter), which is included in the Default engine, allows attackers to inject arbitrary log entries by manipulating the request path.","affected":[{"package":{"name":"github.com/gin-gonic/gin","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/gin-gonic/gin","symbols":["Default","Logger","LoggerWithConfig","LoggerWithFormatter","LoggerWithWriter"]}]}}],"references":[{"type":"FIX","url":"https://github.com/gin-gonic/gin/pull/2237"},{"type":"FIX","url":"https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d"}],"credits":[{"name":"@thinkerou \u003cthinkerou@gmail.com\u003e"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2020-0001","review_status":"REVIEWED"}} -------------------------------------------------------------------------------- /.github/workflows/ospsSecurityAssesssment.yml: -------------------------------------------------------------------------------- 1 | name: OSPS Security Assessment 2 | 3 | on: 4 | schedule: 5 | - cron: "0 9 * * 1" # Weekly on Mondays at 9 AM UTC 6 | workflow_dispatch: # Allow manual triggering 7 | 8 | jobs: 9 | osps-assessment: 10 | runs-on: ubuntu-latest 11 | 12 | permissions: 13 | contents: read 14 | security-events: write # Required for SARIF upload 15 | 16 | steps: 17 | - name: Checkout repository 18 | uses: actions/checkout@v4 19 | 20 | - name: Open Source Project Security Baseline Scanner 21 | uses: revanite-io/osps-baseline-action@v1.0.0 22 | with: 23 | owner: ${{ github.repository_owner }} 24 | repo: ${{ github.event.repository.name }} 25 | token: ${{ secrets.OSPS_WORKFLOW_TOKEN }} 26 | catalog: "osps-baseline" 27 | upload-sarif: "true" 28 | 29 | - name: Upload Assessment Results 30 | if: always() 31 | uses: actions/upload-artifact@v4 32 | with: 33 | name: osps-assessment-results-${{ github.run_number }} 34 | path: evaluation_results/ 35 | retention-days: 30 36 | -------------------------------------------------------------------------------- /security-insights.yml: -------------------------------------------------------------------------------- 1 | header: 2 | schema-version: 2.1.0 3 | last-updated: '2025-11-24' 4 | last-reviewed: '2025-11-24' 5 | url: https://github.com/ossf/osv-schema 6 | 7 | repository: 8 | url: https://github.com/ossf/osv-schema 9 | status: active 10 | accepts-change-request: true 11 | accepts-automated-change-request: true 12 | core-team: 13 | - name: Rex Pan 14 | affiliation: Google 15 | primary: true 16 | - name: Jason Shepherd 17 | affiliation: Red Hat 18 | primary: true 19 | - name: Madison Oliver 20 | affiliation: GitHub 21 | primary: true 22 | - name: Chris Robinson 23 | affiliation: OpenSSF 24 | primary: true 25 | - name: Andrew Pollock 26 | primary: true 27 | - name: Vulnerability Disclosures WG 28 | affiliation: OpenSSF 29 | email: openssf-wg-vul-disclosures@lists.openssf.org 30 | primary: true 31 | 32 | license: 33 | url: https://github.com/ossf/osv-schema/blob/main/LICENSE 34 | expression: Apache-2.0 35 | security: 36 | assessments: 37 | self: 38 | comment: | 39 | Self assessment has not yet been completed. 40 | -------------------------------------------------------------------------------- /tools/debian/README.md: -------------------------------------------------------------------------------- 1 | # Debian advisory converter (WIP) 2 | 3 | ## Prerequisites 4 | 5 | Clone the following two repositories: 6 | - https://salsa.debian.org/security-tracker-team/security-tracker.git 7 | - https://salsa.debian.org/webmaster-team/webwml.git 8 | 9 | `git` also has to be installed and on the `PATH`, 10 | used to read modified dates of files 11 | 12 | Running the `first_package_finder.py` also requires internet connection. 13 | 14 | ## Run converter 15 | 16 | ### Usage: 17 | ``` 18 | usage: convert_debian.py [-h] -o OUTPUT_DIR [--adv_type {DSA,DLA,DTSA}] webwml_repo security_tracker_repo 19 | ``` 20 | 21 | #### Options: 22 | `--adv_type`: Specify advisory type: 23 | 24 | - `DSA`: Debian security advisory 25 | - `DLA`: Debian LTS security advisory 26 | - `DTSA`: Debian testing security advisory 27 | 28 | `--output-dir, -o`: 29 | Output directory to place the converted osv `.json` files 30 | 31 | ### Example: 32 | ``` 33 | python convert_debian.py --adv_type DSA -o ./output path/to/webwml/ path/to/security-tracker-master/ 34 | ``` 35 | 36 | ## Run first_package_finder 37 | 38 | first_package_finder will output `first_package_cache.json.gz` in the working 39 | directory. 