From 58c3b43e418c3ae51a07cb0cdb5954c5bc8b4f02 Mon Sep 17 00:00:00 2001 From: Eshaan Date: Fri, 19 Dec 2025 19:45:52 +1100 Subject: [PATCH] Fix case-sensitive file collision by removing triage.json Resolves #5437 - Verified TRIAGE.json and triage.json are identical (no merge needed) - Deleted triage.json to resolve case-sensitivity issues on Windows - Updated test/test_requirements.py to reference TRIAGE.json - Confirmed no GitHub Actions workflows reference triage.json Signed-off-by: Eshaan --- test/test_requirements.py | 2 +- triage.json | 462 -------------------------------------- 2 files changed, 1 insertion(+), 463 deletions(-) delete mode 100644 triage.json diff --git a/test/test_requirements.py b/test/test_requirements.py index e3d287051f..57d348ccf4 100644 --- a/test/test_requirements.py +++ b/test/test_requirements.py @@ -14,7 +14,7 @@ REQ_TXT = str(ROOT_PATH / "requirements.txt") REQ_CSV = str(ROOT_PATH / "requirements.csv") -TRIAGE_JSON = str(ROOT_PATH / "triage.json") +TRIAGE_JSON = str(ROOT_PATH / "TRIAGE.json") OUTPUT_JSON = str(TEMP_DIR / "output.json") # the output is a temp file DOC_TXT = str(ROOT_PATH / "doc" / "requirements.txt") DOC_CSV = str(ROOT_PATH / "doc" / "requirements.csv") diff --git a/triage.json b/triage.json deleted file mode 100644 index 2f4a6976cf..0000000000 --- a/triage.json +++ /dev/null @@ -1,462 +0,0 @@ -{ - "bomFormat": "CycloneDX", - "specVersion": "1.4", - "version": 1, - "vulnerabilities": [ - { - "id": "CVE-2019-11922", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11922" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2019-11922&vector=CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1" - }, - "score": 8.1, - "severity": "high", - "method": "CVSSv3", - "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "description": "A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "false positive because the python API for zstandard has lower version numbers than the main zstandard library" - }, - "affects": [ - { - "ref": "urn:cbt:1/facebook#zstandard:0.22.0" - } - ] - }, - { - "id": "CVE-2021-24031", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24031" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2021-24031&vector=CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N&version=3.1" - }, - "score": 5.5, - "severity": "medium", - "method": "CVSSv3", - "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" - } - ], - "description": "In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "false positive because the python API for zstandard has lower version numbers than the main zstandard library" - }, - "affects": [ - { - "ref": "urn:cbt:1/facebook#zstandard:0.22.0" - } - ] - }, - { - "id": "CVE-2023-49092", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49092" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-49092&vector=CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1" - }, - "score": 5.9, - "severity": "medium", - "method": "CVSSv3", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ], - "description": "RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer.", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "RSA detected is rust library." - }, - "affects": [ - { - "ref": "urn:cbt:1/rustcrypto#rsa:4.7.2" - } - ] - }, - { - "id": "GHSA-h588-76vg-prgj", - "source": { - "name": "OSV", - "url": "https://osv.dev/list?ecosystem=&q=GHSA-h588-76vg-prgj" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=GHSA-h588-76vg-prgj&vector=unknown&version=2.0" - }, - "score": "unknown", - "severity": "unknown", - "method": "CVSSvunknown", - "vector": "unknown" - } - ], - "description": "`DecimalArray` does not perform bound checks on accessing values and offsets", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "arrow is reporting CVEs found for another product named arrow" - }, - "affects": [ - { - "ref": "urn:cbt:1/unknown#arrow:1.2.3" - } - ] - }, - { - "id": "GHSA-qgrp-8f3v-q85p", - "source": { - "name": "OSV", - "url": "https://osv.dev/list?ecosystem=&q=GHSA-qgrp-8f3v-q85p" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=GHSA-qgrp-8f3v-q85p&vector=unknown&version=2.0" - }, - "score": "unknown", - "severity": "unknown", - "method": "CVSSvunknown", - "vector": "unknown" - } - ], - "description": "`FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "arrow is reporting CVEs found for another product named arrow" - }, - "affects": [ - { - "ref": "urn:cbt:1/unknown#arrow:1.2.3" - } - ] - }, - { - "id": "GHSA-r7cj-wmwv-hfw5", - "source": { - "name": "OSV", - "url": "https://osv.dev/list?ecosystem=&q=GHSA-r7cj-wmwv-hfw5" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=GHSA-r7cj-wmwv-hfw5&vector=unknown&version=2.0" - }, - "score": "unknown", - "severity": "unknown", - "method": "CVSSvunknown", - "vector": "unknown" - } - ], - "description": "`BinaryArray` does not perform bound checks on reading values and