aboutcode-org / aboutcode-org/vulnerablecode

Invalid version range in `apache_httpd` and `gentoo` advisory

Open
#2,387 0 comments 0 reactions 0 assignees View on GitHub
bug Priority: high
Dominant language
Python
Stars
702
Forks
328
Avg merge
3d 8h
Merged PRs (30d)
3

Description

We should not create version range using empty constraint.

```python
'Cannot create AffectedPackage with invalid or unknown range: {'package': {'type': 'apache', 'namespace': '', 'name': 'httpd', 'version': '', 'qualifiers': '', 'subpath': ''}, 'affected_version_range': 'vers:apache/', 'fixed_version_range': None, 'introduced_by_commit_patches': [], 'fixed_by_commit_patches': []} with error:
Traceback (most recent call last):
File "/app/vulnerabilities/importer.py", line 564, in from_dict
VersionRange.from_string(affected_range) if affected_range else None
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/univers/version_range.py", line 139, in from_string
raise ValueError(f"{vers!r} specifies no version range constraints.")
ValueError: 'vers:apache/' specifies no version range constraints.
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.