Support for Google OSV database

[sameer1046]

Current Behavior:

The tool doesn't have support for Google open source vulnerability database
https://osv.dev/list

Proposed Behavior:

The tool should be able to get data from Google osv database.

[stevespringett]

Good suggestion. It's unfortunate osv doesn't support Package URL. I'd recommend creating a ticket for them to support it. Relying on 'name' and 'ecosystem' is fragile and going to be unpredictable. Once osv supports Package URL, I'd be happy to add support for it.

[VinodAnandan]

google/osv.dev#64

[VinodAnandan]

@stevespringett OSV now supports PURL. Please find the below links for more details

https://security.googleblog.com/2021/06/announcing-unified-vulnerability-schema.html
https://tinyurl.com/vuln-json
https://osv.dev/docs/#operation/OSV_QueryAffected

[VinodAnandan]

curl -X POST -d '{"package": {"purl": "pkg:maven/org.apache.struts:struts2-core"}, "version": "2.0.14"}' https://api.osv.dev/v1/query

[pombredanne]

@VinodAnandan FWIW, pkg:maven/org.apache.struts:struts2-core may not be the proper purl for this package, but rather pkg:maven/org.apache.struts/struts2-core

[VinodAnandan]

Thanks @pombredanne

[pombredanne]

@VinodAnandan sure thing! ... note that when VulnerableCode will be ready for usage, it will also have OSV content and everything is keyed by Package URL there... so this could be come a natural additional data source for DT

[VinodAnandan]

The purl issue has been fixed. Thanks to @oliverchang

"curl -X POST -d '{"package": {"purl": "pkg:maven/org.apache.struts/[email protected]"}}' https://api.osv.dev/v1/query"

[sahibamittal]

OSV maintains GCS bucket with all aggregated vulnerabilities which can be scheduled and mirrored in dependency-track database https://github.com/google/osv/blob/master/README.md#data-dumps
I'd like to work on it.

[sahibamittal]

Draft PR for discussion -> #1703

[nscuro]

Implemented in #1703. Thanks @sahibamittal! 🥳

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.