Comments (14)
✨ Thank you for your interest in OSV.dev's data quality! ✨
Please review our FAQ entry on how to most efficiently have this addressed.
from osv.dev.
Same for https://osv.dev/vulnerability/OSV-2024-551, https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69531 - missing fix revision
from osv.dev.
@jonathanmetzman are you able to provide any insights here into what happens from OSS-Fuzz's side?
from osv.dev.
Is there something you noticed that oss-fuzz did wrong? To me everything appears normal, it has a fixed revision.
from osv.dev.
I searched for the logs related to bug 6726871018438656 and only saw regressed bisect performed on Jan 18, but I cannot find any logs related to fixed bisect.
However, for bugs with fix available for example this one: https://osv.dev/vulnerability/OSV-2024-504, I can see both regressed and fixed bisect performed.
from osv.dev.
I searched for the logs related to bug 6726871018438656 and only saw regressed bisect performed on Jan 18, but I cannot find any logs related to fixed bisect.
However, for bugs with fix available for example this one: https://osv.dev/vulnerability/OSV-2024-504, I can see both regressed and fixed bisect performed.
Yes that seems like a bug. This does not seem like an issue on OSS-Fuzz side, but on the bisection side of OSV.
from osv.dev.
@jonathanmetzman are you able to confirm that a request to bisect the fixed version was made from OSS-Fuzz? We have no evidence of one ever being received. Is it possible to repeat that request?
from osv.dev.
I don't think oss-fuzz makes these sorts of requests. I'm not really sure what's being asked of me here.
As far as I know, osv is a consumer of OSS-Fuzz not the other way around.
from osv.dev.
Lets check with @oliverchang once he is back from vacation. It feels like OSV bisector should be periodically checking for unfixed bugs by looking at testcase.fixed attribute and then triggering a fixed bisection. I don't think we should be rely on OSS-Fuzz, but will let Oliver check on this.
from osv.dev.
OSS-Fuzz does actually request a bisection via https://github.com/google/clusterfuzz/blob/aeec8a904ab50ec4169ebcc6667b5505d037fce0/src/clusterfuzz/_internal/base/bisection.py#L47.
There have been repeated cases in the past where this doesn't come through for some reason.
There's a bunch of improvements that need to be made here (mainly #2043 being the architectural one). This would enable us to e.g. do the more reliable periodic check rather than rely on OSS-Fuzz to be reliably sending requests, in addition to better decoupling some of the OSS-Fuzz infra from osv.dev. I think we need to do this in late Q3/Q4 this year. I'll write something up in more detail.
from osv.dev.
In the meantime, I'll run a manual backfill tomorrow (didn't get to this today).
from osv.dev.
https://osv.dev/vulnerability/OSV-2024-22 and https://osv.dev/vulnerability/OSV-2024-551 now both have fixed
attributes. The backfill is still running in case there are any other recent entries with this issue.
from osv.dev.
https://osv.dev/vulnerability/OSV-2024-22 and https://osv.dev/vulnerability/OSV-2024-551 now both have
fixed
attributes. The backfill is still running in case there are any other recent entries with this issue.
apart from the longer architectural change and manual backfills, is there any intermediate solution that can send multiple bisections (tasks distributed over days, like send 3 - one now, one scheduled after a day, one scheduled after 2 days) so even if one fails, other goes through. This is a pretty bad quality issue, so thought for an intermediate solution (extra bisections shouldn't hurt, and data will be complete most of the time?)
from osv.dev.
https://osv.dev/vulnerability/OSV-2024-22 and https://osv.dev/vulnerability/OSV-2024-551 now both have
fixed
attributes. The backfill is still running in case there are any other recent entries with this issue.apart from the longer architectural change and manual backfills, is there any intermediate solution that can send multiple bisections (tasks distributed over days, like send 3 - one now, one scheduled after a day, one scheduled after 2 days) so even if one fails, other goes through. This is a pretty bad quality issue, so thought for an intermediate solution (extra bisections shouldn't hurt, and data will be complete most of the time?)
Pub/Sub should already do this via its own retry mechanism. It's possible that something is preventing OSS-fuzz from sending the request in the first place in these cases -- I'll take a closer look.
from osv.dev.
Related Issues (20)
- Grouping multiple unrelated Git repos into a single "affected" entry is confusing HOT 7
- Incorrect tooltip text on osv.dev when starting affected version is 0
- OSV API Response is Inconsistent with Schema HOT 2
- eze-cli homepage return 404
- Data quality issue with CVE-2024-38356 & CVE-2024-38357 HOT 2
- Haskell GHC ecosystem enumeration broken
- CVSS severities are never validated HOT 1
- Always return the upstream aliases when no alias groups are generated HOT 12
- Data quality issue with CVE-2023-34055 HOT 7
- Request vulnerability of multiple package in the same request HOT 4
- Failed to enumerate versions for some Debian packages HOT 1
- Data quality issue with GO-2024-2521 HOT 4
- Data quality issue with PYSEC-2024-60 HOT 2
- Support API queries for non-enumerated ecosystems
- Missing PURL converters HOT 1
- Git analysis: relax branch computation
- Crucial bug: osv-scanner does not detect known malicious package in lockfiles HOT 8
- Update Documentation Logos for Dark Theme Consistency
- Solution hashes for a vulnerability lies in an external fork HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from osv.dev.