`upload-sarif@v3`: could not convert rules: invalid security severity value, is not a number: undefined #2187

NiccoloFei · 2024-03-08T10:57:15Z

Hi, recently I'm seeing the following error when running the upload-sarif@v3 GH action.
Example failure: https://github.com/cloudnative-pg/postgres-containers/actions/runs/8196632252/job/22417260216

Uploading results
  Processing sarif files: ["snyk.sarif"]
  Uploading results
  Successfully uploaded results
Waiting for processing to finish
  Analysis upload status is pending.
  Analysis upload status is failed.
Error: Code Scanning could not process the submitted SARIF file:
could not convert rules: invalid security severity value, is not a number: undefined
Error: Code Scanning could not process the submitted SARIF file:
could not convert rules: invalid security severity value, is not a number: undefined
    at Object.waitForProcessing (/home/runner/work/_actions/github/codeql-action/v3/lib/upload-lib.js:359:[27](https://github.com/cloudnative-pg/postgres-containers/actions/runs/8196632252/job/22417260216#step:11:28))
    at async run (/home/runner/work/_actions/github/codeql-action/v3/lib/upload-sarif-action.js:58:13)
    at async runWrapper (/home/runner/work/_actions/github/codeql-action/v3/lib/upload-sarif-action.js:76:9)

I'm not sure what could cause that. The upload was working just fine and started failing the last few days.
Any help is appreciated, thanks in advance!

The text was updated successfully, but these errors were encountered:

mbg · 2024-03-08T11:04:40Z

Hi @NiccoloFei 👋

I'll check with the team to see if we have made any changes to the SARIF upload recently that could be responsible for this, but have you verified that the file generated by Snyk is actually a valid SARIF file? If so, could you make the SARIF file available?

NiccoloFei · 2024-03-08T11:48:53Z

Attaching the SARIF content below:

Sarif content:

