aboutcode-org / aboutcode-org/vulnerablecode

Apache HTTPD does NOT use Maven versioning

未关闭
#579 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
bug Data collection data-quality versioning
主要语言
Python
星标
702
派生
328
平均合并
3 天 8 小时
30 天内合并 PR
3

描述

The current code use the univers MavenVersion for httpd advisories. This is incorrect.
The semantics and range notation from httpd are NOT the Maven ones.
See https://httpd.apache.org/security/json/CVE-2000-1204.json for instance:
```JSON
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Apache Software Foundation",
"product": {
"product_data": [
{
"product_name": "Apache HTTP Server",
"version": {
"version_data": [
{
"version_name": "1.3",
"version_affected": "=",
"version_value": "1.3.12"
},
{
"version_name": "1.3",
"version_affected": "=",
"version_value": "1.3.11"
},
{
"version_name": "1.3",
"version_affected": "=",
"version_value": "1.3.9"
}
]
}
}
]
}
}
]
}

```

And per https://archive.apache.org/dist/httpd/ the version seem to be mostly semver with some pre-release extra but these is NOT maven.

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。