-
Notifications
You must be signed in to change notification settings - Fork 47
Changes in score counting in UI #2322
-
|
Context:
UI e2e tests consequences:
API Response Diff:
|
| Identifier | Old score | Old severity |
|---|---|---|
CVE-2024-26308 |
5.5 | medium |
#CVE-2023-0044 |
5.3 | medium |
#CVE-2023-33201 |
5.3 | medium |
2. Score/Severity Value Differences
For 5 items, the base_score values differ from the old average_score/average_severity:
| Identifier | Old score → New score | Old severity → New severity | Reason |
|---|---|---|---|
GHSA-j288-q9x7-2f5v |
6.5 → 5.3 | medium → medium | Different base score |
GHSA-prj3-ccx8-p6x4 |
7.5 → 8.2 | high → high | Uses CVSS 4.0 instead of 3.1 |
#CVE-2023-24815 |
5.3 → 4.8 | medium → medium | Different base score |
#CVE-2023-2976 |
4.4 → 5.5 | medium → medium | Different base score |
#CVE-2023-34455 |
5.9 → 7.5 | medium → high | Both score and severity changed |
This suggests the old average_score was computed (e.g., averaging across all CVSS scores), while the new base_score picks a specific score (likely the highest-versioned CVSS or a designated "base").
3. One modified Date Change
CVE-2024-26308 status modified date changed: 2025年03月27日T19:10:43.565Z → 2024年08月02日T00:07:19.215Z (went backwards).
Beta Was this translation helpful? Give feedback.
All reactions
Replies: 8 comments 12 replies
-
The data used for generating the previous responses are:
Beta Was this translation helpful? Give feedback.
All reactions
-
I'm confused. It would be good if those tests would be in the trustify repo, so that we could find and fix such discrepancies when making backend changes. But I see the point that the UI needs tests too.
What I find weird is that the modified should have changed, as there was no change regarding that.
Just peeking at the first, CVE-2024-26308 doesn't have a CNA score, just and ADP one. Feels like having none as "base" makes sense in this case. But there could be additional ones.
Beta Was this translation helpful? Give feedback.
All reactions
-
I'm confused. It would be good if those tests would be in the trustify repo, so that we could find and fix such discrepancies when making backend changes. But I see the point that the UI needs tests too.
With AI it should be straightforward to create similar tests based on the ones that the UI has, but focusing only in the REST APIs. That's would be a good idea I think.
Just peeking at the first, CVE-2024-26308 doesn't have a CNA score, just and ADP one. Feels like having none as "base" makes sense in this case. But there could be additional ones.
So having base_score: null for CVE-2024-26308 seems correct right? No problem, thanks for the confirmation
Beta Was this translation helpful? Give feedback.
All reactions
-
CVE-2024-26308 doesn't seem to have any score.
For GHSA-j288-q9x7-2f5v I see a base score of 5.3 which is correct (but from the ADP) and a score of 6.5 from the advisory, which is correct too.
I did notice however, that the base score between the vulnerability and the "status" differs by the fact that one seems to include the ADP, while the other doesn't.
Beta Was this translation helpful? Give feedback.
All reactions
-
The modified date is indeed interesting, as this is the modification date from an ADP entry. which shouldn't affect the entry at all.
Beta Was this translation helpful? Give feedback.
All reactions
-
@carlosthe19916 which version did you compare? I assume "new" is the most recent main. What is "old"?
Beta Was this translation helpful? Give feedback.
All reactions
-
Old: GET /api/v2/sbom/{id}/advisory
New: GET /api/v3/sbom/{id}/advisory
So new is the most recent changes from main branch
And Old is the main branch without All the commits from today 10th April (around 14 commits) added today
Beta Was this translation helpful? Give feedback.
All reactions
-
What exactly is the "quarkus-bom"? Is it quarkus-bom-2.13.8.Final-redhat-00004.json.bz2?
Beta Was this translation helpful? Give feedback.
All reactions
-
The link to the sbom is in my comment above
Beta Was this translation helpful? Give feedback.
All reactions
-
So this one Sbom: https://github.com/guacsec/trustify-ui/blob/main/e2e/tests/common/dataset/sbom/quarkus-bom-2.13.8.Final-redhat-00004.json.bz2
Beta Was this translation helpful? Give feedback.
All reactions
-
I just reproduced the setup. Ingesting all advisories. Ingesting quarkus-bom-2.13.8.Final-redhat-00004.json.bz2. However, I get different results. And those look correct.
I'd like to understand how you ingest documents. As something seems off.
Beta Was this translation helpful? Give feedback.
All reactions
-
This is the specific block of code that does it https://github.com/guacsec/trustify-ui/blob/main/e2e/tests/api/dependencies/global.setup.ts#L14-L31
Beta Was this translation helpful? Give feedback.
All reactions
-
Ultimately is this function the one that uploads files https://github.com/guacsec/trustify-ui/blob/main/e2e/tests/api/helpers/general-helpers.ts#L5-L24
It is doing a POST to return /api/v2/{"sbom|advisory"} using "Content-Type": contentType
Beta Was this translation helpful? Give feedback.
All reactions
-
I'm neither a JS nor axios expert. How does it work?
Beta Was this translation helpful? Give feedback.
All reactions
-
Here is a plain curl script that does the same:
Beta Was this translation helpful? Give feedback.
All reactions
-
That looks like it's loading them one by one. I did that, and can't seem to reproduce the issue though.
Beta Was this translation helpful? Give feedback.
All reactions
-
This looks to me like a data issue. The test set contains a CVE file twice for the same CVE:
- https://github.com/guacsec/trustify-ui/blob/main/e2e/tests/common/dataset/advisory/cve/CVE-2024-26308-cve.json.bz2
- https://github.com/guacsec/trustify-ui/blob/main/e2e/tests/common/dataset/advisory/cve/cve-2024-26308.json.bz2
Depending on the order of ingestion, the tests fail or not.
A CVE project file however should not he there twice. But should be ingested in the correct order of being updated. That is ensured by the way CVE projects files are distributed.
My recommendation would be to fix the test data, and then test again, in order to verify.
Beta Was this translation helpful? Give feedback.
All reactions
-
👍 1