aboutcode-org / aboutcode-org/vulnerablecode
Inconsistent package and version ranges
- Lenguaje dominante
- Python
- Estrellas
- 702
- Forks
- 328
- Merge medio
- 3 d 8 h
- PR fusionados (30 d)
- 3
Descripción
See:
- https://github.com/github/advisory-database/pull/5032#issuecomment-2930738938
and
https://public.vulnerablecode.io/vulnerabilities/VCID-a2bb-91uk-hqbg?search=CVE-2024-47535
This vulnerability's records are a problematic as pointed by @AB-xdev ... and there are more issues beyond CVSS, but also wrt. to the package and versions.
from
- https://github.com/github/advisory-database/pull/5032#issuecomment-2930738938
> It is normal that these three data source do not agree on the package name and the versions ranges:
>
> - GitHub: https://github.com/advisories/GHSA-xq3w-v528-46rv
> - Upstream: https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv
> - CVE.org https://github.com/CVEProject/cvelistV5/blob/027ef3e8f36744185584dc5deaa41af4025eb07f/cves/2024/47xxx/CVE-2024-47535.json#L5
>
> 
>
> 
>
> 
>
>
>
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Evaluación
Este issue todavía no se ha evaluado.