aboutcode-org / aboutcode-org/vulnerablecode
RHSA is polluting the data quality
- Ngôn ngữ chính
- Python
- Star
- 702
- Fork
- 328
- Merge trung bình
- 3 ngày 8 giờ
- Pull request đã merge (30 ngày)
- 3
Mô tả
[VCID-67rm-w5m7-aaar](https://public.vulnerablecode.io/vulnerabilities/VCID-67rm-w5m7-aaar) contains unrelated redhat packages in `affected packages`
```
pkg:rpm/redhat/python27-babel@0.9.6-10?arch=el7
pkg:rpm/redhat/python27-python@2.7.18-3?arch=el7
pkg:rpm/redhat/python27-python-jinja2@2.6-16?arch=el7
pkg:rpm/redhat/python27-python-pygments@1.5-5?arch=el7
pkg:rpm/redhat/rh-python38-babel@2.7.0-12?arch=el7
pkg:rpm/redhat/rh-python38-python@3.8.11-2?arch=el7
pkg:rpm/redhat/rh-python38-python-cryptography@2.8-5?arch=el7
pkg:rpm/redhat/rh-python38-python-lxml@4.4.1-7?arch=el7
pkg:rpm/redhat/rh-python38-python-pip@19.3.1-2?arch=el7
pkg:rpm/redhat/rh-python38-python-urllib3@1.25.7-7?arch=el7
```
[VCID-67rm-w5m7-aaar](https://public.vulnerablecode.io/vulnerabilities/VCID-67rm-w5m7-aaar) alias [CVE-2020-28493](https://nvd.nist.gov/vuln/detail/CVE-2020-28493) is essentially a security advisory for jinja2 and has nothing to do with cryptography or pip.
Upon further investigation it turn out that redhat advisory is clubbing bunch of unrelated CVEs in their [RHSA-2021:3252](https://access.redhat.com/errata/RHSA-2021:3252) advisory resulting in this mess. And it's the same story for all RHSA advisories.
Hướng dẫn đóng góp
Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này
Đánh giá
Issue này chưa được đánh giá.