40 | 41 | ### Example: 42 | ``` 43 | python first_package_finder.py 44 | ``` -------------------------------------------------------------------------------- /tools/redhat/convert_redhat.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | """ Convert a CSAF document to OSV format 3 | i.e. https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_4546.json 4 | """ 5 | import argparse 6 | import sys 7 | from datetime import datetime 8 | 9 | from redhat_osv.osv import DATE_FORMAT, RedHatConverter 10 | 11 | 12 | def main(): 13 | """ 14 | Given a Red Hat CSAF document, covert it to OSV. Writes the OSV file to disk at 'osv' by default 15 | """ 16 | parser = argparse.ArgumentParser(description='CSAF to OSV Converter') 17 | parser.add_argument("csaf", metavar="FILE", help='CSAF file to process') 18 | parser.add_argument('--output_directory', dest='out_dir', default="osv") 19 | 20 | args = parser.parse_args() 21 | 22 | with open(args.csaf, "r", encoding="utf-8") as in_f: 23 | csaf_data = in_f.read() 24 | 25 | converter = RedHatConverter() 26 | osv_id, osv_data = converter.convert(csaf_data, 27 | datetime.now().strftime(DATE_FORMAT)) 28 | 29 | if not osv_data: 30 | sys.exit(1) 31 | 32 | with open(f"{args.out_dir}/{osv_id}.json", "w", encoding="utf-8") as out_f: 33 | out_f.write(osv_data) 34 | 35 | 36 | if __name__ == '__main__': 37 | main() 38 | -------------------------------------------------------------------------------- /tools/osv-linter/testdata/nopackage-GHSA-9v2f-6vcg-3hgv.json: -------------------------------------------------------------------------------- 1 | { 2 | "schema_version": "1.4.0", 3 | "id": "GHSA-9v2f-6vcg-3hgv", 4 | "modified": "2024-07-03T20:05:21Z", 5 | "published": "2024-07-01T21:31:15Z", 6 | "aliases": [ 7 | "CVE-2024-39236" 8 | ], 9 | "summary": "Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py", 10 | "details": "Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input.", 11 | "severity": [ 12 | { 13 | "type": "CVSS_V3", 14 | "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" 15 | } 16 | ], 17 | "affected": [ 18 | { 19 | "package": { 20 | "ecosystem": "PyPI", 21 | "name": "Gradi0" 22 | }, 23 | "versions": [ 24 | "4.36.1" 25 | ] 26 | } 27 | ], 28 | "references": [ 29 | { 30 | "type": "ADVISORY", 31 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39236" 32 | }, 33 | { 34 | "type": "WEB", 35 | "url": "https://github.com/Aaron911/PoC/blob/main/Gradio.md" 36 | } 37 | ], 38 | "database_specific": { 39 | "cwe_ids": [ 40 | "CWE-94" 41 | ], 42 | "severity": "CRITICAL", 43 | "github_reviewed": true, 44 | "github_reviewed_at": "2024-07-01T22:13:35Z", 45 | "nvd_published_at": "2024-07-01T19:15:05Z" 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /tools/osv-linter/testdata/GHSA-9v2f-6vcg-3hgv.json: -------------------------------------------------------------------------------- 1 | { 2 | "schema_version": "1.4.0", 3 | "id": "GHSA-9v2f-6vcg-3hgv", 4 | "modified": "2024-07-03T20:05:21Z", 5 | "published": "2024-07-01T21:31:15Z", 6 | "aliases": [ 7 | "CVE-2024-39236" 8 | ], 9 | "summary": "Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py", 10 | "details": "Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input.", 11 | "severity": [ 12 | { 13 | "type": "CVSS_V3", 14 | "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" 15 | } 16 | ], 17 | "affected": [ 18 | { 19 | "package": { 20 | "ecosystem": "PyPI", 21 | "name": "Gradio" 22 | }, 23 | "versions": [ 24 | "4.36.1", 25 | "4.36.