Vendor Severity missing for findings from Go Vulnerability Database govulndb #9671
Replies: 1 comment 2 replies
-
|
Hello @oallauddin
That’s why Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
|
@DmitriyLewen
I think the logic is somewhere here https://github.com/aquasecurity/trivy/blob/main/pkg/vulnerability/vulnerability.go#L149. "Severity": "HIGH",
"VendorSeverity": {
"amazon": 3,
"azure": 3,
"bitnami": 3,
"cbl-mariner": 3,
"redhat": 2
},
"CVSS": {
"bitnami": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"V3Score": 7
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"V3Score": 7
}
|
Beta Was this translation helpful? Give feedback.
-
|
Hello @oallauddin
It means this works within a single source. In your case, the sequence will be as follows:
IIRC alpine doesn't have severity. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Description
Pipeline we use parses cyclonedx findings. Findings that are sourced from govulndb do not have the rating for the govulndb source. Unable to determine the severity level for the source because of this. I believe the reason there is no rating is because the VendorSeverity is missing for findings from govulndb.
Desired Behavior
Have a VendorSeverity/rating entry for findings that are sourced from govulndb.
Actual Behavior
There is no VendorSeverity/rating entry for findings that are sourced from govulndb.
Reproduction Steps
CVE-2025-58058 is sourced from ghsa and has a VendorSeverity value of 2 for ghsa i.e. MEDIUM.
CVE-2025-47907 is sourced from govulndb and has no VendorSeverity value for govulndb.
{ "VulnerabilityID": "CVE-2025-58058", "PkgID": "github.com/ulikunitz/[email protected]", "PkgName": "github.com/ulikunitz/xz", "PkgIdentifier": { "PURL": "pkg:golang/github.com/ulikunitz/[email protected]", "UID": "7d888a458e19196a" }, "InstalledVersion": "v0.5.10", "FixedVersion": "0.5.15", "Status": "fixed", "Layer": { "Digest": "sha256:fd5975e7a295460d8a4b3761897f056a424990b8c6d2a5718ca7dc088f80bc50", "DiffID": "sha256:6cebf11f9ab6065bae4d570cdcb45eb101bb9afcec48facc7c8e1029bc2b2989" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-58058", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Title": "github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory", "Description": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.", "Severity": "MEDIUM", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "cbl-mariner": 2, "ghsa": 2, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-58058", "https://github.com/ulikunitz/xz", "https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2", "https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9", "https://nvd.nist.gov/vuln/detail/CVE-2025-58058", "https://www.cve.org/CVERecord?id=CVE-2025-58058" ], "PublishedDate": "2025-08-28T22:15:32.577Z", "LastModifiedDate": "2025-08-29T16:24:29.73Z" }, { "VulnerabilityID": "CVE-2025-47907", "PkgID": "[email protected]", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/[email protected]", "UID": "1ec3c2315149465c" }, "InstalledVersion": "v1.24.5", "FixedVersion": "1.23.12, 1.24.6", "Status": "fixed", "Layer": { "Digest": "sha256:fd5975e7a295460d8a4b3761897f056a424990b8c6d2a5718ca7dc088f80bc50", "DiffID": "sha256:6cebf11f9ab6065bae4d570cdcb45eb101bb9afcec48facc7c8e1029bc2b2989" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-47907", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Title": "database/sql: Postgres Scan Race Condition", "Description": "Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "redhat": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-47907", "https://go.dev/cl/693735", "https://go.dev/issue/74831", "https://groups.google.com/g/golang-announce/c/x5MKroML2yM", "https://nvd.nist.gov/vuln/detail/CVE-2025-47907", "https://pkg.go.dev/vuln/GO-2025-3849", "https://www.cve.org/CVERecord?id=CVE-2025-47907" ], "PublishedDate": "2025-08-07T16:15:30.357Z", "LastModifiedDate": "2025-08-07T21:26:37.453Z" },{ "id": "CVE-2025-58058", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "ratings": [ { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 770 ], "description": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.", "recommendation": "Upgrade github.com/ulikunitz/xz to version 0.5.15", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-58058" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-58058" }, { "url": "https://github.com/ulikunitz/xz" }, { "url": "https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2" }, { "url": "https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58058" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-58058" } ], "published": "2025-08-28T22:15:32+00:00", "updated": "2025-08-29T16:24:29+00:00", "affects": [ { "ref": "pkg:golang/github.com/ulikunitz/[email protected]", "versions": [ { "version": "v0.5.10", "status": "affected" } ] } ] }, { "id": "CVE-2025-47907", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L" } ], "description": "Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.", "recommendation": "Upgrade stdlib to version 1.23.12, 1.24.6", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-47907" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-47907" }, { "url": "https://go.dev/cl/693735" }, { "url": "https://go.dev/issue/74831" }, { "url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47907" }, { "url": "https://pkg.go.dev/vuln/GO-2025-3849" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-47907" } ], "published": "2025-08-07T16:15:30+00:00", "updated": "2025-08-07T21:26:37+00:00", "affects": [ { "ref": "pkg:golang/[email protected]", "versions": [ { "version": "v1.24.5", "status": "affected" } ] } ] }Target
Container Image
Scanner
Vulnerability
Output Format
JSON
Mode
Standalone
Debug Output
Operating System
Linux
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions