aboutcode-org / aboutcode-org/vulnerablecode
Some fixed-by version data is incorrect and needs to be investigated
- Lingua principale
- Python
- Stelle
- 702
- Fork
- 328
- Merge medio
- 3g 8h
- PR unite (30g)
- 3
Descrizione
While @pombredanne and I were reviewing the VCIO UI, it became clear that some of the data displayed in the `Fixed by packages` tab of the `Vulnerability details` page -- and thus the data in the DB -- is incorrect. The example was a query for `VCID-2nyb-8rwu-aaag`. The last 2 entries in the resulting `Fixed by packages` tab are
```
pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2
pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.1
```
It seems counterintuitive that both of these versions would have been fixed rather than just one of them, and indeed an examination of the NVD Change History section for the CVE (https://nvd.nist.gov/vuln/detail/CVE-2020-36518#VulnChangeHistorySection) reflects that the vulnerability was fixed in 2.13.2.1 but not in 2.13.2.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.