Determine if a Vulnerability is Patched or not

[sourabhsparkala]

We get a list of Vulnerability for a project. We use NVD to get information on Vulnerabilities.

While gathering the information, it is observed that we get

• versionEndExcluding
• versionEndIncluding

Which holds end version information.

Is it possible to use this information to determine if

• A project has an artifact version that lies above the given range? which will determine if the vulnerability is UNPATCHED : PATCHED

DOD:

• Check if the above POC can be implemented.
• Discuss with the team the findings and decide on the best possible step.
• If agreed, then implement the same as part of the rating core.

[artem-smotrakov]

I am not sure what exactly you'd like to check. OWASP Dependency Check reports unpatched vulnerabilities for an artifact, so you can just set resolution to unpatched in the data provider that runs OWASP Dependency Check for an artifact.

[sourabhsparkala]

I am not sure what exactly you'd like to check. OWASP Dependency Check reports unpatched vulnerabilities for an artifact, so you can just set resolution to unpatched in the data provider that runs OWASP Dependency Check for an artifact.

https://github.com/SAP/fosstars-rating-core/pull/534#discussion_r646311240