aboutcode-org / aboutcode-org/vulnerablecode

Missing Affected Versions in Vulnerability Record

Abierto
#1,566 0 comentarios 0 reacciones 0 asignados Ver en GitHub
9-next data-quality
Lenguaje dominante
Python
Estrellas
702
Forks
328
Merge medio
3 d 8 h
PR fusionados (30 d)
3

Descripción

The vulnerability https://public.vulnerablecode.io/vulnerabilities/VCID-aqmt-fmm5-aaad is missing the affected versions `0.7.1.fix1` and `0.7.4.svn.r2010`. See the details here: https://github.com/pypa/advisory-database/blob/e56e7a79124764436c8b64e07d4ee7ab7f6b5605/vulns/ipython/PYSEC-2022-12.yaml.

Additionally, the vulnerability https://public.vulnerablecode.io/vulnerabilities/VCID-zdzp-uhzh-aaar also affects the `jw.util` package version `-class.-jw.util.version.Version-`, as stated here: https://github.com/pypa/advisory-database/blob/e56e7a79124764436c8b64e07d4ee7ab7f6b5605/vulns/jw.util/PYSEC-2020-341.yaml.
This version does indeed exist upstream on PyPI: https://pypi.org/project/jw.util/-class.-jw.util.version.Version-/.

The issue arises when `univers` is unable to parse these unusual versions. IMO we should not discard an affected or fixed version just because it is unusual and cannot be parsed by univers. Instead, should we store these versions as strings if we fail to parse them?

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.