{
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Snyk Container",
          "properties": {
            "artifactsScanned": 169
          },
          "rules": [
            {
              "id": "SNYK-DEBIAN11-EXPAT-6227598",
              "shortDescription": {
                "text": "High severity - Resource Exhaustion vulnerability in expat"
              },
              "fullDescription": {
                "text": "(CVE-2023-52425) expat/libexpat1@2.2.10-2+deb11u5"
              },
              "help": {
                "text": "",
                "markdown": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:11` relevant fixed versions and status._\n\nlibexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.\n## Remediation\nThere is no fixed version for `Debian:11` `expat`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-52425)\n- [cve@mitre.org](https://github.com/libexpat/libexpat/pull/789)\n"
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "tags": [
                  "security",
                  "CWE-400",
                  "deb"
                ],
                "cvssv3_baseScore": 7.5,
                "security-severity": "7.5"
              }
            },
            {
              "id": "SNYK-DEBIAN11-SYSTEMD-6277510",
              "shortDescription": {
                "text": "High severity - Allocation of Resources Without Limits or Throttling vulnerability in systemd"
              },
              "fullDescription": {
                "text": "(CVE-2023-50387) systemd/libsystemd0@247.3-7+deb11u4"
              },
              "help": {
                "text": "",
                "markdown": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:11` relevant fixed versions and status._\n\nCertain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the &#34;KeyTrap&#34; issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.\n## Remediation\nThere is no fixed version for `Debian:11` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-50387)\n- [cve@mitre.org](https://datatracker.ietf.org/doc/html/rfc4035)\n- [cve@mitre.org](https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html)\n- [cve@mitre.org](https://kb.isc.org/docs/cve-2023-50387)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=39367411)\n- [cve@mitre.org](https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/)\n- [cve@mitre.org](https://www.athene-center.de/aktuelles/key-trap)\n- [cve@mitre.org](https://www.isc.org/blogs/2024-bind-security-release/)\n- [cve@mitre.org](https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/)\n- [cve@mitre.org](https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=39372384)\n- [cve@mitre.org](https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1)\n- [cve@mitre.org](https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html)\n- [cve@mitre.org](https://access.redhat.com/security/cve/CVE-2023-50387)\n- [cve@mitre.org](https://bugzilla.suse.com/show_bug.cgi?id=1219823)\n- [cve@mitre.org](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387)\n- [cve@mitre.org](https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2024/02/16/2)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2024/02/16/3)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/)\n"
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "tags": [
                  "security",
                  "CWE-770",
                  "deb"
                ],
                "cvssv3_baseScore": 7.5,
                "security-severity": "7.5"
              }
            },
            {
              "id": "SNYK-DEBIAN11-ZLIB-6008961",
              "shortDescription": {
                "text": "Critical severity - Integer Overflow or Wraparound vulnerability in zlib"
              },
              "fullDescription": {
                "text": "(CVE-2023-45853) zlib/zlib1g@1:1.2.11.dfsg-2+deb11u2"
              },
              "help": {
                "text": "",
                "markdown": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:11` relevant fixed versions and status._\n\nMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.\n## Remediation\nThere is no fixed version for `Debian:11` `zlib`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-45853)\n- [cve@mitre.org](https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356)\n- [cve@mitre.org](https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61)\n- [cve@mitre.org](https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4)\n- [cve@mitre.org](https://github.com/madler/zlib/pull/843)\n- [cve@mitre.org](https://www.winimage.com/zLibDll/minizip.html)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/10/20/9)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20231130-0009/)\n- [cve@mitre.org](https://pypi.org/project/pyminizip/#history)\n- [cve@mitre.org](https://security.gentoo.org/glsa/202401-18)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2024/01/24/10)\n"
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "tags": [
                  "security",
                  "CWE-190",
                  "deb"
                ],
                "cvssv3_baseScore": 9.8,
                "security-severity": "9.8"
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "SNYK-DEBIAN11-EXPAT-6227598",
          "level": "error",
          "message": {
            "text": "This file introduces a vulnerable expat package with a high severity vulnerability."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "Debian/14/Dockerfile"
                },
                "region": {
                  "startLine": 1
                }
              },
              "logicalLocations": [
                {
                  "fullyQualifiedName": "expat@2.2.10-2+deb11u5"
                }
              ]
            }
          ]
        },
        {
          "ruleId": "SNYK-DEBIAN11-SYSTEMD-6277510",
          "level": "error",
          "message": {
            "text": "This file introduces a vulnerable systemd package with a high severity vulnerability."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "Debian/14/Dockerfile"
                },
                "region": {
                  "startLine": 1
                }
              },
              "logicalLocations": [
                {
                  "fullyQualifiedName": "systemd@247.3-7+deb11u4"
                }
              ]
            }
          ]
        },
        {
          "ruleId": "SNYK-DEBIAN11-ZLIB-6008961",
          "level": "error",
          "message": {
            "text": "This file introduces a vulnerable zlib package with a critical severity vulnerability."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "Debian/14/Dockerfile"
                },
                "region": {
                  "startLine": 1
                }
              },
              "logicalLocations": [
                {
                  "fullyQualifiedName": "zlib@1:1.2.11.dfsg-2+deb11u2"
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "tool": {
        "driver": {
          "name": "Snyk Container",
          "properties": {
            "artifactsScanned": 39
          },
          "rules": [
            {
              "id": "snyk:lic:pip:barman:GPL-3.0",
              "shortDescription": {
                "text": "High severity - GPL-3.0 license vulnerability in barman"
              },
              "fullDescription": {
                "text": "barman@3.10.0"
              },
              "help": {
                "text": "",
                "markdown": "GPL-3.0 license"
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "tags": [
                  "security",
                  "pip"
                ],
                "security-severity": "undefined"
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "snyk:lic:pip:barman:GPL-3.0",
          "level": "error",
          "message": {
            "text": "This file introduces a vulnerable barman package with a high severity vulnerability."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "/requirements.txt"
                },
                "region": {
                  "startLine": 1
                }
              },
              "logicalLocations": [
                {
                  "fullyQualifiedName": "barman@3.10.0"
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "tool": {
        "driver": {
          "name": "Snyk Container",
          "properties": {
            "artifactsScanned": 2
          },
          "rules": []
        }
      },
      "results": []
    }
  ]
}

aeisenberg · 2024-03-08T15:50:34Z

I'm pretty sure it's because your sarif has "security-severity": "undefined". I don't know what this value is supposed to be, but you should probably check with snyk to see if there is a known workaround. Otherwise, you can try post-processing the sarif before uploading.

abstractj · 2024-03-11T16:19:11Z

@aeisenberg your assessment seems accurate to me. I tried to downgrade upload-sarif to v2 and the issue persists.

aeisenberg · 2024-03-11T18:24:56Z

I'd recommend post-processing the SARIF that snyk produces to remove the undefined. I am not sure what value should replace it, but it should be numeric.

The Sarif upload action is currently failing because of github/codeql-action#2187, which turned out being related to how snyk produces the sarif. While the issue is being investigated with snyk, let's deploy a temporary workaround to allow the push of new images.

LeviPesin · 2024-03-14T05:35:32Z

Is there any issue opened within the Snyk? I'm getting the same exact error, except of undefined replaced with null: https://github.com/warriors-life/yokohama-proxy/actions/runs/8211361886/job/22460200402.

aeisenberg · 2024-03-14T16:01:17Z

There are no issues that I am aware of. I'd recommend that you raise one. This appears to be a recent change seeing as how there are multiple reports in this issue.

LeviPesin · 2024-03-14T16:41:51Z

Where can I create an issue? It seems like issues are disabled in the https://github.com/snyk/actions repository.

aeisenberg · 2024-03-14T16:59:12Z

See here https://github.com/snyk/actions/blob/master/CONTRIBUTING.md#reporting-issues.

aklira · 2024-03-14T19:02:06Z

Same problem here: https://github.com/fledge-power/fledgepower-deployment/actions/runs/8286079944/job/22675227175

LeviPesin · 2024-03-15T10:15:00Z

See here https://github.com/snyk/actions/blob/master/CONTRIBUTING.md#reporting-issues.

