feat: use VulnsStatus to skip NVD Rejected CVE (#542)

Author: gshanbhag525

pkg/types/types.go

@@ -83,6 +83,7 @@ type VulnerabilityDetail struct {
 	Description      string     `json:",omitempty"`
 	PublishedDate    *time.Time `json:",omitempty"` // Take from NVD or GHSA
 	LastModifiedDate *time.Time `json:",omitempty"` // Take from NVD or GHSA
+	Status           string     `json:"-"`          // Rejected or not, also not stored in db
 }
 
 type AdvisoryDetail struct {

pkg/vulnsrc/nvd/nvd.go

@@ -198,6 +198,7 @@ func (nvd *NVD) Put(tx *bolt.Tx, cve Cve) error {
 		Description:      description,
 		PublishedDate:    &publishedDate,
 		LastModifiedDate: &lastModifiedDate,
+		Status:           strings.ToUpper(cve.VulnStatus),
 	}
 
 	return nvd.PutVulnerabilityDetail(tx, cve.ID, vulnerability.NVD, vuln)

pkg/vulnsrc/nvd/nvd_test.go

@@ -23,6 +23,7 @@ func TestVulnSrc_Update(t *testing.T) {
 				{
 					Key: []string{"vulnerability-detail", "CVE-2020-0001", "nvd"},
 					Value: types.VulnerabilityDetail{
+						Status:           "ANALYZED",
 						Description:      "In getProcessRecordLocked of ActivityManagerService.java isolated apps are not handled correctly. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-140055304",
 						CvssScore:        7.2,
 						CvssVector:       "AV:L/AC:L/Au:N/C:C/I:C/A:C",
@@ -38,6 +39,7 @@ func TestVulnSrc_Update(t *testing.T) {
 				{
 					Key: []string{"vulnerability-detail", "CVE-2023-0001", "nvd"},
 					Value: types.VulnerabilityDetail{
+						Status:           "UNDERGOING ANALYSIS",
 						Description:      "An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.",
 						CvssScoreV3:      6.7,
 						CvssVectorV3:     "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
@@ -51,6 +53,7 @@ func TestVulnSrc_Update(t *testing.T) {
 				{
 					Key: []string{"vulnerability-detail", "CVE-2024-0069", "nvd"},
 					Value: types.VulnerabilityDetail{
+						Status:           "REJECTED",
 						Description:      "Rejected reason: This CVE ID was unused by the CNA.",
 						LastModifiedDate: utils.MustTimeParse("2023-11-28T00:15:07.140Z"),
 						PublishedDate:    utils.MustTimeParse("2023-11-28T00:15:07.140Z"),
@@ -59,6 +62,7 @@ func TestVulnSrc_Update(t *testing.T) {
 				{
 					Key: []string{"vulnerability-detail", "CVE-2024-5732", "nvd"},
 					Value: types.VulnerabilityDetail{
+						Status:           "ANALYZED",
 						Description:      "A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability.",
 						CvssScoreV3:      9.8,
 						CvssVectorV3:     "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",

pkg/vulnsrc/nvd/types.go

@@ -9,6 +9,7 @@ type Cve struct {
 	Metrics      Metrics      `json:"metrics,omitempty"`
 	Weaknesses   []Weakness   `json:"weaknesses,omitempty"`
 	References   []Reference  `json:"references"`
+	VulnStatus   string       `json:"vulnStatus"`
 }
 
 type LangString struct {

pkg/vulnsrc/vulnerability/vulnerability.go

@@ -11,7 +11,10 @@ import (
 )
 
 const (
-	rejectVulnerability = "** REJECT **"
+	rejectedStatus   = "REJECTED"
+	rejectKeyword    = "** REJECT **"
+	rejectedReason   = "Rejected reason:"
+	rejectedDoNotUse = "DO NOT USE THIS CANDIDATE NUMBER"
 )
 
 type Vulnerability struct {
@@ -216,7 +219,8 @@ func getRejectedStatus(details map[types.SourceID]types.VulnerabilityDetail) boo
 		if !ok {
 			continue
 		}
-		if strings.Contains(d.Description, rejectVulnerability) {
+		if strings.EqualFold(d.Status, rejectedStatus) || strings.Contains(d.Description, rejectKeyword) ||
+			strings.Contains(d.Description, rejectedDoNotUse) || strings.HasPrefix(d.Description, rejectedReason) {
 			return true
 		}
 	}

pkg/vulnsrc/vulnerability/vulnerability_test.go

@@ -85,6 +85,7 @@ func TestIsRejected(t *testing.T) {
 					CvssScore:   9.1,
 					Title:       "test vulnerability",
 					Description: "a test vulnerability where vendor rates it lower than NVD",
+					Status:      "Modified",
 				},
 				vulnerability.RedHat: {
 					ID:          "CVE-2020-1234",
@@ -118,6 +119,35 @@ func TestIsRejected(t *testing.T) {
 					CvssScore:   9.1,
 					Title:       "test vulnerability",
 					Description: "** REJECT ** a test vulnerability where vendor rates it lower than NVD",
+					Status:      "Rejected",
+				},
+			},
+			want: true,
+		},
+		{
+			name: "happy path, when vulnerability from redhat and ubuntu is rejected by Nvd (from status only)",
+			details: map[types.SourceID]types.VulnerabilityDetail{
+				vulnerability.RedHat: {
+					ID:          "CVE-2020-1234",
+					CvssScoreV3: 5.6,
+					Title:       "test vulnerability",
+					Description: "a test vulnerability where vendor rates it lower than NVD",
+				},
+				vulnerability.Ubuntu: {
+					ID:          "CVE-2020-1234",
+					CvssScore:   1.2,
+					CvssScoreV3: 3.4,
+					Severity:    types.SeverityLow,
+					SeverityV3:  types.SeverityMedium,
+					Title:       "test vulnerability",
+					Description: "a test vulnerability where vendor rates it lower than NVD",
+				},
+				vulnerability.NVD: {
+					ID:          "CVE-2020-1234",
+					CvssScore:   9.1,
+					Title:       "test vulnerability",
+					Description: "a test vulnerability where vendor rates it lower than NVD",
+					Status:      "Rejected",
 				},
 			},
 			want: true,