aboutcode-org / aboutcode-org/vulnerablecode
Rust Sec DB ambiguous version ranges
- 主要言語
- Python
- スター
- 702
- フォーク
- 328
- 平均マージ
- 3日 8時間
- マージ済み PR（30日）
- 3
説明
https://github.com/rustsec/advisory-db/blob/main/crates/futures-util/RUSTSEC-2020-0059.md has intersecting affecting and patched version ranges.
It mentions:
Affected Range: >= 0.3.2
Patched Range: >= 0.3.7
Hence VC gets confused about whether >= 0.3.7 are really patched.
In a trivial case like this somehow we could infer ">=0.3.2, <0.3.7" is vulnerable. But in complex cases of multiple affected ranges and patched ranges, pairing the ranges to form closed interval will be non trivial and sometimes wrong.
Also the OSV version of the advisory at https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2020-0059.json doesn't really help since the "events" are not connected.
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。