-1" 26 | ] 27 | } 28 | ], 29 | "references": [ 30 | { 31 | "type": "ADVISORY", 32 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39236" 33 | }, 34 | { 35 | "type": "WEB", 36 | "url": "https://github.com/Aaron911/PoC/blob/main/Gradio.md" 37 | } 38 | ], 39 | "database_specific": { 40 | "cwe_ids": [ 41 | "CWE-94" 42 | ], 43 | "severity": "CRITICAL", 44 | "github_reviewed": true, 45 | "github_reviewed_at": "2024-07-01T22:13:35Z", 46 | "nvd_published_at": "2024-07-01T19:15:05Z" 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/greater_than_equals_no_patch.json: -------------------------------------------------------------------------------- 1 | { 2 | "ghsaId": "GHSA-pxmp-fwjc-4x7q", 3 | "identifiers": [ 4 | { 5 | "value": "GHSA-pxmp-fwjc-4x7q" 6 | } 7 | ], 8 | "references": [ 9 | { 10 | "url": "https://www.npmjs.com/advisories/1471" 11 | }, 12 | { 13 | "url": "https://github.com/advisories/GHSA-pxmp-fwjc-4x7q" 14 | } 15 | ], 16 | "description": "All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, such as `youtube.com.evil.co`. This \n\n\n## Recommendation\n\nThis package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`", 17 | "summary": "HTML Injection in marky-markdown", 18 | "severity": "MODERATE", 19 | "cvss": { 20 | "score": 0, 21 | "vectorString": null 22 | }, 23 | "cwes": { 24 | "nodes": [] 25 | }, 26 | "permalink": "https://github.com/advisories/GHSA-pxmp-fwjc-4x7q", 27 | "publishedAt": "2020-09-03T15:45:23Z", 28 | "updatedAt": "2020-09-03T15:45:23Z", 29 | "withdrawnAt": null, 30 | "vulnerabilities": { 31 | "nodes": [ 32 | { 33 | "package": { 34 | "ecosystem": "NPM", 35 | "name": "marky-markdown" 36 | }, 37 | "firstPatchedVersion": null, 38 | "vulnerableVersionRange": ">= 0.0.0" 39 | } 40 | ] 41 | } 42 | } 43 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/greater_than_equals_no_patch.osv.json: -------------------------------------------------------------------------------- 1 | { 2 | "schema_version": "1.5.0", 3 | "id": "GHSA-pxmp-fwjc-4x7q", 4 | "aliases": [], 5 | "published": "2020-09-03T15:45:23Z", 6 | "modified": "2020-09-03T15:45:23Z", 7 | "summary": "HTML Injection in marky-markdown", 8 | "details": "All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, such as `youtube.com.evil.co`. This \n\n\n## Recommendation\n\nThis package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`", 9 | "references": [ 10 | { 11 | "type": "WEB", 12 | "url": "https://www.npmjs.com/advisories/1471" 13 | }, 14 | { 15 | "type": "ADVISORY", 16 | "url": "https://github.com/advisories/GHSA-pxmp-fwjc-4x7q" 17 | } 18 | ], 19 | "affected": [ 20 | { 21 | "package": { 22 | "ecosystem": "npm", 23 | "name": "marky-markdown" 24 | }, 25 | "ranges": [ 26 | { 27 | "type": "SEMVER", 28 | "events": [ 29 | { 30 | "introduced": "0.0.0" 31 | } 32 | ] 33 | } 34 | ], 35 | "versions": [], 36 | "database_specific": { 37 | "ghsa": "https://github.com/advisories/GHSA-pxmp-fwjc-4x7q", 38 | "cwes": [] 39 | } 40 | } 41 | ] 42 | } 43 | -------------------------------------------------------------------------------- /tools/osv-linter/internal/checks/ranges_test.go: -------------------------------------------------------------------------------- 1 | package checks 2 | 3 | import ( 4 | "os" 5 | "testing" 6 | 7 | "github.com/tidwall/gjson" 8 | 9 | "github.com/google/go-cmp/cmp" 10 | "github.com/google/go-cmp/cmp/cmpopts" 11 | ) 12 | 13 | func LoadTestData(filename string) *gjson.Result { 14 | content, err := os.ReadFile(filename) 15 | if err != nil { 16 | panic(err) 17 | } 18 | record := gjson.ParseBytes(content) 19 | return &record 20 | } 21 | 22 | func TestRangeHasIntroducedEvent(t *testing.T) { 23 | t.Parallel() 24 | 25 | type args struct { 26 | json *gjson.Result 27 | } 28 | tests := []struct { 29 | name string 30 | args args 31 | wantFindings []CheckError 32 | }{ 33 | { 34 | name: "A compliant file", 35 | args: args{ 36 | json: LoadTestData("../../testdata/CVE-2023-41045.json"), 37 | }, 38 | wantFindings: nil, 39 | }, 40 | { 41 | name: "A file without an introduced event", 42 | args: args{ 43 | json: LoadTestData("../../testdata/nointroduced-CVE-2023-41045.json"), 44 | }, 45 | wantFindings: []CheckError{{Message: "missing 'introduced' object in event"}}, 46 | }, 47 | } 48 | for _, tt := range tests { 49 | t.Run(tt.name, func(t *testing.T) { 50 | gotFindings := RangeHasIntroducedEvent(tt.args.json, &Config{Verbose: true}) 51 | if diff := cmp.Diff(tt.wantFindings, gotFindings, cmpopts.EquateErrors()); diff != "" { 52 | t.Errorf("RangeHasIntroducedEvent() mismatch (-want +got):\n%s", diff) 53 | } 54 | }) 55 | } 56 | } 57 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/equals_no_patch.osv.json: -------------------------------------------------------------------------------- 