aboutcode-org / aboutcode-org/univers

Add helper to split a ranges with patch backports

未關閉
#127 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Python
星號
50
分支
29
PR 合併指標
30 天內沒有已合併 PR

描述

reported by @kwwall in this [comment](https://www.linkedin.com/feed/update/urn%3Ali%3Aactivity%3A7129861889332793344/?commentUrn=urn%3Ali%3Acomment%3A(activity%3A7129861889332793344%2C7130193407813025795)&dashCommentUrn=urn%3Ali%3Afsd_comment%3A(7130193407813025795%2Curn%3Ali%3Aactivity%3A7129861889332793344)&midToken=AQEFXmditerzrw
)
> Is there a way that this new version notation for dependency and vulnerability ranges can be made to work for back-ported vulnerability patching like Red Hat and other Linux vendors often do? We get a lot of FPs in SCA tools because they don't recognized back-ported patches.

Say you have a range of vulnerable versions from 3.0 to 5.4, and that a patch fix the vulnerability in 5.5 is backported to 3.5 and 4.5, I would like to have a simpler way to obtain a new range looking like this: from 3.0 to before 3.5, from 4.0 to before 4.5, from 5.0 to 5.4

貢獻指南

這個儲存庫沒有索引到貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。