fedcode-next: Code, UI and models to expose and curate extra mitigation possibilities

[pombredanne]

Extra mitigation possibilities, besides package version updates and patching, could include instructions for perimeter security like closing ports, various IDS rules, change in configurations. All of these are likely only text instructions for now

[keshav-space]

Create todos to add mitigation for advisories that do not have fixed package version. Mitigation can be: upgrade, downgrade, patch, config, filter port/ip or replace package. Each mitigation type will have note and structured data field depending on the mitigation type.

[keshav-space]

This is completed in

• Add support for extra mitigation curation #2386

The simplest way to try this out is:

Run the below command after cloning VulnerableCode repo:

 docker compose build
 docker compose up -d

This will collect advisories from all supported sources and detect advisories with missing fixed versions. The identified advisories will be made available at http://127.0.0.1:8001/advisories/todos/?issue_type=MISSING_FIXED_BY_PACKAGE, where individuals can add extra mitigations.

OR

Simply visit https://public2.vulnerablecode.io/advisories/todos/?issue_type=MISSING_FIXED_BY_PACKAGE on staging instance.

Advisory Mitigation Curation List

Advisory Mitigation Curation View

[pombredanne]

Thanks!