1 | { 2 | "schema_version": "1.5.0", 3 | "id": "GHSA-4g4c-8gqh-m4vm", 4 | "aliases": [ 5 | "CVE-2019-13589" 6 | ], 7 | "published": "2019-07-16T00:41:55Z", 8 | "modified": "2021-05-10T22:18:29Z", 9 | "summary": "Inclusion of Functionality from Untrusted Control Sphere in Ruby", 10 | "details": "The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.", 11 | "references": [ 12 | { 13 | "type": "ADVISORY", 14 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13589" 15 | }, 16 | { 17 | "type": "ADVISORY", 18 | "url": "https://github.com/advisories/GHSA-4g4c-8gqh-m4vm" 19 | } 20 | ], 21 | "affected": [ 22 | { 23 | "package": { 24 | "ecosystem": "RubyGems", 25 | "name": "paranoid2" 26 | }, 27 | "ranges": [], 28 | "versions": [ 29 | "1.1.6" 30 | ], 31 | "database_specific": { 32 | "ghsa": "https://github.com/advisories/GHSA-4g4c-8gqh-m4vm", 33 | "cwes": [ 34 | { 35 | "cweId": "CWE-829", 36 | "description": "The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.", 37 | "name": "Inclusion of Functionality from Untrusted Control Sphere" 38 | } 39 | ] 40 | } 41 | } 42 | ] 43 | } 44 | -------------------------------------------------------------------------------- /tools/osv-linter/testdata/MAL-2024-10238.json: -------------------------------------------------------------------------------- 1 | { 2 | "modified": "2024-10-27T13:55:45Z", 3 | "published": "2024-10-27T13:55:45Z", 4 | "schema_version": "1.5.0", 5 | "id": "MAL-2024-10238", 6 | "summary": "Malicious code in 123bla (PyPI)", 7 | "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (482493bb0425cda1267f50c860740681a8c0e91958623ed8d949b9db65b2e4a9)\nThe OpenSSF Package Analysis project identified '123bla' @ 0.0.1 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n", 8 | "affected": [ 9 | { 10 | "package": { 11 | "ecosystem": "PyPI", 12 | "name": "123bla" 13 | }, 14 | "versions": [ 15 | "0.0.1" 16 | ] 17 | } 18 | ], 19 | "credits": [ 20 | { 21 | "name": "OpenSSF: Package Analysis", 22 | "type": "FINDER", 23 | "contact": [ 24 | "https://github.com/ossf/package-analysis", 25 | "https://openssf.slack.com/channels/package_analysis" 26 | ] 27 | } 28 | ], 29 | "database_specific": { 30 | "malicious-packages-origins": [ 31 | { 32 | "import_time": "2024-10-27T14:05:09.316165759Z", 33 | "modified_time": "2024-10-27T13:55:45Z", 34 | "sha256": "482493bb0425cda1267f50c860740681a8c0e91958623ed8d949b9db65b2e4a9", 35 | "source": "ossf-package-analysis", 36 | "versions": [ 37 | "0.0.1" 38 | ] 39 | } 40 | ] 41 | } 42 | } 43 | -------------------------------------------------------------------------------- /scripts/validate-schema-table.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import os 4 | from html.parser import HTMLParser 5 | 6 | 7 | class UnexpectedTagError(Exception): 8 | pass 9 | 10 | 11 | class HTMLValidator(HTMLParser): 12 | def __init__(self) -> None: 13 | super().__init__() 14 | 15 | self.__tags: list[str] = [] 16 | 17 | def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None: 18 | self.__tags.append(tag) 19 | 20 | def handle_endtag(self, tag: str) -> None: 21 | last_tag = self.__tags.pop() 22 | if last_tag != tag: 23 | raise UnexpectedTagError(last_tag) 24 | 25 | 26 | def extract_schema_table() -> tuple[str, int]: 27 | raw_table = '' 28 | index = -1 29 | 30 | with open('docs/schema.md') as f: 31 | for i, line in enumerate(f.readlines()): 32 | if line == '\n': 33 | index = i + 1 34 | raw_table += line 35 | if raw_table != '': 36 | raw_table += line 37 | if line == '
\n': 38 | break 39 | return raw_table, index 40 | 41 | 42 | table, starting_line = extract_schema_table() 43 | 44 | validator = HTMLValidator() 45 | 46 | try: 47 | validator.feed(table) 48 | except UnexpectedTagError as e: 49 | if 'CI' in os.environ: 50 | print( 51 | f'::error file=docs/schema.md,line={starting_line}::unexpected {e} tag in table - ensure that the tags are properly paired' 52 | ) 53 | print( 54 | f'unexpected {e} tag in docs/schema.md databases table - ensure that the tags are properly paired' 55 | ) 56 | exit(1) 57 | -------------------------------------------------------------------------------- /tools/redhat/redhat_osv/convert_redhat_test.py: -------------------------------------------------------------------------------- 1 | """Tests for converting a CSAF document to OSV format""" 2 | import unittest 3 | from datetime import datetime 4 | import json 5 | from redhat_osv.osv import DATE_FORMAT, RedHatConverter 6 | 7 | 8 | class TestRedHatConverter(unittest.TestCase): 9 | """Test end-to-end convertion from RedHAt CSAF to OSV format""" 10 | 11 | test_advisories = ["2024_4546", "2024_6220"] 12 | 13 | def test_convert_redhat(self): 14 | """Test conversion of Red Hat CSAF files to OSV format.""" 