google / google/osv.dev

vulnfeeds: detect when version range has introduced > fixed

Open
#215 5 comments 0 reactions 0 assignees View on GitHub
bug good first issue vulnfeeds
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

For PyPI vulnfeeds, there are some cases of bad data in the form of:

```
introduced: 1.0
fixed: 1.0b4
```

Encoded like so, this means that everything after and including 1.0 is affeted (because 1.0b4 comes *before* 1.0). This should instead be something like

```
introduced: 1.0a0
fixed: 1.0b4
```

We need to detect these cases in the vulnfeeds tool.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.