Will Murphy
Will Murphy
**What would you like to be added**: Sometimes, upgrading a package isn't the right or the only remediation available. Some examples: * Maybe a package has been deprecated but there's...
**What would you like to be added**: I would like the matchDetails struct and JSON representation to report what module constraint was used to match the vulnerability on RPM-based matches....
Consider two version numbers: ``` [root@19ac959dacf7 /]# rpmdev-vercmp 3:10.3.28-1.module_el8.3.0+757+d382997d 3:10.3.28-1.module+el8.3.0+10472+7adc332a 3:10.3.28-1.module_el8.3.0+757+d382997d < 3:10.3.28-1.module+el8.3.0+10472+7adc332a ``` This is correct! build 757 is _earlier_ than build 10472. However, if we're comparing Centos8 artifacts...
Previously, different build numbers of the same RPM version release string were compared lexicographically, leading to incorrect comparisons between RedHat and RedHat clone RPMs, resulting in FPs or FNs on...
Some NVD records have the same record over 400 times. Often, data has been fixed upstream but because the NVD provider only processes changed records, these fixes to old data...
Part of work for https://github.com/anchore/grype/issues/2745 AlmaLinux has no equivalent page to CVE listings like https://access.redhat.com/security/cve/cve-2016-3707 or to the API behind them, but it does have its own errata/advisories, e.g. https://errata.almalinux.org/8/ALSA-2024-10953.html...
**What would you like to be added**: ### Background Many vulnerability data providers, such as Red Hat, Oracle Linux, and Amazon Linux provide disclosure information (that is, notice that a...
**What would you like to be added**: There are a few places where Grype simplifies the list of CVSS vectors available on an NVD vuln into a single severity score...
Sometimes secDB using distros include information that a given package version fixed a GHSA. This causes a GHSA match with no severity to be emitted by grype. In the case...