Allow collaborators to withdraw or reject CVE IDs
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6
- Forks
- 2
- Avg merge
- 9h 7m
- Merged PRs (30d)
- 2
Description
Currently this bot can automatically assigns CVE IDs to GHSAs through the CVE API. However, sometimes a GHSA report is rejected by core developers or withdrawn by the reporter. In this case we need a way for the bot to be instructed to "withdraw" a CVE ID. Today that's done manually exclusively by CVE admins.
To enable any collaborators to reject a CVE ID (which is a
- Create a phrase that instructs the bot to reject the CVE ID (
@psrt-ghsa-bot reject <CVE ID>?) - Anyone in the collaborators list (
python/psrtandcollaborating_users, and_teams) can use the above phrase to trigger a CVE ID rejection. - Must not work if the CVE ID has been published or if the GHSA is still open.
This requires the bot to be able to get a list of comments in a GHSA to take commands.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the bot's GitHub comment handling and its CVE/GHSA API integration. Trace how collaborators, team membership, comment history, publication state, and GHSA state are currently represented. Done means an authorized collaborator can issue the rejection command only for an unpublished CVE linked to a closed GHSA, while unauthorized, published, or open cases are rejected safely.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100