Datasource Request: Photon OS Advisories

[captn3m0]

Upstream Source: https://github.com/vmware/photon/wiki/Security-Advisories (CC BY-SA 4.0.)

Republished in OSV at https://github.com/captn3m0/photon-os-advisories, enriched using https://packages.vmware.com/photon/photon_cve_metadata/

Sample advisory URL: https://captnemo.in/photon-os-advisories/advisories/PHSA-2024-4.0-0685.json

[keshav-space]

Thanks @captn3m0, we should definitely add this.
I wanted to know if there is a way to get all the versions of a package released by Photon. In advisory PHSA-2024-4.0-0682, there is a fix for curl. After importing this advisory, we'll have to concretely resolve all the versions that lie between 0 and 8.7.1-3.ph4. To do this, we'll need the list of all the versions of curl that were released in Photon 4.

{
    "package": {
        "ecosystem": "Photon OS:4.0",
        "name": "curl",
        "purl": "pkg:rpm/vmware/curl?distro=photon-4"
    },
    "ranges": {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "8.7.1-3.ph4"
            }
        ],
        "type": "ECOSYSTEM"
    }
}

[captn3m0]

Is this an optional requirement? Because, I can't think of any distro that provides such listings.

In this case, since the SPEC files are public on GitHub, this could possibly be generated. If this is really required, I am happy to do it, but setting introduced to 0 is recommended by the spec: https://ossf.github.io/osv-schema/#special-values

introduced allows a version of the value "0" to represent a version that sorts before any other version.

Is this concrete resolution requirement because of purl limitations?

[keshav-space]

@captn3m0 Advisories are perfect, we don’t need to change that. We should import these advisories as is, no issues there.

What I was referring to is that once we import these advisories, we run a set of improvers on them. One of those improvements is to get the concrete versions between the ranges. But we should do this seperately at later stage.

By the way, @captn3m0 do you think this https://packages.vmware.com/photon/4.0/photon_4.0_x86_64/x86_64/ would be the right source to gather all the package versions in Photon-4?

Is this concrete resolution requirement because of purl limitations?

Not the purl limitation, but it has more to do with the fact that in VulnerableCode packages are first-class citizens.

[captn3m0]

Got it.

A package repository monitored properly could be considered a good source for this.

I don't know if VMWare deleted old packages here, you should reach out and confirm (the GitHub repository I linked above is a good place to ask).