google / google/osv.dev

Missing version in affected version list of the GIT section of CVE-2024-50382 and https://osv.dev/vulnerability/CVE-2024-50383

Open
#3,161 5 comments 0 reactions 0 assignees View on GitHub
backlog data quality
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**Describe the bug**
In the affected version range of the GIT section, there are a few missing versions of Botan 2.*, specifically 2.18 and 2.19 and their subversions.

**To Reproduce**
Steps to reproduce the behaviour:
1. Go to ['CVE-2024-50382'](https://osv.dev/vulnerability/CVE-2024-50382) or ['CVE-2024-50383'](https://osv.dev/vulnerability/CVE-2024-50383)
2. Click on the GIT section of the affected libraries
3. Click on 2.*

**Expected behaviour**
a full list of the library 2.* versions

**Screenshots**

Image

Image

**Additional context**
I am reporting it here and not in NVD as the vulnerabilities are still under analysis there, so there are no assigned CPEs yet, and looking through the documentation, I saw no reason for those versions to not be included as well.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.