Skip to content

0.144.x Branch PR #311

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
karsten-klein wants to merge 6 commits into
base: master
Choose a base branch
from
Open

0.144.x Branch PR #311

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
57cf421
AE-1548: creating branch for further patches
karsten-klein Nov 19, 2025
903fbf7
AE-1548: Due to newly Introduced "CVSS Applicability Condition Attrib…
ThomasMartinMeta Nov 19, 2025
621534a
Small refactor
ThomasMartinMeta Nov 20, 2025
7e94c91
Merge pull request #312 from org-metaeffekt/0.144.x-AE-1548-cvss-appl…
karsten-klein Nov 20, 2025
e892a10
AE-1558 Prepare 0.144.3 RELEASE
karsten-klein Nov 21, 2025
27ca139
Post-release adjustments
karsten-klein Nov 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion inventory/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-plugin-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../poms/ae-core-plugin-management-pom</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion libraries/ae-common-kernel/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-libraries</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion libraries/ae-container-control/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-libraries</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion libraries/ae-inspect-reader/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-libraries</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion libraries/ae-inventory-processor/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-libraries</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
11 changes: 10 additions & 1 deletion ...ava/org/metaeffekt/core/inventory/processor/report/model/aeaa/AeaaInventoryAttribute.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@

import org.metaeffekt.core.inventory.processor.model.AbstractModelBase;
import org.metaeffekt.core.inventory.processor.report.model.aeaa.eol.export.AeaaExportedCycleState;
import org.metaeffekt.core.inventory.processor.report.model.aeaa.score.AeaaCvssConditionAttributes;

/**
* Mirrors structure of <code>com.metaeffekt.artifact.analysis.vulnerability.enrichment.AeaaInventoryAttribute</code>
Expand Down Expand Up @@ -100,7 +101,15 @@ public enum AeaaInventoryAttribute implements AbstractModelBase.Attribute {
ADVISOR_OSV_GHSA_REVIEWED_DATE("GHSA Reviewed Date"),
NVD_EQUIVALENT("NVD Equivalent"),
NVD_EQUIVALENT_ADVISORIES("NVD Equivalent Advisories"),
;
/**
* Stores a JSON Object of arbitrary data which may be used to evaluate the applicability condition of CVSS vectors in {@code com.metaeffekt.mirror.contents.vulnerability.Vulnerability.isCvssVectorApplicable()}.
* <p>
* Currently known uses of this are:
* <ul>
* <li> Stores the {@link AeaaInventoryAttribute#MS_PRODUCT_ID}s of referenced artifacts as a JSON Array using the {@link AeaaCvssConditionAttributes#MATCHES_ON_MS_PRODUCT_ID} key.</li>
* </ul>
*/
CVSS_APPLICABILITY_CONDITION_ATTRIBUTES("CVSS Applicability Condition Attributes");

private final String key;

Expand Down
30 changes: 22 additions & 8 deletions ...ain/java/org/metaeffekt/core/inventory/processor/report/model/aeaa/AeaaVulnerability.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -554,15 +554,23 @@ protected boolean isCvssVectorApplicable(JSONObject applicabilityCondition) {
final List<String> findMsProductIds = ((JSONArray) findMsProductIdsObj).toList().stream().map(String::valueOf).collect(Collectors.toList());
boolean foundMatchingArtifact = false;

for (Artifact artifact : this.getAffectedArtifactsByDefaultKey()) {
final String msProductId = artifact.get(AeaaInventoryAttribute.MS_PRODUCT_ID);
if (msProductId == null) {
continue;
}
final List<String> artifactMsProductIds = Arrays.asList(msProductId.split(", "));
if (artifactMsProductIds.stream().anyMatch(findMsProductIds::contains)) {
final JSONArray msCvssApplicabilityConditionAttributes = getAdditionalCvssApplicabilityConditionAttributes().optJSONArray(AeaaCvssConditionAttributes.MATCHES_ON_MS_PRODUCT_ID);
if (msCvssApplicabilityConditionAttributes != null) {
if (msCvssApplicabilityConditionAttributes.toList().stream().map(Object::toString).anyMatch(findMsProductIds::contains)) {
foundMatchingArtifact = true;
break;
}
}

if (!foundMatchingArtifact) {
for (Artifact artifact : this.getAffectedArtifactsByDefaultKey()) {
String data = artifact.get(AeaaInventoryAttribute.MS_PRODUCT_ID);

final Set<String> artifactMsProductIds = StringUtils.hasText(data) ? new HashSet<>(Arrays.asList(data.split(", ?"))) : new HashSet<>();

if (artifactMsProductIds.stream().anyMatch(findMsProductIds::contains)) {
foundMatchingArtifact = true;
break;
}
}
}

