Data quality issue with CVE-2024-53981 and CVE-2024-24762
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 369
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 149
Description
**The CVE ID**
[CVE-2024-53981](https://osv.dev/vulnerability/CVE-2024-53981)
[CVE-2024-24762](https://osv.dev/vulnerability/CVE-2024-24762)
**Describe the data quality issue observed**
For Debian 11 and 12 (Bullseye and Bookworm) both CVEs have `python-multipart` affected versions which were never released in those distributions. Debian security tracker for [CVE-2024-53981](https://security-tracker.debian.org/tracker/CVE-2024-53981) and [CVE-2024-24762](https://security-tracker.debian.org/tracker/CVE-2024-24762) denotes versions `0.0.5-2` and `0.0.5-3` as vulnerable on Bullseye and Bookworm respectively, while the converted CVE entry lists all versions up to and including `0.0.20-1`.
For [CVE-2024-24762](https://osv.dev/vulnerability/CVE-2024-24762) the Debian 13 (Trixie) fix version is also questionable, as the [CVE-2024-24762](https://security-tracker.debian.org/tracker/CVE-2024-24762) Debian security tracker seems to denote that version 0.0.20-1 is the fixed version for Debian Trixie.
**Suggested changes to record**
For Debian 11 and 12, remove the additional, non-released `python-multipart` versions from the affected versions array. For Debian 13, check if version `0.0.9-1` is the correct fix version for [CVE-2024-24762](https://osv.dev/vulnerability/CVE-2024-24762).
Contributor guide
Assessment
This issue has not been assessed yet.