Collapse OSV advisories that describe the same CVE - #23
Merged
Merged
Conversation
OSV returns one record per source, so every pgAdmin vulnerability arrives twice, once from the GitHub Advisory Database and once from the PyPA database, and the security page lists each of them twice: a query today returns 56 records for 28 CVEs, exactly doubled. The two carry the same summary, details and severity, so the merge keeps the GHSA record and drops the other. GHSA wins because GitHub assigns an advisory an identifier and keeps it, whereas the PYSEC identifiers for pgAdmin have all been reassigned within the past year for CVEs going back to 2022, and the identifier is what we upsert on. References and aliases are unioned rather than taken from the winner alone, since the discarded record links to a couple of places the other does not, and its identifier is how somebody searching for it still finds the advisory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two bugs in the OSV importer, both visible on https://www.pgadmin.org/security/ today.
Every advisory is listed twice. OSV returns one record per source, so each CVE arrives as both a GHSA and a PYSEC record: a query today returns 56 records for 28 CVEs, exactly doubled, and the live page shows all 56.
fetch_advisories()now collapses records sharing a CVE, keeping the GHSA one. That choice is not cosmetic: the identifier is whatfetch_pgadmin_cvesupserts on, and the PYSEC identifiers for pgAdmin have all been reassigned within the past year for CVEs going back to 2022, so keying on those would churn the table whenever that happens again. References and aliases are unioned rather than taken from the winner alone, so no link is lost and the dropped identifier still matches a search. Records with no CVE pass through untouched.Twenty of the twenty eight have no score. Every advisory published since the middle of 2026 carries both a CVSS 4.0 vector and a 3.1 one, and severity extraction deliberately took the highest version present. We cannot compute a 4.0 base score, its scoring being a lookup table rather than a formula and this module having no dependencies by design, so those advisories showed no score at all despite a perfectly scorable 3.1 vector sitting beside the one we kept. Worse, the page orders by base score, so the newest vulnerabilities sorted as though they were the least severe. The vector and the score now come from the same entry, the highest version that actually yields a number.
After deploying, run
./manage.py fetch_pgadmin_cves --pruneonce. The redundant rows are already in the database, and pruning is what removes them.Verified against the live OSV response: 56 records in, 28 out, no CVE appearing twice, every survivor a GHSA, references a superset of both sources, and every advisory now carrying a base score and a severity band.
No test is included because the repository has none and this did not seem the place to introduce the convention; happy to add
security/tests.pyif you would like one.