Skip to content

tooling: include OSV JSON data in official CVE feed#181

Open
Pnkcaht wants to merge 2 commits intokubernetes:mainfrom
Pnkcaht:tooling/srctl-prow-tests
Open

tooling: include OSV JSON data in official CVE feed#181
Pnkcaht wants to merge 2 commits intokubernetes:mainfrom
Pnkcaht:tooling/srctl-prow-tests

Conversation

@Pnkcaht
Copy link

@Pnkcaht Pnkcaht commented Feb 6, 2026 •
edited
Loading

What I Did

  • Extended the official Kubernetes CVE feed to include OSV JSON data.
  • For each CVE issue:
    • First attempt to extract an embedded OSV JSON object from the issue body
      (new SRC CVE announcement format).
    • Fallback to fetching the OSV JSON from the
      kubernetes-sigs/cve-feed-osv repository when no embedded OSV is present.
    • Added the OSV data under the _kubernetes_io["osv"] field.
    • Ensured that both the primary CVE and any additional CVEs referenced in the
      same issue include OSV data.
  • Implemented safe network handling with try/except blocks and a timeout=5
    to prevent feed generation failures.
  • Maintained backward compatibility: when no OSV data is available, the osv
    field remains None.

Related Issue

Tests

I picked 2 different CVEs to do the test, in which the first one is related to the correct error, that is, a null return for an expected pattern.The second one is based on the correct pattern related to a CVE with the public OSV.

CVE test with OSV not published

The correct and standard behavior is for the OSV to be null, since this example CVE does not have a published OSV.

image

CVE with a Public OSV

CVE with public OSV where the expected default behavior is receiving a JSON with the correct information.

Output Terminal

{
  "id": "CVE-2019-11243",
  "osv": {
    "id": "CVE-2019-11243",
    "modified": "2019-04-18T21:31:53Z",
    "published": "2019-04-18T21:31:53Z",
    "summary": "rest.AnonymousClientConfig() does not remove the serviceaccount credentials from config created by rest.InClusterConfig()",
    "details": "In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()",
    "affected": [
      {
        "package": {
          "ecosystem": "kubernetes",
          "name": "k8s.io/client-go"
        },
        "severity": [
          {
            "type": "CVSS_V3",
            "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
          }
        ],
        "ranges": [
          {
            "type": "SEMVER",
            "events": [
              {
                "introduced": "1.12.0"
              },
              {
                "fixed": "1.12.5"
              },
              {
                "introduced": "1.13.0"
              },
              {
                "fixed": "1.13.1"
              }
            ]
          }
        ]
      }
    ],
    "references": [
      {
        "type": "ADVISORY",
        "url": "https://github.com/kubernetes/kubernetes/issues/76797"
      },
      {
        "type": "ADVISORY",
        "url": "https://www.cve.org/cverecord?id=CVE-2019-11243"
      }
    ]
  }
}

@Pnkcaht
tooling: include OSV JSON data in official CVE feed
1314b35 
Signed-off-by: pnkcaht <samzoovsk19@gmail.com>
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Feb 7, 2026
@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Feb 7, 2026
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Feb 7, 2026

Hi @Pnkcaht. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Feb 7, 2026
@Pnkcaht
tooling: include embedded OSV data from CVE issue body
8032848 
Signed-off-by: pnkcaht <samzoovsk19@gmail.com>
@PushkarJ
Copy link
Member

PushkarJ commented Feb 14, 2026

/ok-to-test
/triage accepted
/sig security

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. triage/accepted Indicates an issue or PR is ready to be actively worked on. sig/security Categorizes an issue or PR as relevant to SIG Security. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 14, 2026
@PushkarJ
Copy link
Member

PushkarJ commented Feb 14, 2026

@Pnkcaht Thank you so much for making this contribution. I tested this locally and it works well!

