Skip to content

Commit 2d33082

Browse files
kikofernandezkikofernandez
authored
Merge pull request #10226 from kikofernandez/kiko/fix-vendor-scanner-and-openvex/OTP-19781
fix scanner and vex statements for next release OTP-19781
2 parents 7c95cca + 95e6905 commit 2d33082

File tree

6 files changed

+150
-8
lines changed

6 files changed

+150
-8
lines changed

‎.github/scripts/otp-compliance.es‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1621,8 +1621,7 @@ maint_to_otp_conversion(Branch) ->
16211621
case Branch of
16221622
~"master" ->
16231623
%% Master corresponds to possible patched versions of OTP_VERSION-1.
1624-
VersionNumber = erlang:list_to_integer(string:trim(os:cmd("cat OTP_VERSION | cut -d. -f1"))),
1625-
BinVersionNumber = erlang:integer_to_binary(VersionNumber-1),
1624+
BinVersionNumber = erlang:list_to_binary(string:trim(os:cmd("cat OTP_VERSION | cut -d. -f1"))),
16261625
<<"otp-", BinVersionNumber/binary>>;
16271626
<<"maint-", Vers/binary>> ->
16281627
<<"otp-", Vers/binary>>;
@@ -1758,7 +1757,7 @@ vendor_by_version(_) ->
17581757
%% any vulnerability. The user should still look into possible
17591758
%% issues with wx if they link to it.
17601759
non_vulnerable_vendor_packages() ->
1761-
[~"wx"].
1760+
[~"wx-doc-src"].
17621761

17631762
ignore_non_vulnerable_vendors(Packages) ->
17641763
lists:filter(fun (#{~"ID" := Id}) -> not lists:member(Id, non_vulnerable_vendor_packages())

‎.github/workflows/reusable-vendor-vulnerability-scanner.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -124,9 +124,6 @@ jobs:
124124
with:
125125
app-id: ${{ secrets.ERLANG_VENDOR_SCANNER_APP_ID }}
126126
private-key: ${{ secrets.ERLANG_VENDOR_SCANNER_BOT_PRIVATE_KEY }}
127-
permissions: |
128-
issues: write
129-
security_events: read
130127

131128
# PRs comming from a fork can use their own GH_TOKEN instead.
132129
# this is for security reasons that forked PRs cannot work with Github App tokens

‎make/openvex.table‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -547,6 +547,34 @@
547547
],
548548
"not_affected": "vulnerable_code_not_present"
549549
}
550+
},
551+
{
552+
"pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d": "CVE-2016-2183",
553+
"status": {
554+
"apps": [
555+
"pkg:otp/[email protected]",
556+
"pkg:otp/[email protected]"
557+
],
558+
"not_affected": "vulnerable_code_not_present"
559+
}
560+
}
561+
],
562+
"otp-29": [
563+
{
564+
"pkg:github/madler/zlib@1a8db63788c34a50e39e273d39b7e1033208aea2": "CVE-2023-45853",
565+
"status": { "not_affected": "vulnerable_code_not_present" }
566+
},
567+
{
568+
"pkg:github/openssl/openssl@01d5e2318405362b4de5e670c90d9b40a351d053": "CVE-2025-4575",
569+
"status": {
570+
"not_affected": "vulnerable_code_not_present"
571+
}
572+
},
573+
{
574+
"pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d": "CVE-2016-2183",
575+
"status": {
576+
"not_affected": "vulnerable_code_not_present"
577+
}
550578
}
551579
]
552580
}

