Potentially incorrect versions entries in PYSEC-2024-115 & PYSEC-2024-53
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 369
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 149
Description
It seems that https://api.osv.dev/v1/vulns/PYSEC-2024-115 and https://api.osv.dev/v1/vulns/PYSEC-2024-53 have PIP version constraints in their `versions`:
```
"langchain-openai==0.1.25",
"langchain-core==0.2.40",
"langchain-community==0.2.17",
"langchain-openai==0.1.24",
"langchain-groq==0.1.10",
```
Looking at [the spec for `versions`](https://ossf.github.io/osv-schema/#affectedversions-field) I think this might technically be valid but afaik it's never been done before and it won't work with the offline logic in `osv-scanner` because it expects to be comparing versions only.
It looks like this is being added by `osv.dev` as the upstream (e.g. https://github.com/pypa/advisory-database/blob/main/vulns/langchain/PYSEC-2024-115.yaml) does not include these versions.
I picked this up via the `semantic` workflow in the `osv-detector` repo that runs the library from `osv-scalibr` across all the available versions in each ecosystem
Contributor guide
Assessment
This issue has not been assessed yet.