Bug 13118

Summary:	New Vulnerability has Historical/Wontfix state
Product:	[Yocto Project Subprojects] Security Response Tool	Reporter:	Ross Burton <ross.burton>
Component:	General	Assignee:	David Reyna <david.reyna>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Medium
Version:	unspecified
Target Milestone:	3.2 M1
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)

Description Ross Burton 2019-01-03 16:39:59 UTC

I created a new Vulnerability for a number of CVEs, but the status has defaulted to Status: Historical, Outcome: Closed (won't fix).

Comment 1 David Reyna 2019-01-04 05:22:40 UTC

1. New vulnerabilities by default inherit their status from the parent CVE.

  (a) Example

   CVE-xxxx with Priority: Undefined,   Status: Historical
-> VUL-xxxxx with  Priority: Undefined,   Status: Historical,   Outcome: Open 

  (b) Example

   CVE-xxxx with Priority: High,   Status: Investigate
-> VUL-xxxxx with Priority: High,   Status: Investigate,   Outcome: Open

2. New vulnerabilities created from the top bar "New Vulnerability" when in the Vulnerabilities table by default get these values (from orm/models.py):

   VUL-xxxxx with Priority: Low,   Status: Investigate,   Outcome: Open

3. QUESTION: I can change the default from CVEs to be more like #2? I can also at least force the Status to be "Investigate" and the Outcome to be "Open" since it is being explicitly created?

Comment 2 Ross Burton 2019-01-10 16:04:18 UTC

Forcing the status sounds like a better idea than copying Historical, yes.

Comment 3 David Reyna 2019-09-05 04:40:15 UTC

This should be addressed with my pending bulk update.