The Trials and Tribulations of Bulk Converting CVEs to OSV
summary
Describes an automated pipeline that pulls NVD CVE data, maps CPE vendor:product pairs to git repos, fuzzily matches version numbers to git tags and commits, and clones repos to enumerate affected commits; maintains an ever‑growing denylist of misleading repos and uses tag-to-commit heuristics and API lookups when available. Precomputation covers about ~10,000 CPE vendor-product combos mapping to roughly 9,000 repositories, yielding a high 60s% conversion rate so far and ongoing validation work.
AI-written summary · about
chapters (23)
- 0:00Bulk CVE to OSV conversion
- 1:24CVE program needs programmatic records
- 6:45Andrew’s background and OSV overview
- 8:14OSV mission and value
- 13:57OSV.dev infrastructure and data flow
- 14:39Challenges in C/C++ CVE conversion
- 21:22Mapping versions to Git commits
- 24:38Conversion success rates and metrics
- 25:40Improving CVE and OSV interoperability
- 27:25Bright spots in CVE record quality
- 28:50Consistent CVE record quality matters
- 29:53OSV 2024 data quality improvements
- 31:42Q&A
- 32:02Handling CVEs without NVD enrichment
- 33:28Extending OSV beyond open source
- 34:57Multiple canonical repositories
- 36:44CVEs without official IDs
- 39:56Opinion on CAF
- 41:49Mapping Git commits to C/C++ packages
- 43:12Incentivizing CNAs for metadata
- 47:24Support for non-Git version control
- 50:07OpenVEX interoperability plans
- 51:34Kubernetes and OSV adoption
related talks
55mLet’s Talk About Fitness for Purpose: Comparing and Contrasting the CVE List with OSV.dev
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
33mWhere is my Code Vulnerable: Matching CVEs and Source Code
30mThe National Vulnerability Database (NVD) – Where It Is and Where It’s Going
26mConfig Based CVE Matching for Linux Kernel
35mVulnrichment Playground
26mEffective Software Supply Chain Monitoring
25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities