sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(cve): match the CODESYS runtime against NVD by CPE #180

Merged
sharang merged 1 commits from feat/codesys-cve-nvd into main 2026-07-16 20:10:20 +00:00
Conversation 0 Commits 1 Files Changed 2
+296 -1
sharang commented 2026-07-16 20:04:25 +00:00
Owner
Copy Link
Copy Source

Demo follow-up (the "No CVE alerts" finding). OSV-by-purl can't match pkg:codesys/*, and CODESYS advisories live in NVD keyed by CPE + runtime version. Adds scan_codesys: find the runtime component, pull cpe:2.3:a:codesys:* CVEs from NVD, keep those whose affected-version range covers the runtime version. Wired into persist_control_app_sbom (best-effort, timeout-bounded). Pure logic unit-tested against an NVD fixture (4.17.0.0 matches <=4.20, not <4.9). Tracker #167.

🤖 Generated with Claude Code

Demo follow-up (the "No CVE alerts" finding). OSV-by-purl can't match `pkg:codesys/*`, and CODESYS advisories live in **NVD keyed by CPE + runtime version**. Adds `scan_codesys`: find the runtime component, pull `cpe:2.3:a:codesys:*` CVEs from NVD, keep those whose affected-version range covers the runtime version. Wired into `persist_control_app_sbom` (best-effort, timeout-bounded). Pure logic unit-tested against an NVD fixture (4.17.0.0 matches `<=4.20`, not `<4.9`). Tracker #167. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
sharang added 1 commit 2026-07-16 20:04:25 +00:00
feat(cve): match the CODESYS runtime against NVD by CPE
CI / Check (pull_request) Successful in 5m20s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details
6006c14f99 
OSV-by-purl can't match `pkg:codesys/*` (OSV has no codesys ecosystem), so the
CODESYS control-app SBOM produced zero CVE alerts even when the runtime was
affected — "No CVE alerts" read as safe when it just meant "not checked" (found
live during the demo).

Add CveScanner::scan_codesys: find the CODESYS **runtime** component (the version
advisories key off), pull `cpe:2.3:a:codesys:*` CVEs from NVD, and keep the ones
whose affected-version range (versionStart/End Including/Excluding, or an exact
CPE version) covers the runtime version. Wired into persist_control_app_sbom
alongside the OSV scan (best-effort, timeout-bounded).

Pure logic unit-tested (runtime detection, dotted-version compare, CPE range
matching, NVD-config parsing against a fixture): a 4.17.0.0 runtime matches a
`<=4.20` CVE but not an old `<4.9` one.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sharang merged commit 097f86243e into main 2026-07-16 20:10:20 +00:00
sharang deleted branch feat/codesys-cve-nvd 2026-07-16 20:10:20 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#180