aboutcode-org / aboutcode-org/vulnerablecode
Some fixed-by version data is incorrect and needs to be investigated
- Linguagem predominante
- Python
- Estrelas
- 702
- Forks
- 328
- Merge médio
- 3d 8h
- PRs com merge (30d)
- 3
Descrição
While @pombredanne and I were reviewing the VCIO UI, it became clear that some of the data displayed in the `Fixed by packages` tab of the `Vulnerability details` page -- and thus the data in the DB -- is incorrect. The example was a query for `VCID-2nyb-8rwu-aaag`. The last 2 entries in the resulting `Fixed by packages` tab are
```
pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2
pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.1
```
It seems counterintuitive that both of these versions would have been fixed rather than just one of them, and indeed an examination of the NVD Change History section for the CVE (https://nvd.nist.gov/vuln/detail/CVE-2020-36518#VulnChangeHistorySection) reflects that the vulnerability was fixed in 2.13.2.1 but not in 2.13.2.
Guia de contribuição
Nenhum guia de contribuição indexado para este repositório
Avaliação
Esta issue ainda não foi avaliada.