offsets", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "arrow is reporting CVEs found for another product named arrow" - }, - "affects": [ - { - "ref": "urn:cbt:1/unknown#arrow:1.2.3" - } - ] - }, - { - "id": "RUSTSEC-2021-0116", - "source": { - "name": "OSV", - "url": "https://osv.dev/list?ecosystem=&q=RUSTSEC-2021-0116" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=RUSTSEC-2021-0116&vector=unknown&version=2.0" - }, - "score": "unknown", - "severity": "unknown", - "method": "CVSSvunknown", - "vector": "unknown" - } - ], - "description": "`BinaryArray` does not perform bound checks on reading values and offsets", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "arrow is reporting CVEs found for another product named arrow" - }, - "affects": [ - { - "ref": "urn:cbt:1/unknown#arrow:1.2.3" - } - ] - }, - { - "id": "RUSTSEC-2021-0117", - "source": { - "name": "OSV", - "url": "https://osv.dev/list?ecosystem=&q=RUSTSEC-2021-0117" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=RUSTSEC-2021-0117&vector=unknown&version=2.0" - }, - "score": "unknown", - "severity": "unknown", - "method": "CVSSvunknown", - "vector": "unknown" - } - ], - "description": "`DecimalArray` does not perform bound checks on accessing values and offsets", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "arrow is reporting CVEs found for another product named arrow" - }, - "affects": [ - { - "ref": "urn:cbt:1/unknown#arrow:1.2.3" - } - ] - }, - { - "id": "RUSTSEC-2021-0118", - "source": { - "name": "OSV", - "url": "https://osv.dev/list?ecosystem=&q=RUSTSEC-2021-0118" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=RUSTSEC-2021-0118&vector=unknown&version=2.0" - }, - "score": "unknown", - "severity": "unknown", - "method": "CVSSvunknown", - "vector": "unknown" - } - ], - "description": "`FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "arrow is reporting CVEs found for another product named arrow" - }, - "affects": [ - { - "ref": "urn:cbt:1/unknown#arrow:1.2.3" - } - ] - }, - { - "id": "CVE-2022-42969", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42969" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-42969&vector=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1" - }, - "score": 7.5, - "severity": "high", - "method": "CVSSv3", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "description": "The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "in_triage", - "response": [], - "detail": "NewFound" - }, - "affects": [ - { - "ref": "urn:cbt:1/pytest#py:1.11.0" - } - ] - }, - { - "id": "CVE-2022-42969", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42969" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-42969&vector=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1" - }, - "score": 7.5, - "severity": "high", - "method": "CVSSv3", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "description": "The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "in_triage", - "response": [], - "detail": "NewFound" - }, - "affects": [ - { - "ref": "urn:cbt:1/unknown#py:1.11.0" - } - ] - }, - { - "id": "CVE-2022-23602", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23602" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-23602&vector=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N&version=3.1" - }, - "score": 8.1, - "severity": "high", - "method": "CVSSv3", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" - } - ], - "description": "Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include referencing a file local to the host operating system. Nimforum will render the file if able. This can also be done silently by using NimForum's post \"preview\" endpoint. Even if NimForum is running as a non-critical user, the forum.json secrets can be stolen. Version 2.2.0 of NimForum includes patches for this vulnerability. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "false_positive", - "response": [], - "detail": "docutils is reporting CVEs found for another product with the same name" - }, - "affects": [ - { - "ref": "urn:cbt:1/nim-lang#docutils:0.20.1" - } - ] - }, - { - "id": "CVE-2020-28463", - "source": { - "name": "OSV", - "url": "https://osv.dev/list?ecosystem=&q=CVE-2020-28463" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-28463&vector=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N&version=3.1" - }, - "score": 6.5, - "severity": "medium", - "method": "CVSSv3", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" - } - ], - "description": "Server-side Request Forgery (SSRF) via img tags in reportlab", - "recommendation": "", - "advisories": [], - "created": "NOT_KNOWN", - "published": "NOT_KNOWN", - "updated": "", - "analysis": { - "state": "not_affected", - "response": [], - "detail": "Applied the appropriate mitigations to avoid malicious images" - }, - "affects": [ - { - "ref": "urn:cbt:1/reportlab#reportlab:4.1.0" - } - ] - } - ] -} \ No newline at end of file