Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Severity to deduplicate index #445

Open
lucatruf opened this issue Feb 17, 2022 · 1 comment
Open

Add Severity to deduplicate index #445

lucatruf opened this issue Feb 17, 2022 · 1 comment

Comments

@lucatruf
Copy link

What's the problem this feature will solve?
If a vulnerability from a save scanner change severity (I'm interesed in when it became higher) the change is lost.

Describe the solution you'd like
Might be quite simple, add Severity to the uix_vulnerability index:

vulnerability_uniqueness = DDL(
    "CREATE UNIQUE INDEX uix_vulnerability ON %(fullname)s "
    "(md5(name), md5(description), type, COALESCE(host_id, -1), COALESCE(service_id, -1), "
    "COALESCE(md5(method), ''), COALESCE(md5(parameter_name), ''), COALESCE(md5(path), ''), "
    "COALESCE(md5(website), ''), workspace_id, COALESCE(source_code_id, -1), severity);"
)

We faced a situation where we missed a High severity vulnerability because in a previous scan that same vuln had a Medium severity. Importing the new report deduplicated the vuln and it didn't show up.
We changed the index and imported the report again, this time the vuln showed up.

Alternative Solutions
I don't think there's one

Additional context
I don't have any

@aenima-x
Copy link
Contributor

The problem with this is that will generate the opposite reaction.
If you "discard" a vuln by downgrading its severity and you upload a new scan it will show up duplicated.
Let us think about it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants