Compute all transitive aliases for OSV entries

[fingeromer]

It seems like when I search CVE-2023-36258 I got to results - PYSEC & GHSA:

but when I search in the API:

{      
    "package": {
       "purl":"pkg:pypi/langchain@0.0.266"
      }
    }

I got only the PYSEC entry:

 {
            "id": "PYSEC-2023-98",
            "details": "An issue in langchain v.0.0.199 allows an attacker to execute arbitrary code via the PALChain in the python exec method.",
            "aliases": [
                "CVE-2023-36258"
            ],
            "modified": "2023-08-18T15:49:49.212164Z",
            "published": "2023-07-03T21:15:00Z",
            "references": [
                {
                    "type": "REPORT",
                    "url": "https://github.com/hwchase17/langchain/issues/5872"
                }
            ],
            "affected": [
                {
                    "package": {
                        "name": "langchain",
                        "ecosystem": "PyPI",
                        "purl": "pkg:pypi/langchain"
                    },
                    "ranges": [
                        {
                            "type": "ECOSYSTEM",
                            "events": [
                                {
                                    "introduced": "0"
                                }
                            ]
                        }
                    ],
                    "versions": [
                        "0.0.1",
                        "0.0.10",
                        "0.0.100",
                        "0.0.101",
                        .
                        .
                        .
                        .
                    ],
                    "database_specific": {
                        "source": "https://github.com/pypa/advisory-database/blob/main/vulns/langchain/PYSEC-2023-98.yaml"
                    }
                }

It means a lot because it seems like for langchain the vulnerabilities in PYSEC are never fixed:

While in GHSA they are (or at least include the 'last affected version':

[andrewpollock]

In-progress assessment:

PYSEC-2023-98

$ GET https://api.osv.dev/v1/vulns/PYSEC-2023-98 | jq .affected[].package
{
  "name": "langchain",
  "ecosystem": "PyPI",
  "purl": "pkg:pypi/langchain"
}

$ GET https://api.osv.dev/v1/vulns/PYSEC-2023-98 | jq .affected[].ranges
[
  {
    "type": "ECOSYSTEM",
    "events": [
      {
        "introduced": "0"
      }
    ]
  }
]

$ GET https://api.osv.dev/v1/vulns/PYSEC-2023-98 | jq .affected[].versions | grep 0.0.266
  "0.0.266",

GHSA-2qmj-7962-cjq8

$ GET https://api.osv.dev/v1/vulns/GHSA-2qmj-7962-cjq8 | jq .affected[].package
{
  "name": "langchain",
  "ecosystem": "PyPI",
  "purl": "pkg:pypi/langchain"
}

$ GET https://api.osv.dev/v1/vulns/GHSA-2qmj-7962-cjq8 | jq .affected[].ranges
[
  {
    "type": "ECOSYSTEM",
    "events": [
      {
        "introduced": "0"
      },
      {
        "last_affected": "0.0.222"
      }
    ]
  }
]

$ GET https://api.osv.dev/v1/vulns/GHSA-2qmj-7962-cjq8 | jq .affected[].versions | grep 0.0.266

On the face of it, this looks like it may be incomplete version enumeration for GHSA-2qmj-7962-cjq8, but further investigation is required.

[another-rex]

Can you clarify what the mismatch is?

This seems like a issue with GHSA not updating their last_affected field they publish, assuming this would be fixed in the newer releases.

The API only returns the PYSEC entry, since 0.0.222 < 0.0.266, so according to the GHSA entry, 0.0.266 is not affected.

[another-rex]

Created github/advisory-database#2640 to resolve this upstream.

[fingeromer]

Thanks @another-rex, I think I understand.
I this diagram explain my confusion well:

I was expecting to see all aliases of the CVE related to version 0.0.266

[another-rex]

We currently are working on a solution to populate the aliases field with all the aliases of the CVE. (Part of #1293)

The API will still return the advisory that's affecting the version of the package you pass in (e.g. PYSEC-123), but at least the aliases field will contain the other advisories (e.g. GHSA-123).