aboutcode-org / aboutcode-org/vulnerablecode
Apache HTTPD does NOT use Maven versioning
- Linguagem predominante
- Python
- Estrelas
- 702
- Forks
- 328
- Merge médio
- 3d 8h
- PRs com merge (30d)
- 3
Descrição
The current code use the univers MavenVersion for httpd advisories. This is incorrect.
The semantics and range notation from httpd are NOT the Maven ones.
See https://httpd.apache.org/security/json/CVE-2000-1204.json for instance:
```JSON
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Apache Software Foundation",
"product": {
"product_data": [
{
"product_name": "Apache HTTP Server",
"version": {
"version_data": [
{
"version_name": "1.3",
"version_affected": "=",
"version_value": "1.3.12"
},
{
"version_name": "1.3",
"version_affected": "=",
"version_value": "1.3.11"
},
{
"version_name": "1.3",
"version_affected": "=",
"version_value": "1.3.9"
}
]
}
}
]
}
}
]
}
```
And per https://archive.apache.org/dist/httpd/ the version seem to be mostly semver with some pre-release extra but these is NOT maven.
Guia de contribuição
Nenhum guia de contribuição indexado para este repositório
Avaliação
Esta issue ainda não foi avaliada.