Impact

At least one user found that the locations view showed only the first 100 vulnerable locations. The incident was detected reactively by a user who reported through our help desk [1] that he logged into the location view of one of his findings and could only see the first 100 vulnerabilities when in fact he had more.

Cause

The locations are loaded from the db in pages of 100 units at a time, each location has a field with the name advisories which in turn contains a field with the name cve. This last one must be stored with the list type, however, there were punctual situations in which the field was of string type, so the loading was stopped by a typing error and only the pages loaded before it were shown.

Solution

A casting was performed to transform the cve field from string type to list type [2], and a migration was performed to fix the typing of the data fields stored in the database [3].

Conclusion

The incorrectly typed data was introduced when performing a migration to populate locations in the database, this type of migration is critical and should be controlled with an accurate peer review, however, on this occasion, the error was not detected before going to production. FAILED_PEER_REVIEW