aboutcode-org / aboutcode-org/vulnerablecode

Weird item with no history and various RedHat data bugs

Offen
#1,662 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Python
Sterne
702
Forks
328
Ø Merge
3 T. 8 Std.
Gemergte PRs (30 T.)
3

Beschreibung

This entry is weird
https://public.vulnerablecode.io/packages/pkg:rpm/redhat/application-ui@container-v2.3%3Farch=6-9?search=pkg:rpm/redhat/application-ui@container-v2.3?arch=6-9

- The vulnerability does not reference anything redhat in https://nvd.nist.gov/vuln/detail/CVE-2021-3918 or in https://github.com/advisories/GHSA-896r-f27r-55mw
- there is no history in our entry https://public.vulnerablecode.io/vulnerabilities/VCID-ft33-ayw5-aaad and
- https://ftp.redhat.com/redhat/containers/rhacm2/application-ui-rhel8/v2.3.0-120.txt is a place that references this `application-ui-container-v2.3.0-120 application-ui-container-v2.3.0-120.tar.gz` (or may be it could be from https://ftp.redhat.com/redhat/containers/rhacm2/application-ui-rhel8/v2.3.6-9.txt ?)
- `pkg:rpm/redhat/application-ui@container-v2.3?arch=6-9` is not correct at all and we did not parse the name, version and else correctly.

- There are a bunch of refs to RedHat that are for fixes to packages that bundled the json-schema at fault:
```
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3918.json
2024702 https://bugzilla.redhat.com/show_bug.cgi?id=2024702
999765 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999765
RHSA-2021:5171 https://access.redhat.com/errata/RHSA-2021:5171
RHSA-2022:0041 https://access.redhat.com/errata/RHSA-2022:0041
RHSA-2022:0246 https://access.redhat.com/errata/RHSA-2022:0246
RHSA-2022:0350 https://access.redhat.com/errata/RHSA-2022:0350
RHSA-2022:0595 https://access.redhat.com/errata/RHSA-2022:0595
RHSA-2022:0735 https://access.redhat.com/errata/RHSA-2022:0735
RHSA-2022:4914 https://access.redhat.com/errata/RHSA-2022:4914
RHSA-2022:4956 https://access.redhat.com/errata/RHSA-2022:4956
RHSA-2022:7055 https://access.redhat.com/errata/RHSA-2022:7055
```
... BUT I do not know where the incorrect data was collected from.

In https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3918.json I see:
```
{
"product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8",
"release_date" : "2022-03-04T00:00:00Z",
"advisory" : "RHSA-2022:0595",
"cpe" : "cpe:/a:redhat:acm:2.3::el8",
"package" : "rhacm2/application-ui-rhel8:v2.3.6-9",
"impact" : "moderate"
}
```
which is likely the thing did not parse correctly.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.