The allowlist ids are not stable

Our daily security scan for our Node.js projects failed today because the ids in our .audit-ci.json files no longer match the ids of the NPM advisory/GitHub vulnerability database.

A good example is CVE-2020-15168. We we added the allowlist entry for this vulnerability on Nov 4, the id was 1003055. Today it’s failing because the id is now 1005560.

I’m guessing this is a side effect of the recent move to use the GitHub Advisory Database as the backend for npm audit.

Maybe it would be better to identify the vulnerabilities by CVE, which is a more stable identifier?

[GUI]

We’ve also been bit by the IDs changing a few times since GitHub’s ownership change now.

Does every vulnerability in the database have a CVE? It looks like here’s maybe a few examples of ones that don’t have CVEs: https://github.com/advisories/GHSA-r8hm-w5f7-wj39, https://github.com/advisories/GHSA-pjwm-rvh2-c87w, https://github.com/advisories/GHSA-xx4c-jj58-r7x6 So with GitHub’s ownership, would using the github_advisory_id (eg, GHSA-xx4c-jj58-r7x6) as a stable identifier be better?

I’m not sure if these NPM IDs changing is expected behavior now, but if extra context helps, here is a specific example of how these IDs have changed for CVE-2021-33623:

• ~ 2021-10-08: 1753 became 1002624
• ~ 2021-11-18: 1002624 became 1005151
• ~ 2021-12-03: 1005151 became 1006754

Note that only the original and latest IDs seem to work at the https://npmjs.com/advisories/* URLs (and the ones in between now result in 404s).

[mobilutz]

FYI change to use GitHub-advisory-ids was merged and will be in 6.0.0 #217