tree f1f0a4d6f358fa493fdcf9172bb14b47583db82c
parent 58a610ac68550f158773c67e71608ce16764a9f0
author Tatiana Bradley <tatianabradley@google.com> 1663689290 -0400
committer Tatiana Bradley <tatiana@golang.org> 1663788498 +0000

internal/worker: do not skip GHSAs that have CVEs

The worker was missing some GHSAs because it always filtered out GHSAs with CVEs (and sometimes CVEs are miscategorized as not Go vulns, aren't published yet, etc).

This change modifies the logic to look at all GHSAs and create an issue if there is not yet an issue for the associated CVE.

Note that this leaves a gap (which will be fixed in a subsequent CL) in which a CVE that is later found by the worker will have a duplicate issue created for it.

Change-Id: I54008c2b2772ee6de9ece2f129de8668e80bed27
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/432095
Run-TryBot: Tatiana Bradley <tatiana@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Jonathan Amsterdam <jba@google.com>