15 | for test_advisory in self.test_advisories: 16 | modified_time = datetime.strptime("2024-09-02T14:30:00", 17 | "%Y-%m-%dT%H:%M:%S") 18 | csaf_file = f"testdata/CSAF/rhsa-{test_advisory}.json" 19 | expected_file = f"testdata/OSV/RHSA-{test_advisory}.json" 20 | 21 | with open(csaf_file, "r", encoding="utf-8") as fp: 22 | csaf_data = fp.read() 23 | converter = RedHatConverter() 24 | osv_data = converter.convert(csaf_data, 25 | modified_time.strftime(DATE_FORMAT)) 26 | 27 | advisory_id = test_advisory.replace("_", ":") 28 | assert osv_data[0] == f"RHSA-{advisory_id}" 29 | result_data = json.loads(osv_data[1]) 30 | 31 | with open(expected_file, "r", encoding="utf-8") as fp: 32 | expected_data = json.load(fp) 33 | assert expected_data == result_data 34 | 35 | 36 | if __name__ == '__main__': 37 | unittest.main() 38 | -------------------------------------------------------------------------------- /tools/osv-linter/internal/checks/schema.go: -------------------------------------------------------------------------------- 1 | package checks 2 | 3 | import ( 4 | _ "embed" 5 | "fmt" 6 | "strings" 7 | 8 | "github.com/tidwall/gjson" 9 | "github.com/xeipuuv/gojsonschema" 10 | ) 11 | 12 | // Please run 'go generate ./...' to sync schema.json. 13 | //go:generate cp ../../../../validation/schema.json schema_generated.json 14 | 15 | //go:embed schema_generated.json 16 | var LoadedSchema []byte 17 | 18 | var CheckInvalidSchema = &CheckDef{ 19 | Code: "SCH:001", 20 | Name: "conforms-to-schema", 21 | Description: "the record must conform to the OSV JSON schema", 22 | Check: SchemaCheck, 23 | } 24 | 25 | func SchemaCheck(json *gjson.Result, config *Config) []CheckError { 26 | schemaLoader := gojsonschema.NewBytesLoader(LoadedSchema) 27 | documentLoader := gojsonschema.NewStringLoader(json.Raw) 28 | 29 | result, err := gojsonschema.Validate(schemaLoader, documentLoader) 30 | if err != nil { 31 | // This should not happen with a valid embedded schema. 32 | // It indicates a problem with the linter itself. 33 | panic(fmt.Sprintf("schema validation failed: %v", err)) 34 | } 35 | 36 | if result.Valid() { 37 | return nil 38 | } 39 | 40 | var errors []string 41 | for _, desc := range result.Errors() { 42 | if config.NewEcosystem && strings.Contains(desc.Description(), "Does not match pattern") { 43 | continue 44 | } 45 | errors = append(errors, fmt.Sprintf("- %s", desc)) 46 | } 47 | 48 | if len(errors) == 0 { 49 | return nil 50 | } 51 | 52 | return []CheckError{ 53 | { 54 | Message: fmt.Sprintf("Record does not conform to schema:\n %s", strings.Join(errors, "\n")), 55 | }, 56 | } 57 | } 58 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/multiple_ranges_in_package.osv.json: -------------------------------------------------------------------------------- 1 | { 2 | "schema_version": "1.5.0", 3 | "id": "GHSA-9qj7-jvg4-qr2x", 4 | "aliases": [ 5 | "CVE-2013-2119" 6 | ], 7 | "published": "2017-10-24T18:33:37Z", 8 | "modified": "2021-09-08T20:47:39Z", 9 | "summary": "Moderate severity vulnerability that affects passenger", 10 | "details": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.", 11 | "references": [ 12 | { 13 | "type": "ADVISORY", 14 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2119" 15 | }, 16 | { 17 | "type": "ADVISORY", 18 | "url": "https://github.com/advisories/GHSA-9qj7-jvg4-qr2x" 19 | } 20 | ], 21 | "affected": [ 22 | { 23 | "package": { 24 | "ecosystem": "RubyGems", 25 | "name": "passenger" 26 | }, 27 | "ranges": [ 28 | { 29 | "type": "ECOSYSTEM", 30 | "events": [ 31 | { 32 | "introduced": "0" 33 | }, 34 | { 35 | "introduced": "4.0.1" 36 | }, 37 | { 38 | "fixed": "4.0.5" 39 | }, 40 | { 