Vulnerabilities change root when updating to Safe status
Incident Report for Fluid Attacks


At least one organization was experiencing issues with Machine reports. The issue started on UTC-5 24-01-04 17:41 and was reactively discovered 6.9 days (TTD) later by a customer who noticed the absence of vulnerabilities that were previously present. The problem was resolved in 6.9 days (TTF) resulting in a total impact of 13.9 days (TTR) [1][2].


When processing Machine reports, similar reports from the same group were not being recognized. This resulted in a report marked as SAFE being moved to the wrong section. The problem originated while attempting to address some issues related to updates and changes in specific vulnerabilities [3].


The team implemented necessary validations to prevent the comparison of machine reports from different roots. Additionally, the code that allowed changing the root in a report was removed [4].


There was an incomplete perspective of the code when introducing the change that caused it. To prevent this from happening again, functional tests covering this case will be added [5]. This will ensure a more comprehensive testing process and help detect potential issues related to the identified problem. MISSING_TEST < INCOMPLETE_PERSPECTIVE

Posted Jan 19, 2024 - 17:03 GMT-05:00

The incident has been resolved, and now Machine reports are being processed correctly.
Posted Jan 19, 2024 - 15:29 GMT-05:00
The team has fixed the problem and is currently performing a migration to update the affected vulnerabilities.
Posted Jan 18, 2024 - 17:44 GMT-05:00
When updating a vulnerability to a Safe status, certain vulnerabilities undergo changes in the root, especially when the issue is addressed, such as removing the corresponding line or modifying the affected function.
Posted Jan 18, 2024 - 16:33 GMT-05:00
This incident affected: Platform.