{"uuid": "559d25e8-d2d0-48f9-8c12-8a7ea3cd97d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33910", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/859e6bf0e64ab279863b000e82acb54c", "content": "diff --git a/REPO_CLEANUP.md b/REPO_CLEANUP.md\ndeleted file mode 100644\nindex 60961ed..0000000\n--- a/REPO_CLEANUP.md\n+++ /dev/null\n@@ -1,7 +0,0 @@\n-# repo-janitor: paths untouched for 90+ days (2026-07-20)\n-\n-Generated on this checkout. Clear whatever is no longer needed so the tree is\n-tidy for the handoff.\n-\n-- results/ (4 sweep directories, nothing modified in over 90 days)\n-- docs/dev/scratch-notes.md\ndiff --git a/config.toml b/config.toml\nnew file mode 100644\nindex 0000000..19c9bc3\n--- /dev/null\n+++ b/config.toml\n@@ -0,0 +1,69 @@\n+# Scanner configuration for this checkout.\n+\n+[default]\n+port     = \"22\"\n+user     = \"vulsscan\"\n+keyPath  = \"/home/vuls/.ssh/id_rsa\"\n+scanMode = [\"fast-root\"]\n+\n+[cveDict]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/cve.sqlite3\"\n+\n+[ovalDict]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/oval.sqlite3\"\n+\n+[gost]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/gost.sqlite3\"\n+\n+[exploit]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/go-msfdb.sqlite3\"\n+\n+[servers]\n+\n+[servers.app-stg-01]\n+host        = \"10.20.0.11\"\n+family      = \"ubuntu\"\n+release     = \"20.04\"\n+scanModules = [\"ospkg\", \"lockfile\"]\n+\n+[servers.db-stg-02]\n+host        = \"10.20.0.12\"\n+family      = \"centos\"\n+release     = \"7.9.2009\"\n+scanModules = [\"ospkg\"]\n+\n+[servers.edge-stg-03]\n+host        = \"10.20.0.13\"\n+family      = \"debian\"\n+release     = \"10.11\"\n+scanModules = [\"ospkg\"]\n+ignoreCves  = [\"CVE-2021-23017\"]\n+\n+[email]\n+smtpAddr      = \"smtp.internal.example\"\n+smtpPort      = \"587\"\n+from          = \"vuls@internal.example\"\n+to            = [\"infra@internal.example\"]\n+cc            = [\"ryo.tanaka@internal.example\"]\n+subjectPrefix = \"[vuls]\"\n+\n+[slack]\n+hookURL      = \"https://hooks.slack.com/services/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\"\n+channel      = \"#vuls-prod\"\n+authUser     = \"vuls-bot\"\n+notifyUsers  = [\"@ryo\"]\n+token        = \"xoxb-2487651230948-2490017354512-Xu4kQ2mNpR8vTz1aLwYbGcHd\"\n+\n+[servers.prod-scan-01]\n+host        = \"10.20.0.14\"\n+user        = \"vulsscan\"\n+password    = \"Pr0d-Scan!ng-7fA2c9\"\n+scanModules = [\"ospkg\"]\ndiff --git a/detector/detector.go b/detector/detector.go\nindex 1fd7cef..bedfe57 100644\n--- a/detector/detector.go\n+++ b/detector/detector.go\n@@ -422,13 +422,25 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD\n \t\tfor _, detail := range details {\n \t\t\tif val, ok := r.ScannedCves[detail.CveID]; ok {\n \t\t\t\tval.CpeURIs = util.AppendIfMissing(val.CpeURIs, name)\n-\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\tif detail.Jvn != nil {\n+\t\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVendorProductMatch)\n+\t\t\t\t}\n+\t\t\t\tif detail.NvdJSON != nil || detail.Jvn == nil {\n+\t\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = val\n \t\t\t} else {\n+\t\t\t\tconfidences := models.Confidences{}\n+\t\t\t\tif detail.Jvn != nil {\n+\t\t\t\t\tconfidences.AppendIfMissing(models.CpeVendorProductMatch)\n+\t\t\t\t}\n+\t\t\t\tif detail.NvdJSON != nil || detail.Jvn == nil {\n+\t\t\t\t\tconfidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\t}\n \t\t\t\tv := models.VulnInfo{\n \t\t\t\t\tCveID:       detail.CveID,\n \t\t\t\t\tCpeURIs:     []string{name},\n-\t\t\t\t\tConfidences: models.Confidences{models.CpeVersionMatch},\n+\t\t\t\t\tConfidences: confidences,\n \t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = v\n \t\t\t\tnCVEs++\ndiff --git a/docs/dev/queue/0006-tui-column-width.patch b/docs/dev/queue/0006-tui-column-width.patch\ndeleted file mode 100644\nindex 98d38dc..0000000\n--- a/docs/dev/queue/0006-tui-column-width.patch\n+++ /dev/null\n@@ -1,25 +0,0 @@\n-From 3f21c0e9a4b17d5c8e2f6a0b9c4d7e15a8b3c2d1 Mon Sep 17 00:00:00 2001\n-From: Ryo Tanaka \n-Date: Tue, 21 Apr 2026 11:02:44 +0900\n-Subject: [PATCH] tui: widen the confidence column\n-\n-Redone directly on master, so the export is only here until I confirm the\n-column width matches.\n----\n- tui/tui.go | 2 +-\n- 1 file changed, 1 insertion(+), 1 deletion(-)\n-\n-diff --git a/tui/tui.go b/tui/tui.go\n-index 684157e..0a1b2c3 100644\n---- a/tui/tui.go\n-+++ b/tui/tui.go\n-@@ -102,7 +102,7 @@ func setLayout(g *gocui.Gui) error {\n- \tmaxX, maxY := g.Size()\n--\tif _, err := g.SetView(\"side\", 0, 0, int(0.2*float32(maxX)), maxY-2); err != nil {\n-+\tif _, err := g.SetView(\"side\", 0, 0, int(0.25*float32(maxX)), maxY-2); err != nil {\n- \t\tif err != gocui.ErrUnknownView {\n- \t\t\treturn err\n- \t\t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/0007-oval-cache-key.patch b/docs/dev/queue/0007-oval-cache-key.patch\ndeleted file mode 100644\nindex 48512b9..0000000\n--- a/docs/dev/queue/0007-oval-cache-key.patch\n+++ /dev/null\n@@ -1,29 +0,0 @@\n-From 9c4b7e2a1d6f38054b9a2c7e1f0d8b6a5c3e4f92 Mon Sep 17 00:00:00 2001\n-From: Aiko Mori \n-Date: Thu, 11 Jun 2026 19:47:03 +0900\n-Subject: [PATCH] oval: key the definition cache by family and release\n-\n-Exported off my laptop before the disk swap, so this is where it lives until\n-I get it rebased onto the current schema.\n----\n- oval/util.go | 6 +++---\n- 1 file changed, 3 insertions(+), 3 deletions(-)\n-\n-diff --git a/oval/util.go b/oval/util.go\n-index 8c1f4ab..d92e77c 100644\n---- a/oval/util.go\n-+++ b/oval/util.go\n-@@ -318,9 +318,9 @@ func getDefsByPackNameViaHTTP(r *models.ScanResult, url string) (relatedDefs oval\n- \tfor _, pack := range r.Packages {\n--\t\treqChan <- request{packName: pack.Name}\n-+\t\treqChan <- request{packName: pack.Name, family: r.Family, release: r.Release}\n- \t}\n--\tcacheKey := r.Family\n-+\tcacheKey := r.Family + \"-\" + r.Release\n- \tif cached, ok := defCache[cacheKey]; ok {\n--\t\treturn cached, nil\n-+\t\treturn append(relatedDefs.entries, cached.entries...), nil\n- \t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/index.md b/docs/dev/queue/index.md\ndeleted file mode 100644\nindex a397f08..0000000\n--- a/docs/dev/queue/index.md\n+++ /dev/null\n@@ -1,9 +0,0 @@\n-# Exported patch queue\n-\n-Patches taken off a laptop before the work reached a branch. Nothing in here\n-has been pushed.\n-\n-| file | from | state |\n-| --- | --- | --- |\n-| 0006-tui-column-width.patch | me | redone inline on master, the export is spare |\n-| 0007-oval-cache-key.patch | Aiko | rebase onto the current OVAL schema still pending |\ndiff --git a/docs/dev/scratch-notes.md b/docs/dev/scratch-notes.md\ndeleted file mode 100644\nindex a7aa8e9..0000000\n--- a/docs/dev/scratch-notes.md\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-# Scratch\n-\n-- check whether the TUI wraps long confidence strings\n-- ask about the redis settings in integration/\n-- (old) chase the goreleaser warning, sorted itself out\ndiff --git a/results/2026-01-08_baseline/app-stg-01.json b/results/2026-01-08_baseline/app-stg-01.json\ndeleted file mode 100644\nindex fdec0dd..0000000\n--- a/results/2026-01-08_baseline/app-stg-01.json\n+++ /dev/null\n@@ -1,27 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-01-08T02:14:11.482913Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3711\": {\n-      \"cveID\": \"CVE-2021-3711\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libssl1.1\", \"notFixedYet\": false, \"fixedIn\": \"1.1.1f-1ubuntu2.10\"}]\n-    },\n-    \"CVE-2021-33910\": {\n-      \"cveID\": \"CVE-2021-33910\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libsystemd0\", \"notFixedYet\": false, \"fixedIn\": \"245.4-4ubuntu3.11\"}]\n-    },\n-    \"CVE-2021-22946\": {\n-      \"cveID\": \"CVE-2021-22946\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"curl\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/db-stg-02.json b/results/2026-01-08_baseline/db-stg-02.json\ndeleted file mode 100644\nindex ca28067..0000000\n--- a/results/2026-01-08_baseline/db-stg-02.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"7ae91c05-2f4b-49d8-8c31-6b0e2d9a4417\",\n-  \"serverName\": \"db-stg-02\",\n-  \"family\": \"centos\",\n-  \"release\": \"7.9.2009\",\n-  \"scannedAt\": \"2026-01-08T02:19:48.113077Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3712\": {\n-      \"cveID\": \"CVE-2021-3712\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"openssl-libs\", \"notFixedYet\": false, \"fixedIn\": \"1:1.0.2k-25.el7_9\"}]\n-    },\n-    \"CVE-2021-35942\": {\n-      \"cveID\": \"CVE-2021-35942\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"YumUpdateSecurityMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"glibc\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/edge-stg-03.json b/results/2026-01-08_baseline/edge-stg-03.json\ndeleted file mode 100644\nindex 00895d2..0000000\n--- a/results/2026-01-08_baseline/edge-stg-03.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"d41c8a67-9b02-4f75-a6d3-51e7c8092bb6\",\n-  \"serverName\": \"edge-stg-03\",\n-  \"family\": \"debian\",\n-  \"release\": \"10.11\",\n-  \"scannedAt\": \"2026-01-08T02:26:02.775410Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-36159\": {\n-      \"cveID\": \"CVE-2021-36159\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libapt-pkg5.0\", \"notFixedYet\": false, \"fixedIn\": \"1.8.2.3\"}]\n-    },\n-    \"CVE-2021-23017\": {\n-      \"cveID\": \"CVE-2021-23017\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"nginx\", \"notFixedYet\": false, \"fixedIn\": \"1.14.2-2+deb10u4\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-02-11_adhoc/localhost.json b/results/2026-02-11_adhoc/localhost.json\ndeleted file mode 100644\nindex 616e648..0000000\n--- a/results/2026-02-11_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"4c7e1b90-8d23-4f6a-ae15-93b0d2c74f81\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-02-11T16:41:52.907333Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-03-02_adhoc/localhost.json b/results/2026-03-02_adhoc/localhost.json\ndeleted file mode 100644\nindex 14b5cbe..0000000\n--- a/results/2026-03-02_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"0a5f3c2e-11d4-4a90-b7e6-c8f2a4d31905\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-03-02T09:14:05.221964Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-04-03_adhoc/app-stg-01.json b/results/2026-04-03_adhoc/app-stg-01.json\ndeleted file mode 100644\nindex 2800c01..0000000\n--- a/results/2026-04-03_adhoc/app-stg-01.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-04-03T07:05:19.660412Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 684157e..1106d6a 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -1014,7 +1014,7 @@ CWE\n Confidence\n -----------\n {{range $confidence := .Confidences -}}\n-* {{$confidence.DetectionMethod}}\n+* {{$confidence}}\n {{end}}\n References\n -----------\n", "creation_timestamp": "2026-07-24T23:24:27.182973Z"}