41 | "fixed": "3.0.21" 42 | } 43 | ] 44 | } 45 | ], 46 | "versions": [], 47 | "database_specific": { 48 | "ghsa": "https://github.com/advisories/GHSA-9qj7-jvg4-qr2x", 49 | "cwes": [] 50 | } 51 | } 52 | ] 53 | } 54 | -------------------------------------------------------------------------------- /tools/osv-linter/testdata/GO-2024-2963.json: -------------------------------------------------------------------------------- 1 | {"schema_version":"1.3.1","id":"GO-2024-2963","modified":"2024-07-02T20:11:00Z","published":"2024-07-02T20:11:00Z","aliases":["CVE-2024-24791"],"summary":"Denial of service due to improper 100-continue handling in net/http","details":"The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \"Expect: 100-continue\" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail.\n\nAn attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \"Expect: 100-continue\" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.","affected":[{"package":{"name":"stdlib","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.12"},{"introduced":"1.22.0-0"},{"fixed":"1.22.5"}]}],"ecosystem_specific":{"imports":[{"path":"net/http","symbols":["Client.CloseIdleConnections","Client.Do","Client.Get","Client.Head","Client.Post","Client.PostForm","Get","Head","Post","PostForm","Transport.CancelRequest","Transport.CloseIdleConnections","Transport.RoundTrip","persistConn.readResponse"]}]}}],"references":[{"type":"FIX","url":"https://go.dev/cl/591255"},{"type":"REPORT","url":"https://go.dev/issue/67555"},{"type":"WEB","url":"https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ"}],"credits":[{"name":"Geoff Franks"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2024-2963","review_status":"REVIEWED"}} -------------------------------------------------------------------------------- /tools/ghsa/testdata/equals_no_patch.json: -------------------------------------------------------------------------------- 1 | { 2 | "ghsaId": "GHSA-4g4c-8gqh-m4vm", 3 | "identifiers": [ 4 | { 5 | "value": "GHSA-4g4c-8gqh-m4vm" 6 | }, 7 | { 8 | "value": "CVE-2019-13589" 9 | } 10 | ], 11 | "references": [ 12 | { 13 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13589" 14 | }, 15 | { 16 | "url": "https://github.com/advisories/GHSA-4g4c-8gqh-m4vm" 17 | } 18 | ], 19 | "description": "The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.", 20 | "summary": "Inclusion of Functionality from Untrusted Control Sphere in Ruby", 21 | "severity": "CRITICAL", 22 | "cvss": { 23 | "score": 9.8, 24 | "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" 25 | }, 26 | "cwes": { 27 | "nodes": [ 28 | { 29 | "cweId": "CWE-829", 30 | "description": "The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.", 31 | "name": "Inclusion of Functionality from Untrusted Control Sphere" 32 | } 33 | ] 34 | }, 35 | "permalink": "https://github.com/advisories/GHSA-4g4c-8gqh-m4vm", 36 | "publishedAt": "2019-07-16T00:41:55Z", 37 | "updatedAt": "2021-05-10T22:18:29Z", 38 | "withdrawnAt": null, 39 | "vulnerabilities": { 40 | "nodes": [ 41 | { 42 | "package": { 43 | "ecosystem": "RUBYGEMS", 44 | "name": "paranoid2" 45 | }, 46 | "firstPatchedVersion": null, 47 | "vulnerableVersionRange": "= 1.1.6" 48 | } 49 | ] 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/less_than_equals_no_patch.osv.json: -------------------------------------------------------------------------------- 1 | { 2 | "schema_version": "1.5.0", 3 | "id": "GHSA-jvf4-g24p-2qgw", 4 | "aliases": [ 5 | "CVE-2020-7738" 6 | ], 7 | "published": "2021-05-10T18:37:34Z", 8 | "modified": "2021-05-10T18:37:34Z", 9 | "summary": "Arbitrary Code Execution in shiba", 10 | "details": "\"All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().