google / google/osv.dev

Potentially incorrect versions entries in PYSEC-2024-115 & PYSEC-2024-53

Open
#5,578 1 comment 0 reactions 1 assignee Claimed by @jess-lowe View on GitHub
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

It seems that https://api.osv.dev/v1/vulns/PYSEC-2024-115 and https://api.osv.dev/v1/vulns/PYSEC-2024-53 have PIP version constraints in their `versions`:

```
"langchain-openai==0.1.25",
"langchain-core==0.2.40",
"langchain-community==0.2.17",
"langchain-openai==0.1.24",
"langchain-groq==0.1.10",
```

Looking at [the spec for `versions`](https://ossf.github.io/osv-schema/#affectedversions-field) I think this might technically be valid but afaik it's never been done before and it won't work with the offline logic in `osv-scanner` because it expects to be comparing versions only.

It looks like this is being added by `osv.dev` as the upstream (e.g. https://github.com/pypa/advisory-database/blob/main/vulns/langchain/PYSEC-2024-115.yaml) does not include these versions.

I picked this up via the `semantic` workflow in the `osv-detector` repo that runs the library from `osv-scalibr` across all the available versions in each ecosystem

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.