google / google/osv.dev

Data quality issue with CVE-2024-53981 and CVE-2024-24762

Open
#3,751 2 comments 0 reactions 0 assignees View on GitHub
backlog cleanup data quality
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**The CVE ID**
[CVE-2024-53981](https://osv.dev/vulnerability/CVE-2024-53981)
[CVE-2024-24762](https://osv.dev/vulnerability/CVE-2024-24762)

**Describe the data quality issue observed**
For Debian 11 and 12 (Bullseye and Bookworm) both CVEs have `python-multipart` affected versions which were never released in those distributions. Debian security tracker for [CVE-2024-53981](https://security-tracker.debian.org/tracker/CVE-2024-53981) and [CVE-2024-24762](https://security-tracker.debian.org/tracker/CVE-2024-24762) denotes versions `0.0.5-2` and `0.0.5-3` as vulnerable on Bullseye and Bookworm respectively, while the converted CVE entry lists all versions up to and including `0.0.20-1`.

For [CVE-2024-24762](https://osv.dev/vulnerability/CVE-2024-24762) the Debian 13 (Trixie) fix version is also questionable, as the [CVE-2024-24762](https://security-tracker.debian.org/tracker/CVE-2024-24762) Debian security tracker seems to denote that version 0.0.20-1 is the fixed version for Debian Trixie.

**Suggested changes to record**
For Debian 11 and 12, remove the additional, non-released `python-multipart` versions from the affected versions array. For Debian 13, check if version `0.0.9-1` is the correct fix version for [CVE-2024-24762](https://osv.dev/vulnerability/CVE-2024-24762).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.