‎vex/otp-28.openvex.json‎

Lines changed: 64 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
"@id": "https://openvex.dev/docs/public/otp/vex-otp-28",
44
"author": "vexctl",
55
"timestamp": "2025-08-21T10:55:45.714759+02:00",
6-
"last_updated": "2025-09-18T09:59:20.278041735+02:00",
7-
"version": 25,
6+
"last_updated": "2025-09-19T10:34:52.749902956+02:00",
7+
"version": 27,
88
"statements": [
99
{
1010
"vulnerability": {
@@ -473,6 +473,68 @@
473473
],
474474
"status": "not_affected",
475475
"justification": "vulnerable_code_not_present"
476+
},
477+
{
478+
"vulnerability": {
479+
"name": "CVE-2016-2183"
480+
},
481+
"timestamp": "2025-09-19T10:34:52.73417131+02:00",
482+
"products": [
483+
{
484+
"@id": "pkg:github/erlang/[email protected]"
485+
},
486+
{
487+
"@id": "pkg:github/erlang/[email protected]"
488+
},
489+
{
490+
"@id": "pkg:github/erlang/[email protected]"
491+
},
492+
{
493+
"@id": "pkg:github/erlang/[email protected]"
494+
},
495+
{
496+
"@id": "pkg:github/erlang/[email protected]"
497+
},
498+
{
499+
"@id": "pkg:otp/[email protected]"
500+
},
501+
{
502+
"@id": "pkg:github/erlang/[email protected]"
503+
},
504+
{
505+
"@id": "pkg:otp/[email protected]"
506+
},
507+
{
508+
"@id": "pkg:otp/[email protected]"
509+
},
510+
{
511+
"@id": "pkg:otp/[email protected]"
512+
},
513+
{
514+
"@id": "pkg:otp/[email protected]"
515+
},
516+
{
517+
"@id": "pkg:otp/[email protected]"
518+
},
519+
{
520+
"@id": "pkg:otp/[email protected]"
521+
}
522+
],
523+
"status": "not_affected",
524+
"justification": "vulnerable_code_not_present"
525+
},
526+
{
527+
"vulnerability": {
528+
"name": "CVE-2016-2183"
529+
},
530+
"timestamp": "2025-09-19T10:34:52.749903353+02:00",
531+
"products": [
532+
{
533+
"@id": "pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d"
534+
}
535+
],
536+
"status": "not_affected",
537+
"justification": "vulnerable_code_not_present"
476538
}
477539
]
478540
}

‎vex/otp-29.openvex.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"@context": "https://openvex.dev/ns/v0.2.0",
3+
"@id": "https://openvex.dev/docs/public/otp/vex-otp-29",
4+
"author": "vexctl",
5+
"timestamp": "2025-09-19T10:20:20.759995+02:00",
6+
"last_updated": "2025-09-19T10:33:18.152632187+02:00",
7+
"version": 4,
8+
"statements": [
9+
{
10+
"vulnerability": {
11+
"name": "CVE-2016-2183"
12+
},
13+
"timestamp": "2025-09-19T10:33:18.120131746+02:00",
14+
"products": [
15+
{
16+
"@id": "pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d"
17+
}
18+
],
19+
"status": "not_affected",
20+
"justification": "vulnerable_code_not_present"
21+
},
22+
{
23+
"vulnerability": {
24+
"name": "CVE-2025-4575"
25+
},
26+
"timestamp": "2025-09-19T10:33:18.136216491+02:00",
27+
"products": [
28+
{
29+
"@id": "pkg:github/openssl/openssl@01d5e2318405362b4de5e670c90d9b40a351d053"
30+
}
31+
],
32+
"status": "not_affected",
33+
"justification": "vulnerable_code_not_present"
34+
},
35+
{
36+
"vulnerability": {
37+
"name": "CVE-2023-45853"
38+
},
39+
"timestamp": "2025-09-19T10:33:18.152633759+02:00",
40+
"products": [
41+
{
42+
"@id": "pkg:github/madler/zlib@1a8db63788c34a50e39e273d39b7e1033208aea2"
43+
}
44+
],
45+
"status": "not_affected",
46+
"justification": "vulnerable_code_not_present"
47+
}
48+
]
49+
}

‎vex/otp-29.openvex.json.license‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
%CopyrightBegin%
2+
3+
SPDX-License-Identifier: Apache-2.0
4+
5+
Copyright Ericsson AB 2025. All Rights Reserved.
6+
7+
%CopyrightEnd%

0 commit comments

Comments
 (0)