Thank you, submitted a ticket there!

github/codeql-action#2187

mykolaveremeichyk · 2024-03-20T15:13:14Z

See here https://github.com/snyk/actions/blob/master/CONTRIBUTING.md#reporting-issues.

Thank you, submitted a ticket there!

Are there any updates regarding the submitted ticket?

LeviPesin · 2024-03-21T20:58:58Z

They've replied only today with a request to provide the full SARIF file (well, they could've downloaded it from just any run).

mprado-enclave · 2024-04-08T16:48:27Z

This behavior is expected - licenses and vulnerabilities were originally designed with a common structure but license-related findings are now managed differently. That is, license-related findings do not indicate a security vulnerability and are labeled as 'undefined'. You can use use the --sarif-file-output=snyk.sarif arg and add the following lines to fix it:

   - name: Replace security-severity undefined for license-related findings 
     run: sed -i 's/"security-severity": "undefined"/"security-severity": "0"/g' snyk.sarif

This was referenced Mar 11, 2024

Snyk workflow failure keycloak/keycloak#27761

Closed

Snyk workflow failure keycloak/keycloak#27767

Merged

This was referenced Mar 13, 2024

ci: temporary workaround for the snyk failure cloudnative-pg/postgres-containers#95

Merged

ci: temporary workaround for the snyk failure cloudnative-pg/postgis-containers#55

Merged

abstractj mentioned this issue Mar 13, 2024

Snyk workflow failure keycloak/keycloak#27866

Merged

Erikvl87 mentioned this issue Mar 14, 2024

The Github action to scan for vulnerabilities using Snyk fails Erikvl87/docker-languagetool#90

Closed

minghinmatthewlam mentioned this issue Mar 14, 2024

Fix Snyk upload invalid security severity value ava-labs/teleporter#352

Closed

jorgesoft added a commit to jorgesoft/dolibarr-container that referenced this issue Mar 15, 2024

Update snyk-container.yml with temporary fix

11568d8

github/codeql-action#2187

melikhov-dev mentioned this issue Mar 19, 2024

Update snyk_container.yaml datalens-tech/datalens-ui#794

Merged

This was referenced Apr 9, 2024

Snyk upload workaround ava-labs/teleporter-token-bridge#72

Merged

Snyk upload fix ava-labs/teleporter#361

Open

Snyk upload fix ava-labs/awm-relayer#260

Merged

ismarslomic mentioned this issue Apr 17, 2024

fix(node): downgrade node from v21 to v20 sjmayotte/route53-dynamic-dns#61

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

`upload-sarif@v3`: could not convert rules: invalid security severity value, is not a number: undefined #2187

`upload-sarif@v3`: could not convert rules: invalid security severity value, is not a number: undefined #2187

NiccoloFei commented Mar 8, 2024

mbg commented Mar 8, 2024

NiccoloFei commented Mar 8, 2024

aeisenberg commented Mar 8, 2024

abstractj commented Mar 11, 2024 •

edited

aeisenberg commented Mar 11, 2024

LeviPesin commented Mar 14, 2024 •

edited

aeisenberg commented Mar 14, 2024

LeviPesin commented Mar 14, 2024

aeisenberg commented Mar 14, 2024

aklira commented Mar 14, 2024

LeviPesin commented Mar 15, 2024

mykolaveremeichyk commented Mar 20, 2024

LeviPesin commented Mar 21, 2024

mprado-enclave commented Apr 8, 2024

upload-sarif@v3: could not convert rules: invalid security severity value, is not a number: undefined #2187

upload-sarif@v3: could not convert rules: invalid security severity value, is not a number: undefined #2187

Comments

NiccoloFei commented Mar 8, 2024

mbg commented Mar 8, 2024

NiccoloFei commented Mar 8, 2024

aeisenberg commented Mar 8, 2024

abstractj commented Mar 11, 2024 • edited

aeisenberg commented Mar 11, 2024

LeviPesin commented Mar 14, 2024 • edited

aeisenberg commented Mar 14, 2024

LeviPesin commented Mar 14, 2024

aeisenberg commented Mar 14, 2024

aklira commented Mar 14, 2024

LeviPesin commented Mar 15, 2024

mykolaveremeichyk commented Mar 20, 2024

LeviPesin commented Mar 21, 2024

mprado-enclave commented Apr 8, 2024

`upload-sarif@v3`: could not convert rules: invalid security severity value, is not a number: undefined #2187

`upload-sarif@v3`: could not convert rules: invalid security severity value, is not a number: undefined #2187

abstractj commented Mar 11, 2024 •

edited

LeviPesin commented Mar 14, 2024 •

edited