Backported fixes missing in advisory data
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 48
- Forks
- 14
- Avg merge
- 19h 45m
- Merged PRs (30d)
- 13
Description
The issue first showed up for PSF-2023-2 aka CVE-2023-27043 for me, but I suspect it may affect many more issues. For brevity I'll focus on this one.
The advisory data says it is fixed in https://github.com/python/cpython/commit/4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19, i.e. 3.13.0. From looking around I can find e.g. https://github.com/python/cpython/commit/ee953f2b8fc12ee9b8209ab60a2f06c603e5a624, which fixes the same thing in 3.9.20. This information is sadly not reflected in the above advisory file.
Even the NVD database meanwhile has versions for this one that look reasonable to me: https://nvd.nist.gov/vuln/detail/CVE-2023-27043
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with advisories/python/PSF-2023-2.json and compare its fixed-version data with the linked CPython backport commit and the NVD entry for CVE-2023-27043. Check whether other advisory files have the same omission; the work is done when the relevant backported fixes are accurately represented in the advisory data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100