cve-bin-tool
cve-bin-tool copied to clipboard
Reporting and Triage improvements (was a GSoC idea, now available to all)
Possible GSoC idea: Reporting and Triage improvements
- related: #1462
- related: #1379
I just filed 4 feature requests related to the report UI and how we display triage data:
- #1614
- #1615
- #1616
- #1617
And this got me thinking that we probably have some refinements we can do in that area:
- improving how triage is displayed across reports (e.g apparently it's missing in PDF right now)
- allowing further customization of reports based on triage
- adding how-to guides on common triage scenarios such as...
- "how to triage false positives"
- "how to add triage comments" (e.g. extended information about mitigations used for a cve which isn't yet fixed)
- "how to re-use triage in other projects using merged reports" (e.g. use the triage from a docker base image across multiple projects using the same base)
- "tracking changing triage and fixes over time using merged reports" -Improving, creating, or recommending tools to help with triage data. We have some, but probably not everything anyone could want here. Do we need a command line "add triage to file" option, for example?
Difficulty: Intermediate to Advanced Hours: 175 or 350 depending on how many of these ideas you propose to tackle. Simple triage display fixes and documentation is likely a 175 hour project, students intending to add additional triage tools and triage-customized reports would likely want to apply for a 350hr slot.
Open to all:
This work was previously flagged as a potential GSoC project, but we didn't get an applicants interested in doing it at that time. It's now available to anyone who wants to work in this area.
The new VEX feature (#1570) may also be worth considering as this offers facilities to support the triage process by using a JSON file. Maybe consider adding some tooling to manipulate the status of a vulnerability rather than just using an editor to edit a large JSON file.
This one didn't happen in GSoC 2022, so I'm going to remove the reserved note and stuff above.
See also #1747
Closing this (and all the other leftover gsoc ideas from previous years) in order to help folk focus on the new project idea descriptions.