\"", 11 | "references": [ 12 | { 13 | "type": "ADVISORY", 14 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7738" 15 | }, 16 | { 17 | "type": "ADVISORY", 18 | "url": "https://github.com/advisories/GHSA-jvf4-g24p-2qgw" 19 | } 20 | ], 21 | "affected": [ 22 | { 23 | "package": { 24 | "ecosystem": "npm", 25 | "name": "shiba" 26 | }, 27 | "ranges": [ 28 | { 29 | "type": "SEMVER", 30 | "events": [ 31 | { 32 | "introduced": "0" 33 | } 34 | ] 35 | } 36 | ], 37 | "versions": [], 38 | "database_specific": { 39 | "ghsa": "https://github.com/advisories/GHSA-jvf4-g24p-2qgw", 40 | "cwes": [ 41 | { 42 | "cweId": "CWE-94", 43 | "description": "The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.", 44 | "name": "Improper Control of Generation of Code ('Code Injection')" 45 | } 46 | ] 47 | } 48 | } 49 | ] 50 | } 51 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/multiple_ranges_in_package.json: -------------------------------------------------------------------------------- 1 | { 2 | "ghsaId": "GHSA-9qj7-jvg4-qr2x", 3 | "identifiers": [ 4 | { 5 | "value": "GHSA-9qj7-jvg4-qr2x" 6 | }, 7 | { 8 | "value": "CVE-2013-2119" 9 | } 10 | ], 11 | "references": [ 12 | { 13 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2119" 14 | }, 15 | { 16 | "url": "https://github.com/advisories/GHSA-9qj7-jvg4-qr2x" 17 | } 18 | ], 19 | "description": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.", 20 | "summary": "Moderate severity vulnerability that affects passenger", 21 | "severity": "MODERATE", 22 | "cvss": { 23 | "score": 0, 24 | "vectorString": null 25 | }, 26 | "cwes": { 27 | "nodes": [] 28 | }, 29 | "permalink": "https://github.com/advisories/GHSA-9qj7-jvg4-qr2x", 30 | "publishedAt": "2017-10-24T18:33:37Z", 31 | "updatedAt": "2021-09-08T20:47:39Z", 32 | "withdrawnAt": null, 33 | "vulnerabilities": { 34 | "nodes": [ 35 | { 36 | "package": { 37 | "ecosystem": "RUBYGEMS", 38 | "name": "passenger" 39 | }, 40 | "firstPatchedVersion": { 41 | "identifier": "4.0.5" 42 | }, 43 | "vulnerableVersionRange": ">= 4.0.1, < 4.0.5" 44 | }, 45 | { 46 | "package": { 47 | "ecosystem": "RUBYGEMS", 48 | "name": "passenger" 49 | }, 50 | "firstPatchedVersion": { 51 | "identifier": "3.0.21" 52 | }, 53 | "vulnerableVersionRange": "< 3.0.21" 54 | } 55 | ] 56 | } 57 | } 58 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/less_than_equals_no_patch.json: -------------------------------------------------------------------------------- 1 | { 2 | "ghsaId": "GHSA-jvf4-g24p-2qgw", 3 | "identifiers": [ 4 | { 5 | "value": "GHSA-jvf4-g24p-2qgw" 6 | }, 7 | { 8 | "value": "CVE-2020-7738" 9 | } 10 | ], 11 | "references": [ 12 | { 13 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7738" 14 | }, 15 | { 16 | "url": "https://github.com/advisories/GHSA-jvf4-g24p-2qgw" 17 | } 18 | ], 19 | "description": "\"All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().\"", 20 | "summary": "Arbitrary Code Execution in shiba", 21 | "severity": "HIGH", 22 | "cvss": { 23 | "score": 8.3, 24 | "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" 25 | }, 26 | "cwes": { 27 | "nodes": [ 28 | { 29 | "cweId": "CWE-94", 30 | "description": "The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.", 31 | "name": "Improper Control of Generation of Code ('Code Injection')" 32 | } 33 | ] 34 | }, 35 | "permalink": "https://github.com/advisories/GHSA-jvf4-g24p-2qgw", 36 | "publishedAt": "2021-05-10T18:37:34Z", 37 | "updatedAt": "2021-05-10T18:37:34Z", 38 | "withdrawnAt": null, 39 | "vulnerabilities": { 40 | "nodes": [ 41 | { 42 | "package": { 43 | "ecosystem": "NPM", 44 | "name": "shiba" 45 | }, 46 | "firstPatchedVersion": null, 47 | "vulnerableVersionRange": "<= 1.2.1" 48 | } 49 | ] 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/withdrawn.osv.json: -------------------------------------------------------------------------------- 1 | { 2 | "schema_version": "1.5.0", 3 | "id": "GHSA-35c4-f3rq-f9g3", 4 | "aliases": [ 5 | "CVE-2015-3227" 6 | ], 7 | "published": "2018-09-17T21:57:23Z", 8 | "modified": "2019-07-03T21:02:03Z", 9 | "withdrawn": "2018-10-11T17:29:49Z", 10 | "summary": "Moderate severity vulnerability that affects activesupport", 11 | "details": "Withdrawn, accidental duplicate publish.