{"uuid": "828113b1-d882-47cd-acdf-3523476bcd17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23017", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/48bd70943efcecb8cc7f37c349f02ea8", "content": "diff --git a/config.toml.sample b/config.toml.sample\nnew file mode 100644\nindex 0000000..c874e4b\n--- /dev/null\n+++ b/config.toml.sample\n@@ -0,0 +1,69 @@\n+# Scanner configuration for this checkout.\n+\n+[default]\n+port     = \"22\"\n+user     = \"vulsscan\"\n+keyPath  = \"/home/vuls/.ssh/id_rsa\"\n+scanMode = [\"fast-root\"]\n+\n+[cveDict]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/cve.sqlite3\"\n+\n+[ovalDict]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/oval.sqlite3\"\n+\n+[gost]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/gost.sqlite3\"\n+\n+[exploit]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/go-msfdb.sqlite3\"\n+\n+[servers]\n+\n+[servers.app-stg-01]\n+host        = \"10.20.0.11\"\n+family      = \"ubuntu\"\n+release     = \"20.04\"\n+scanModules = [\"ospkg\", \"lockfile\"]\n+\n+[servers.db-stg-02]\n+host        = \"10.20.0.12\"\n+family      = \"centos\"\n+release     = \"7.9.2009\"\n+scanModules = [\"ospkg\"]\n+\n+[servers.edge-stg-03]\n+host        = \"10.20.0.13\"\n+family      = \"debian\"\n+release     = \"10.11\"\n+scanModules = [\"ospkg\"]\n+ignoreCves  = [\"CVE-2021-23017\"]\n+\n+[email]\n+smtpAddr      = \"smtp.internal.example\"\n+smtpPort      = \"587\"\n+from          = \"vuls@internal.example\"\n+to            = [\"infra@internal.example\"]\n+cc            = [\"ryo.tanaka@internal.example\"]\n+subjectPrefix = \"[vuls]\"\n+\n+[slack]\n+hookURL      = \"https://hooks.slack.com/services/...\"\n+channel      = \"#vuls-prod\"\n+authUser     = \"vuls-bot\"\n+notifyUsers  = [\"@ryo\"]\n+token        = \"xoxb-...\"\n+\n+[servers.prod-scan-01]\n+host        = \"10.20.0.14\"\n+user        = \"vulsscan\"\n+password    = \"...\"\n+scanModules = [\"ospkg\"]\ndiff --git a/detector/detector.go b/detector/detector.go\nindex 1fd7cef..3f902f0 100644\n--- a/detector/detector.go\n+++ b/detector/detector.go\n@@ -420,15 +420,22 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD\n \t\t\treturn err\n \t\t}\n \t\tfor _, detail := range details {\n+\t\t\tconfidence := models.CpeVersionMatch\n+\t\t\tif detail.Jvn != nil && detail.NvdJSON == nil {\n+\t\t\t\tconfidence = models.CpeVendorProductMatch\n+\t\t\t} else if detail.Jvn != nil {\n+\t\t\t\tconfidence = models.CpeVendorProductMatch\n+\t\t\t}\n+\n \t\t\tif val, ok := r.ScannedCves[detail.CveID]; ok {\n \t\t\t\tval.CpeURIs = util.AppendIfMissing(val.CpeURIs, name)\n-\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\tval.Confidences.AppendIfMissing(confidence)\n \t\t\t\tr.ScannedCves[detail.CveID] = val\n \t\t\t} else {\n \t\t\t\tv := models.VulnInfo{\n \t\t\t\t\tCveID:       detail.CveID,\n \t\t\t\t\tCpeURIs:     []string{name},\n-\t\t\t\t\tConfidences: models.Confidences{models.CpeVersionMatch},\n+\t\t\t\t\tConfidences: models.Confidences{confidence},\n \t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = v\n \t\t\t\tnCVEs++\ndiff --git a/docs/dev/queue/0006-tui-column-width.patch b/docs/dev/queue/0006-tui-column-width.patch\ndeleted file mode 100644\nindex 98d38dc..0000000\n--- a/docs/dev/queue/0006-tui-column-width.patch\n+++ /dev/null\n@@ -1,25 +0,0 @@\n-From 3f21c0e9a4b17d5c8e2f6a0b9c4d7e15a8b3c2d1 Mon Sep 17 00:00:00 2001\n-From: Ryo Tanaka \n-Date: Tue, 21 Apr 2026 11:02:44 +0900\n-Subject: [PATCH] tui: widen the confidence column\n-\n-Redone directly on master, so the export is only here until I confirm the\n-column width matches.\n----\n- tui/tui.go | 2 +-\n- 1 file changed, 1 insertion(+), 1 deletion(-)\n-\n-diff --git a/tui/tui.go b/tui/tui.go\n-index 684157e..0a1b2c3 100644\n---- a/tui/tui.go\n-+++ b/tui/tui.go\n-@@ -102,7 +102,7 @@ func setLayout(g *gocui.Gui) error {\n- \tmaxX, maxY := g.Size()\n--\tif _, err := g.SetView(\"side\", 0, 0, int(0.2*float32(maxX)), maxY-2); err != nil {\n-+\tif _, err := g.SetView(\"side\", 0, 0, int(0.25*float32(maxX)), maxY-2); err != nil {\n- \t\tif err != gocui.ErrUnknownView {\n- \t\t\treturn err\n- \t\t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/scratch-notes.md b/docs/dev/scratch-notes.md\ndeleted file mode 100644\nindex a7aa8e9..0000000\n--- a/docs/dev/scratch-notes.md\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-# Scratch\n-\n-- check whether the TUI wraps long confidence strings\n-- ask about the redis settings in integration/\n-- (old) chase the goreleaser warning, sorted itself out\ndiff --git a/results/2026-02-11_adhoc/localhost.json b/results/2026-02-11_adhoc/localhost.json\ndeleted file mode 100644\nindex 616e648..0000000\n--- a/results/2026-02-11_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"4c7e1b90-8d23-4f6a-ae15-93b0d2c74f81\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-02-11T16:41:52.907333Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-03-02_adhoc/localhost.json b/results/2026-03-02_adhoc/localhost.json\ndeleted file mode 100644\nindex 14b5cbe..0000000\n--- a/results/2026-03-02_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"0a5f3c2e-11d4-4a90-b7e6-c8f2a4d31905\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-03-02T09:14:05.221964Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-04-03_adhoc/app-stg-01.json b/results/2026-04-03_adhoc/app-stg-01.json\ndeleted file mode 100644\nindex 2800c01..0000000\n--- a/results/2026-04-03_adhoc/app-stg-01.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-04-03T07:05:19.660412Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 684157e..db8d4d8 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -1014,7 +1014,7 @@ CWE\n Confidence\n -----------\n {{range $confidence := .Confidences -}}\n-* {{$confidence.DetectionMethod}}\n+* {{$confidence.Score}} / {{$confidence.DetectionMethod}}\n {{end}}\n References\n -----------\n", "creation_timestamp": "2026-07-24T23:24:28.167644Z"}