Expand All @@ -578,6 +586,12 @@ protected boolean isCvssVectorApplicable(JSONObject applicabilityCondition) {
return true;
}

public JSONObject getAdditionalCvssApplicabilityConditionAttributes() {
final String cvssConditions = this.getAdditionalAttribute(AeaaInventoryAttribute.CVSS_APPLICABILITY_CONDITION_ATTRIBUTES);
if (StringUtils.isEmpty(cvssConditions)) return new JSONObject();
return new JSONObject(cvssConditions);
}

public CvssSelectionResult selectEffectiveCvssVectors(CvssVectorSet cvssVectorSet, CvssSelector baseSelector, CvssSelector effectiveSelector, List<CvssScoreVersionSelectionPolicy> versionSelectionPolicy) {
return new CvssSelectionResult(
cvssVectorSet,
Expand Down
2 changes: 1 addition & 1 deletion libraries/ae-maven-kernel/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-libraries</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion libraries/ae-security/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-libraries</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion libraries/ae-system-analysis-scripts/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-libraries</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion libraries/ae-test-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-libraries</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
</parent>

<artifactId>ae-test-common</artifactId>
Expand Down
2 changes: 1 addition & 1 deletion libraries/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-plugin-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../poms/ae-core-plugin-management-pom</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion modules/ae-common-content/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-modules</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion modules/ae-commons-annotation/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-modules</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion modules/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-plugin-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../poms/ae-core-plugin-management-pom</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion plugins/ae-api-compile-maven-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-plugins</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion plugins/ae-api-publish-maven-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-plugins</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion plugins/ae-artifact-publish-maven-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-plugins</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion plugins/ae-dependency-analysis-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-plugins</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion plugins/ae-inventory-maven-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-plugins</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
4 changes: 2 additions & 2 deletions plugins/ae-inventory-maven-plugin/src/it/TestPomReport/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@
<groupId>org.metaeffekt.core</groupId>
<artifactId>test-pom-report</artifactId>
<name>${project.artifactId}</name>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<packaging>jar</packaging>

<properties>
<ae.core.version>0.144.2</ae.core.version>
<ae.core.version>0.144-SNAPSHOT</ae.core.version>
</properties>

<build>
Expand Down
2 changes: 1 addition & 1 deletion plugins/ae-jira-maven-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-plugins</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion plugins/ae-shell-script-assembler-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-plugins</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
</parent>

<artifactId>ae-shell-script-assembler-plugin</artifactId>
Expand Down
2 changes: 1 addition & 1 deletion plugins/ae-version-maven-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-plugins</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion plugins/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-plugin-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../poms/ae-core-plugin-management-pom</relativePath>
</parent>

Expand Down
4 changes: 2 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core</artifactId>
<name>metaeffekt-core</name>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<packaging>pom</packaging>

<description>Core project with fundamental runtime and build support.</description>
Expand Down Expand Up @@ -54,7 +54,7 @@

<ae.7zip.bundle.version>0.4.0</ae.7zip.bundle.version>

<ae.core.version>0.144.2</ae.core.version>
<ae.core.version>0.144-SNAPSHOT</ae.core.version>
<ae.core.version_last>${ae.core.version}</ae.core.version_last>

<artifact.inventory.version>${ae.core.version}</artifact.inventory.version>
Expand Down
2 changes: 1 addition & 1 deletion poms/ae-core-dependency-management-pom/ae-core-modules-dependency-management-pom/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-dependency-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion poms/ae-core-dependency-management-pom/ae-core-plugin-dependency-management-pom/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-dependency-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion poms/ae-core-dependency-management-pom/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-poms</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
4 changes: 2 additions & 2 deletions poms/ae-core-plugin-management-pom/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,14 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-poms</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

<properties>
<header.copyright.year>2024</header.copyright.year>

<ae.core.version>0.144.2</ae.core.version>
<ae.core.version>0.144-SNAPSHOT</ae.core.version>

<artifact.inventory.version>${ae.core.version}</artifact.inventory.version>
<artifact.inventory.enabled>true</artifact.inventory.enabled>
Expand Down
2 changes: 1 addition & 1 deletion poms/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion tests/ae-aggregate-sources-module/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-plugin-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../../poms/ae-core-plugin-management-pom</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion tests/ae-attach-asset-metadata-test/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-plugin-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../../poms/ae-core-plugin-management-pom</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion tests/ae-container-validation/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-plugin-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../../poms/ae-core-plugin-management-pom</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion tests/ae-example-module/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-plugin-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../../poms/ae-core-plugin-management-pom</relativePath>
</parent>

Expand Down
2 changes: 1 addition & 1 deletion tests/ae-inventory-container-itest/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-core-plugin-management-pom</artifactId>
<version>0.144.2</version>
<version>0.144-SNAPSHOT</version>
<relativePath>../../poms/ae-core-plugin-management-pom/pom.xml</relativePath>
</parent>

Expand Down
Loading