/lgtm
/assign mtardy

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 14, 2026
@PushkarJ PushkarJ removed their assignment Feb 14, 2026
@PushkarJ PushkarJ mentioned this pull request Feb 14, 2026
Draft
@Pnkcaht
Copy link
Author

Pnkcaht commented Feb 14, 2026

@PushkarJ Thank you my friend, I will be contributing regularly here as well.

mtardy
mtardy suggested changes Mar 11, 2026
View reviewed changes
Copy link
Member

@mtardy mtardy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, it works but I think the patch could be adjusted

sig-security-tooling/cve-feed/hack/__pycache__/cve_title_parser.cpython-313.pyc
Copy link
Member

@mtardy mtardy Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hey you committed a binary file here, please remove

sig-security-tooling/cve-feed/hack/fetch-official-cve-feed.py Outdated
Comment on lines +98 to +100

# Initialize the OSV field as None in case no OSV JSON is available
cve['_kubernetes_io']['osv'] = None
Copy link
Member

@mtardy mtardy Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you already did that on line 82

sig-security-tooling/cve-feed/hack/fetch-official-cve-feed.py Outdated
Comment on lines +113 to +115
except requests.RequestException:
# If any network error occurs (timeout, connection error, etc.), leave 'osv' as None
cve['_kubernetes_io']['osv'] = None
Copy link
Member

@mtardy mtardy Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's already none, you can again remove that

sig-security-tooling/cve-feed/hack/fetch-official-cve-feed.py
Comment on lines +123 to +132
# Make a deep copy of the main CVE to avoid overwriting its data
additional_cve = copy.deepcopy(cve)

# Update the CVE ID for this additional CVE
additional_cve['id'] = additional_cve_id

# Set the external URL for this CVE on CVE.org
additional_cve['external_url'] = f'https://www.cve.org/cverecord?id={additional_cve_id}'

# Set the Google Group URL specific to this CVE
Copy link
Member

@mtardy mtardy Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please do not add unnecessary comments on un-related lines to your changes

sig-security-tooling/cve-feed/hack/fetch-official-cve-feed.py Outdated
Comment on lines +135 to +152
# --- Add OSV data for the additional CVE ---
# Initialize the OSV field as None in case no JSON exists
additional_cve['_kubernetes_io']['osv'] = None

# Construct the URL to fetch the OSV JSON from the official repository
additional_osv_url = f'https://raw.githubusercontent.com/kubernetes-sigs/cve-feed-osv/main/vulns/{additional_cve_id}.json'

try:
# Attempt to fetch the OSV JSON with a 5-second timeout
res_additional_osv = requests.get(additional_osv_url, timeout=5)

# If the file exists, parse it as JSON and store it in the 'osv' field
if res_additional_osv.status_code == 200:
additional_cve['_kubernetes_io']['osv'] = res_additional_osv.json()

except requests.RequestException:
# If any network error occurs (timeout, connection issue, etc.), keep 'osv' as None
additional_cve['_kubernetes_io']['osv'] = None
Copy link
Member

@mtardy mtardy Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you reuse that code with a function instead of duplicating?

sig-security-tooling/cve-feed/hack/fetch-official-cve-feed.py
if not body:
return None

match = re.search(r"```json\s*(\{.*?\})\s*```", body, re.DOTALL)
Copy link
Member

@mtardy mtardy Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please match the full "```json osv" because the "```json" can appear in different places in the issue if any json blob is included.

@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Mar 11, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Pnkcaht
Once this PR has been reviewed and has the lgtm label, please ask for approval from mtardy. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@mtardy
Copy link
Member

mtardy commented Mar 11, 2026

/hold until we fix the patches

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 11, 2026
@mtardy
Copy link
Member

mtardy commented Mar 11, 2026

I picked 2 different CVEs to do the test, in which the first one is related to the correct error, that is, a null return for an expected pattern.The second one is based on the correct pattern related to a CVE with the public OSV.

Also by the way, could you add actual tests that indeed for one coming from the OSV feed repo you have a not null OSV value, and the same from the body of an issue.

@PushkarJ
Copy link
Member

PushkarJ commented Mar 11, 2026

@mtardy many of the PR suggestions should be fixed in my follow up PR: #183

I opened this one myself instead of getting those changes in as PR review feedback and delaying the PR merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cailyn-codes cailyn-codes Awaiting requested review from cailyn-codes

@tabbysable tabbysable Awaiting requested review from tabbysable

1 more reviewer

@mtardy mtardy mtardy requested changes

Reviewers whose approvals may not affect merge requirements

Assignees

@mtardy mtardy

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. sig/security Categorizes an issue or PR as relevant to SIG Security. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.

Projects

None yet

Milestone

No milestone

4 participants

@Pnkcaht @k8s-ci-robot @PushkarJ @mtardy