psf / psf/advisory-database

Backported fixes missing in advisory data

Open
#77 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
48
Forks
14
Avg merge
19h 45m
Merged PRs (30d)
13

Description

The issue first showed up for PSF-2023-2 aka CVE-2023-27043 for me, but I suspect it may affect many more issues. For brevity I'll focus on this one.

The advisory data says it is fixed in https://github.com/python/cpython/commit/4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19, i.e. 3.13.0. From looking around I can find e.g. https://github.com/python/cpython/commit/ee953f2b8fc12ee9b8209ab60a2f06c603e5a624, which fixes the same thing in 3.9.20. This information is sadly not reflected in the above advisory file.

Even the NVD database meanwhile has versions for this one that look reasonable to me: https://nvd.nist.gov/vuln/detail/CVE-2023-27043

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with advisories/python/PSF-2023-2.json and compare its fixed-version data with the linked CPython backport commit and the NVD entry for CVE-2023-27043. Check whether other advisory files have the same omission; the work is done when the relevant backported fixes are accurately represented in the advisory data.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.