sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(cve): match the CODESYS runtime against NVD by CPE #180

Merged
sharang merged 1 commits from feat/codesys-cve-nvd into main 2026-07-16 20:10:20 +00:00
Conversation 0 Commits 1 Files Changed 2
+296 -1
1 Commits
Author SHA1 Message Date
Sharang ParnerkarandClaude Opus 4.8 6006c14f99 feat(cve): match the CODESYS runtime against NVD by CPE
CI / Check (pull_request) Successful in 5m20s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details 
OSV-by-purl can't match `pkg:codesys/*` (OSV has no codesys ecosystem), so the
CODESYS control-app SBOM produced zero CVE alerts even when the runtime was
affected — "No CVE alerts" read as safe when it just meant "not checked" (found
live during the demo).

Add CveScanner::scan_codesys: find the CODESYS **runtime** component (the version
advisories key off), pull `cpe:2.3:a:codesys:*` CVEs from NVD, and keep the ones
whose affected-version range (versionStart/End Including/Excluding, or an exact
CPE version) covers the runtime version. Wired into persist_control_app_sbom
alongside the OSV scan (best-effort, timeout-bounded).

Pure logic unit-tested (runtime detection, dotted-version compare, CPE range
matching, NVD-config parsing against a fixture): a 4.17.0.0 runtime matches a
`<=4.20` CVE but not an old `<4.9` one.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-16 22:04:23 +02:00