Investigate downstream advisory usage
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 1.2k
- Forks
- 544
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 45
Description
As discussed in https://github.com/rustsec/advisory-db/pull/1738#issuecomment-1684483582, issuing an informational="notice" advisory would cause alerts similar to actual vulnerabilities in some cases, which is undesirable and prevents using this type of advisory in some cases.
Our informational advisories seem to map quite poorly in most vulnerability-handling contexts, and we may consider skipping some of them in the export for osv.dev
I started a broader review of of the vulnerability audit ecosystem consumes our advisories (and other Rust-related advisories too). The test repository with the current results is https://github.com/amousset/vulnerable_crate.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the discussion in advisory-db#1738 and review the current results in the vulnerable_crate test repository. Compare how informational="notice" advisories are consumed across vulnerability-handling tools and determine whether any should be omitted from the osv.dev export. Done means documenting the downstream findings and the resulting export decision.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100