aboutcode-org / aboutcode-org/vulnerablecode
Some fixed-by version data is incorrect and needs to be investigated
- Dominant language
- Python
- Stars
- 702
- Forks
- 328
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 3
Description
While @pombredanne and I were reviewing the VCIO UI, it became clear that some of the data displayed in the `Fixed by packages` tab of the `Vulnerability details` page -- and thus the data in the DB -- is incorrect. The example was a query for `VCID-2nyb-8rwu-aaag`. The last 2 entries in the resulting `Fixed by packages` tab are
```
pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2
pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.1
```
It seems counterintuitive that both of these versions would have been fixed rather than just one of them, and indeed an examination of the NVD Change History section for the CVE (https://nvd.nist.gov/vuln/detail/CVE-2020-36518#VulnChangeHistorySection) reflects that the vulnerability was fixed in 2.13.2.1 but not in 2.13.2.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.