Skip to content

Paginate UI and API for packages with large number of advisories reporting them #2197

Description

@TG1999

Choice 1:

{
                "purl": "pkg:pypi/trac@0.8.4",
                "affected_by_vulnerabilities": {
"response": [{
                        "advisory_id": "pysec_importer_v2/PYSEC-2005-1",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.10"
                        ],
                        "duplicate_advisory_ids": []
                    },
                    {
                        "advisory_id": "pysec_importer_v2/PYSEC-2006-2",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.9.6"
                        ],
                        "duplicate_advisory_ids": []
                    },
                    {
                        "advisory_id": "pysec_importer_v2/PYSEC-2006-3",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.11"
                        ],
                        "duplicate_advisory_ids": []
                    },
                    {
                        "advisory_id": "pysec_importer_v2/PYSEC-2007-2",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.10.3.1"
                        ],
                        "duplicate_advisory_ids": []
                    },
                    {
                        "advisory_id": "pysec_importer_v2/PYSEC-2007-3",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.10.3.1"
                        ],
                        "duplicate_advisory_ids": []
                    },
                    {
                        "advisory_id": "pysec_importer_v2/PYSEC-2008-4",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.10.5"
                        ],
                        "duplicate_advisory_ids": []
                    },
                    {
                        "advisory_id": "pysec_importer_v2/PYSEC-2008-5",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.10.5"
                        ],
                        "duplicate_advisory_ids": []
                    },
                    {
                        "advisory_id": "pysec_importer_v2/PYSEC-2008-6",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.11.2"
                        ],
                        "duplicate_advisory_ids": []
                    },
                    {
                        "advisory_id": "pysec_importer_v2/PYSEC-2008-7",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.11.2"
                        ],
                        "duplicate_advisory_ids": []
                    },
                    {
                        "advisory_id": "pysec_importer_v2/PYSEC-2009-7",
                        "fixed_by_packages": [
                            "pkg:pypi/trac@0.11.6"
                        ],
                        "duplicate_advisory_ids": []
                    }
                ],
"next": "https://public2.vcio/api/v3/advisories?purl=pkg:pypi/trac@0.8.4&page=2"
}
                    ,
                "fixing_vulnerabilities": [],
                "next_non_vulnerable_version": "0.9.6",
                "latest_non_vulnerable_version": "0.11.6",
                "risk_score": null
            },

Choice 2:

{
                "purl": "pkg:pypi/trac@0.8.4",
                "affected_by_vulnerabilities_url":"https://public2.vcio/api/v3/affected-advisories?purl=pkg:pypi/trac@0.8.4",
                "fixing_vulnerabilities_url": "https://public2.vcio/api/v3/fixed-advisories?purl=pkg:pypi/trac@0.8.4",
                "next_non_vulnerable_version": "0.9.6",
                "latest_non_vulnerable_version": "0.11.6",
                "risk_score": null
},
{
"count": 1,
"next": null,
"previous": null,
"results" : {
 "advisories" : [
  {
                "advisory_id": "pysec_importer_v2/PYSEC-2006-2",
                "url": "https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip",
                "aliases": [
                    "CVE-2006-3695",
                    "GHSA-r524-c2gf-5chr"
                ],
                "summary": "Trac before 0.9.6 does not disable the \"raw\" or \"include\" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458.",
                "severities": [],
                "weaknesses": [],
                "references": [
                    {
                        "url": "http://secunia.com/advisories/20958",
                        "reference_type": "",
                        "reference_id": ""
                    },
                    {
                        "url": "http://secunia.com/advisories/21534",
                        "reference_type": "",
                        "reference_id": ""
                    },
                    {
                        "url": "http://securitytracker.com/id?1016457",
                        "reference_type": "",
                        "reference_id": ""
                    },
                    {
                        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27706",
                        "reference_type": "",
                        "reference_id": ""
                    },
                    {
                        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27708",
                        "reference_type": "",
                        "reference_id": ""
                    },
                    {
                        "url": "http://trac.edgewall.org/wiki/ChangeLog",
                        "reference_type": "",
                        "reference_id": ""
                    },
                    {
                        "url": "http://www.debian.org/security/2006/dsa-1152",
                        "reference_type": "",
                        "reference_id": ""
                    },
                    {
                        "url": "http://www.securityfocus.com/bid/18323",
                        "reference_type": "",
                        "reference_id": ""
                    },
                    {
                        "url": "http://www.vupen.com/english/advisories/2006/2729",
                        "reference_type": "",
                        "reference_id": ""
                    }
                ],
                "exploitability": null,
                "weighted_severity": null,
                "risk_score": null,
                "related_ssvc_trees": []
            }
}
]
}

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions