Govulncheck Scanner parser returns HTTP 500 (KeyError: 'aliases') on OSV entries without aliases

[extim-su]

Bug description
The Govulncheck Scanner parser (v1, GovulncheckParser) crashes on govulncheck streaming (≥ v1.0) output if any osv entry has no aliases. The reimport API then returns HTTP 500:

{"message":"Internal server error, check logs for details", ...}

Cause: in the new-format branch, the parser reads the first alias of every osv entry without checking that it exists:

django-DefectDojo/dojo/tools/govulncheck/parser.py

Line 221 in b9e7ef9

cve = elem["osv"]["aliases"][0]

cve = elem["osv"]["aliases"][0]

Go-only advisories can have no CVE/GHSA alias. GO-2026-5932 (golang.org/x/crypto/openpgp, all versions, no fix) is one, and govulncheck includes its osv record for any module that depends on golang.org/x/crypto. So the reimport now fails for most Go projects. The field is missing entirely, which raises KeyError; an empty list would raise IndexError.

The legacy (pre-1.0 Vulns) branch does the same at L164 (vuln["OSV"]["aliases"][0]).

GovulncheckParserV2 already handles this (aliases = osv.get("aliases") or [], L428), so only the v1 scan type is affected.

Steps to reproduce

1. Save the sample below as govulncheck.json. It matches what govulncheck -format json v1.1.4 emits, trimmed to the relevant objects.
2. Import or reimport it with scan type Govulncheck Scanner.
3. The import fails with HTTP 500 (KeyError: 'aliases').

Expected behavior
Advisories without aliases import normally. cve could fall back to empty (as V2 does) or to the OSV id, rather than the whole report being rejected.

Deployment method
Seen through the API (/api/v2/reimport-scan/) from CI. Checked against the parser on current master (b9e7ef9).

Sample scan files

{
  "config": {
    "protocol_version": "v1.0.0",
    "scanner_name": "govulncheck",
    "scanner_version": "v1.1.4",
    "db": "https://vuln.go.dev",
    "go_version": "go1.26.8",
    "scan_level": "symbol",
    "scan_mode": "source"
  }
}
{
  "osv": {
    "schema_version": "1.3.1",
    "id": "GO-2026-5932",
    "modified": "2026-07-07T22:15:29Z",
    "published": "2026-07-07T22:15:29Z",
    "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues",
    "affected": [
      {
        "package": { "name": "golang.org/x/crypto", "ecosystem": "Go" },
        "ranges": [ { "type": "SEMVER", "events": [ { "introduced": "0" } ] } ],
        "ecosystem_specific": { "imports": [ { "path": "golang.org/x/crypto/openpgp" } ] }
      }
    ],
    "references": [ { "type": "REPORT", "url": "https://go.dev/issue/44226" } ],
    "database_specific": { "url": "https://pkg.go.dev/vuln/GO-2026-5932", "review_status": "REVIEWED" }
  }
}
{
  "finding": {
    "osv": "GO-2026-5932",
    "trace": [ { "module": "golang.org/x/crypto", "version": "v0.57.0" } ]
  }
}

Additional context
As a workaround we rewrite the report before upload and set aliases: [<GO id>] where it's missing. Switching to Govulncheck Scanner V2 would also avoid it, but that starts a new test with different dedupe hashes.