Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #141 +/- ##
==========================================
- Coverage 70.72% 70.56% -0.16%
==========================================
Files 30 30
Lines 2842 2844 +2
==========================================
- Hits 2010 2007 -3
- Misses 722 727 +5
Partials 110 110
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| } | ||
| if update.manuallyFixable { | ||
| updateCves(tmpManualCves, cve, Package{String: pkg}, []string{update.Erratum}, "", nil) | ||
| updateCves(tmpManualCves, cve, pkgDetail, []string{update.Erratum}, "", nil, update.EVRA) |
There was a problem hiding this comment.
I would avoid displaying any fixed version for manually fixable CVEs.
| seenPkgErratum := map[packageErratum]bool{} | ||
| tmpManualCves := map[string]VulnerabilityDetail{} | ||
| for pkg, upDetail := range updates.UpdateList { | ||
| for _, update := range upDetail.AvailableUpdates { |
There was a problem hiding this comment.
Since it's going through all available updated packages (from multiple errata) and collecting CVEs, the affected section can contain multiple newer fixed EVRAs.
Only one affected item for each affected package would be better - probably the earliest fixed EVRA would be best.
E.g.
{
"cve": "CVE-2026-31885",
"affected_packages": [
"freerdp-2:2.11.7-1.el9_7.2.x86_64",
"freerdp-libs-2:2.11.7-1.el9_7.2.x86_64",
"libwinpr-2:2.11.7-1.el9_7.2.x86_64"
],
"errata": [
"RHSA-2026:16482",
"RHSA-2026:19358"
],
"affected": [
{
"package_name": "libwinpr",
"evra": "2:2.11.7-1.el9_7.2.x86_64",
"fixed_evra": "2:2.11.7-1.el9_7.7.x86_64",
"cpe": "",
"module_name": null,
"module_stream": null
},
{
"package_name": "libwinpr",
"evra": "2:2.11.7-1.el9_7.2.x86_64",
"fixed_evra": "2:2.11.7-7.el9_8.3.x86_64",
"cpe": "",
"module_name": null,
"module_stream": null
},
{
"package_name": "freerdp-libs",
"evra": "2:2.11.7-1.el9_7.2.x86_64",
"fixed_evra": "2:2.11.7-1.el9_7.7.x86_64",
"cpe": "",
"module_name": null,
"module_stream": null
},
{
"package_name": "freerdp-libs",
"evra": "2:2.11.7-1.el9_7.2.x86_64",
"fixed_evra": "2:2.11.7-7.el9_8.3.x86_64",
"cpe": "",
"module_name": null,
"module_stream": null
},
{
"package_name": "freerdp",
"evra": "2:2.11.7-1.el9_7.2.x86_64",
"fixed_evra": "2:2.11.7-1.el9_7.7.x86_64",
"cpe": "",
"module_name": null,
"module_stream": null
},
{
"package_name": "freerdp",
"evra": "2:2.11.7-1.el9_7.2.x86_64",
"fixed_evra": "2:2.11.7-7.el9_8.3.x86_64",
"cpe": "",
"module_name": null,
"module_stream": null
}
]
}
2253e62 to
49bc237
Compare
| found := false | ||
| for i, ap := range vulnDetail.Affected { | ||
| if affectedKey(ap) == newKey { | ||
| if newAP.FixedEVRA != "" && ap.FixedEVRA != "" && isEarlierEVRA(newAP.FixedEVRA, ap.FixedEVRA) { |
There was a problem hiding this comment.
Any version comparison is not needed. Just take the first one reported from Updates API, they are already sorted. https://github.com/RedHatInsights/vmaas-lib/blob/main/vmaas/common.go#L168
| assert.Contains(t, cves.ManualCves["CVE-1"].Errata, "RHSA-6") | ||
| assert.Len(t, cves.ManualCves["CVE-1"].Affected, 2) | ||
| assert.Equal(t, cves.ManualCves["CVE-1"].Affected[0].Cpe, currentReleaseCPE) | ||
| assert.Equal(t, "0:1-1.x86_64", cves.ManualCves["CVE-1"].Affected[0].FixedEVRA) |
There was a problem hiding this comment.
FixedEVRA for any ManualCves shouldn't be empty?
fb1028a to
884373e
Compare
| return p | ||
| } | ||
| pkgDetail := Package{String: pkg} | ||
| if nevra, err := utils.ParseNevra(pkg, true); err == nil { |
There was a problem hiding this comment.
Calling the utils.ParseNevra should not be needed. This information should be available from other structs. Also always you can concat name + "-" + evra to get nevra
| newAP := buildAffectedPackage(pkg, cpe, module, fixedEVRA) | ||
| newKey := affectedKey(newAP) | ||
| found := false | ||
| for _, ap := range vulnDetail.Affected { |
There was a problem hiding this comment.
Could this use a map instead of looping the slice?
| EVRA: pkg.EVRAStringE(true), | ||
| Cpe: cpe, | ||
| newAP := buildAffectedPackage(pkg, cpe, module, fixedEVRA) | ||
| newKey := affectedKey(newAP) |
There was a problem hiding this comment.
Composite string key from almost all AffectedPackage attributes is not needed. We can assume that the package name is unique in this scope.
884373e to
def2127
Compare
3 participants
RHINENG-29137