Mismatch in Vulnerability count

[raelyz]

Hello Team, I'm facing a similar issue to #89.

In the screenshot you can see that there are supposedly 2 High Vulnerabilities but if we look at the list of vulnerabilities displayed below there are 0.

I have followed a similar set of instructions and sent an email last Friday and was wondering if anyone has seen it.

[bluesentinelsec]

Hello @raelyz thank you for reaching out.

We understand that the vulnerability counts by severity table does not match the severity in the vulnerability findings table.

This mismatch is occurring because two of the reported CVE's have differing severity values from multiple vendors (e.g. NVD, MITRE, GitHub Security Advisories, etc.):

1. CVE-2024-56326
2. CVE-2024-6119

You are seeing the mismatch in the vulnerability findings table because the Inspector GitHub Action is preferring to render NVD, with a rating of medium, over other vendors such as GitLab with a rating of high (see source code here).

We will modify this action to render the highest severity in our next release.

Work for this issue is expected to begin on Monday February 24th 2025.

[bluesentinelsec]

Brief update: I am about 3/4 through the expected work to resolve this issue.
I will post updated guidance when we're confident in the fix and the timeline for publishing a new release.

[bluesentinelsec]

@raelyz I have finished the expected code changes to resolve this issue.

Would you be able to test your action against the fix_severity_rating_mismatch branch to verify it resolves the issue?

 uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@fix_severity_rating_mismatch

In the mean time, we will continue reviewing, refining, and testing the code changes.
I will begin preparing a new release for this action after the current code changes are approved.

[bluesentinelsec]

@raelyz we have published a new release that resolves this issue:

https://github.com/aws-actions/vulnerability-scan-github-action-for-amazon-inspector/releases/tag/v1.2.1

Please update your workflows to use v1.2.1 or v1 to receive the release.

If you have follow-up questions, comments, or feedback about this issue, feel free to raise that here.

Otherwise, I will close this issue in 24 hours.