aboutcode-org / aboutcode-org/vulnerablecode
Some fixed-by version data is incorrect and needs to be investigated
- Lenguaje dominante
- Python
- Estrellas
- 702
- Forks
- 328
- Merge medio
- 3 d 8 h
- PR fusionados (30 d)
- 3
Descripción
While @pombredanne and I were reviewing the VCIO UI, it became clear that some of the data displayed in the `Fixed by packages` tab of the `Vulnerability details` page -- and thus the data in the DB -- is incorrect. The example was a query for `VCID-2nyb-8rwu-aaag`. The last 2 entries in the resulting `Fixed by packages` tab are
```
pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2
pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.1
```
It seems counterintuitive that both of these versions would have been fixed rather than just one of them, and indeed an examination of the NVD Change History section for the CVE (https://nvd.nist.gov/vuln/detail/CVE-2020-36518#VulnChangeHistorySection) reflects that the vulnerability was fixed in 2.13.2.1 but not in 2.13.2.
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Evaluación
Este issue todavía no se ha evaluado.