\r\n\r\nThe (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.", 12 | "references": [ 13 | { 14 | "type": "ADVISORY", 15 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3227" 16 | }, 17 | { 18 | "type": "ADVISORY", 19 | "url": "https://github.com/advisories/GHSA-35c4-f3rq-f9g3" 20 | } 21 | ], 22 | "affected": [ 23 | { 24 | "package": { 25 | "ecosystem": "RubyGems", 26 | "name": "activesupport" 27 | }, 28 | "ranges": [ 29 | { 30 | "type": "ECOSYSTEM", 31 | "events": [ 32 | { 33 | "introduced": "3.2.0" 34 | }, 35 | { 36 | "fixed": "3.2.22" 37 | }, 38 | { 39 | "introduced": "4.2.0" 40 | }, 41 | { 42 | "fixed": "4.2.2" 43 | }, 44 | { 45 | "introduced": "4.0.0" 46 | }, 47 | { 48 | "fixed": "4.1.11" 49 | } 50 | ] 51 | } 52 | ], 53 | "versions": [], 54 | "database_specific": { 55 | "ghsa": "https://github.com/advisories/GHSA-35c4-f3rq-f9g3", 56 | "cwes": [] 57 | } 58 | } 59 | ] 60 | } 61 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/npm_greater_than.osv.json: -------------------------------------------------------------------------------- 1 | { 2 | "schema_version": "1.5.0", 3 | "id": "GHSA-mhpp-875w-9cpv", 4 | "aliases": [ 5 | "CVE-2016-10707" 6 | ], 7 | "published": "2018-01-22T13:32:42Z", 8 | "modified": "2021-09-15T20:10:34Z", 9 | "summary": "Denial of Service in jquery", 10 | "details": "Affected versions of `jquery` use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, `jquery` enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or later.", 11 | "references": [ 12 | { 13 | "type": "ADVISORY", 14 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10707" 15 | }, 16 | { 17 | "type": "ADVISORY", 18 | "url": "https://github.com/advisories/GHSA-mhpp-875w-9cpv" 19 | } 20 | ], 21 | "affected": [ 22 | { 23 | "package": { 24 | "ecosystem": "npm", 25 | "name": "jquery" 26 | }, 27 | "ranges": [ 28 | { 29 | "type": "SEMVER", 30 | "events": [ 31 | { 32 | "introduced": "2.1.1-0" 33 | }, 34 | { 35 | "fixed": "3.0.0" 36 | } 37 | ] 38 | } 39 | ], 40 | "versions": [], 41 | "database_specific": { 42 | "ghsa": "https://github.com/advisories/GHSA-mhpp-875w-9cpv", 43 | "cwes": [ 44 | { 45 | "cweId": "CWE-400", 46 | "description": "The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.", 47 | "name": "Uncontrolled Resource Consumption" 48 | } 49 | ] 50 | } 51 | } 52 | ] 53 | } 54 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/npm_greater_than.json: -------------------------------------------------------------------------------- 1 | { 2 | "ghsaId": "GHSA-mhpp-875w-9cpv", 3 | "identifiers": [ 4 | { 5 | "value": "GHSA-mhpp-875w-9cpv" 6 | }, 7 | { 8 | "value": "CVE-2016-10707" 9 | } 10 | ], 11 | "references": [ 12 | { 13 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10707" 14 | }, 15 | { 16 | "url": "https://github.com/advisories/GHSA-mhpp-875w-9cpv" 17 | } 18 | ], 19 | "description": "Affected versions of `jquery` use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, `jquery` enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or later.", 20 | "summary": "Denial of Service in jquery", 21 | "severity": "HIGH", 22 | "cvss": { 23 | "score": 7.5, 24 | "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" 25 | }, 26 | "cwes": { 27 | "nodes": [ 28 | { 29 | "cweId": "CWE-400", 30 | "description": "The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.", 31 | "name": "Uncontrolled Resource Consumption" 32 | } 33 | ] 34 | }, 35 | "permalink": "https://github.com/advisories/GHSA-mhpp-875w-9cpv", 36 | "publishedAt": "2018-01-22T13:32:42Z", 37 | "updatedAt": "2021-09-15T20:10:34Z", 38 | "withdrawnAt": null, 39 | "vulnerabilities": { 40 | "nodes": [ 41 | { 42 | "package": { 43 | "ecosystem": "NPM", 44 | "name": "jquery" 45 | }, 46 | "firstPatchedVersion": { 47 | "identifier": "3.0.0" 48 | }, 49 | "vulnerableVersionRange": "> 2.1.0, < 3.0.0" 50 | } 51 | ] 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /tools/ghsa/testdata/less_than_equals_with_patch.json: -------------------------------------------------------------------------------- 1 | { 2 | "ghsaId": "GHSA-f89g-whpf-6q9m", 3 | "identifiers": [ 4 | { 5 | "value": "GHSA-f89g-whpf-6q9m" 6 | }, 7 | { 8 | "value": "CVE-2017-16008" 9 | } 10 | ], 11 | "references": [ 12 | { 13 | "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16008" 14 | }, 15 | { 16 | "url": "https://github.com/advisories/GHSA-f89g-whpf-6q9m" 17 | } 18 | ], 19 | "description": "Affected versions of `i18next` allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.\n\n## Proof of Concept\n```\nvar init = i18n.init({debug: true}, function(){\n var test = i18n.t('__firstName__ __lastName__', {\n escapeInterpolation: true,\n firstName: '__lastNameHTML__',\n lastName: '