owasp-depscan 5.4.1__tar.gz → 5.4.3__tar.gz

{owasp_depscan-5.4.1/owasp_depscan.egg-info → owasp_depscan-5.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.4.1
+Version: 5.4.3
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.7.1
+Requires-Dist: appthreat-vulnerability-db==5.7.3
 Requires-Dist: defusedxml
 Requires-Dist: oras~=0.1.26
 Requires-Dist: PyYAML

{owasp_depscan-5.4.1 → owasp_depscan-5.4.3}/depscan/lib/analysis.py

@@ -398,8 +398,18 @@ def prepare_vdr(options: PrepareVdrOptions):
                 if not is_os_target_sw(package_issue):
                     fp_count += 1
                     continue
+            # Issue #320 - Malware matches without purl are false positives
+            if vid.startswith("MAL-"):
+                fp_count += 1
+                malicious_count -= 1
+                continue
         else:
             purl_obj = parse_purl(purl)
+            # Issue #320 - Malware matches without purl are false positives
+            if not purl_obj and vid.startswith("MAL-"):
+                fp_count += 1
+                malicious_count -= 1
+                continue
             if purl_obj:
                 version_used = purl_obj.get("version")
                 package_type = purl_obj.get("type")

{owasp_depscan-5.4.1 → owasp_depscan-5.4.3}/depscan/lib/normalize.py

@@ -54,6 +54,9 @@ def create_pkg_variations(pkg_dict):
             if purl_obj:
                 pkg_type = purl_obj.get("type")
                 qualifiers = purl_obj.get("qualifiers", {})
+                # Issue #320. Mandate version number for generic packages to reduce FPs
+                if pkg_type in ("generic",) and not purl_obj.get("version"):
+                    return None
                 if pkg_type in ("npm",):
                     # vendorless package could have npm as the vendor name from sources such as osv
                     # So we need 1 more alias

{owasp_depscan-5.4.1 → owasp_depscan-5.4.3/owasp_depscan.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.4.1
+Version: 5.4.3
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.7.1
+Requires-Dist: appthreat-vulnerability-db==5.7.3
 Requires-Dist: defusedxml
 Requires-Dist: oras~=0.1.26
 Requires-Dist: PyYAML

{owasp_depscan-5.4.1 → owasp_depscan-5.4.3}/owasp_depscan.egg-info/requires.txt

@@ -1,4 +1,4 @@
-appthreat-vulnerability-db==5.7.1
+appthreat-vulnerability-db==5.7.3
 defusedxml
 oras~=0.1.26
 PyYAML

{owasp_depscan-5.4.1 → owasp_depscan-5.4.3}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "owasp-depscan"
-version = "5.4.1"
+version = "5.4.3"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},
 ]
 dependencies = [
-    "appthreat-vulnerability-db==5.7.1",
+    "appthreat-vulnerability-db==5.7.3",
     "defusedxml",
     "oras~=0.1.26",
     "PyYAML",