google / google/osv.dev

Data quality issue with CVE-2021-42384

Open
#2,128 3 comments 0 reactions 0 assignees View on GitHub
backlog bug data quality worker
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**The CVE ID**
CVE-2021-42384

**Describe the data quality issue observed**
When I searched this CVE ID from osv.dev, I got different result with NVD when echo system is GIT.
[Result of osv.dev](https://osv.dev/vulnerability/CVE-2021-42384)

The affected version shows as below image
![image](https://github.com/google/osv.dev/assets/164469490/9020c856-0cc7-4c71-88d2-8c5c6d3fab2f)

[Result of NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-42384)

The affected version shows as below image
![image](https://github.com/google/osv.dev/assets/164469490/ff968dd3-949f-46df-aea6-57d982ed59dc)

The "From" (1_18_0) and and "Up to" (1_33_1) version are both the same between osv.dev and NVD.

However, osv.dev does not link this CVE to all tag version .

For example, I use the busybox v1.30.1, the tag ID is [1_30_1](https://github.com/mirror/busybox/releases/tag/1_30_1) , and the GIT commit hash is as following
[1dd2685dcc735496d7adde87ac60b9434ed4a04c](https://github.com/mirror/busybox/commit/1dd2685dcc735496d7adde87ac60b9434ed4a04c)

As you can see, CVE-2021-42384 can not be found on osv.dev and osv-scanner tool with this version.

![image](https://github.com/google/osv.dev/assets/164469490/29785b71-83b3-43aa-93ae-b36f3f777aef)

**Suggested changes to record**
Link CVE to all tag version between from and Up .

Hope my description is clear :)
Thank you very much.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.