vmware / vmware/photon

Missing Updated Packages from Security Advisories

Open
#1,565 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C
Stars
3.2k
Forks
692
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

Some security advisories are missing data in the Updated Packages Information section. As a result, it is not possible to determine which packages should be updated to mitigate the vulnerability.

==> ./Security-Update-3.0-302.md <==
==> ./Security-Update-4.0-675.md <==
==> ./Security-Update-3.0-79.md <==
==> ./Security-Update-3.0-140.md <==
==> ./Security-Update-5.0-268.md <==
==> ./Security-Update-3.0-193.md <==
==> ./Security-Update-3.0-313.md <==
==> ./Security-Update-1.0-261.md <==
==> ./Security-Update-1.0-241.md <==
==> ./Security-Update-3.0-6.md <==
==> ./Security-Update-3.0-33.md <==
==> ./Security-Update-5.0-131.md <==
==> ./Security-Update-1.0-234.md <==
==> ./Security-Update-3.0-26.md <==
==> ./Security-Update-1.0-277.md <==
==> ./Security-Update-3.0-773.md <==
==> ./Security-Update-4.0-608.md <==
==> ./Security-Update-4.0-589.md <==
==> ./Security-Update-1.0-267.md <==
==> ./Security-Update-3.0-676.md <==
==> ./Security-Update-1.0-223.md <==
==> ./Security-Update-1.0-276.md <==
==> ./Security-Update-1.0-242.md <==
==> ./Security-Update-3.0-389.md <==
==> ./Security-Update-3.0-680.md <==
==> ./Security-Update-4.0-250.md <==
==> ./Security-Update-3.0-748.md <==
==> ./Security-Update-4.0-592.md <==
==> ./Security-Update-3.0-305.md <==
==> ./Security-Update-1.0-248.md <==
==> ./Security-Update-4.0-405.md <==

Reproduction steps
  1. Clone wiki
  2. find . -type f -name "Security*.md" -exec tail -n1 -v {} \; | grep -B1 'Information' | grep 'Security'
  3. While there is probably a better way to find these file, this did work. These advisories are missing the Updated Packages Information.
Expected behavior

I expect all security advisories to have packages to update in order to mitigate the vulnerability.

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the provided find/tail/grep command in the wiki and inspect the listed Security-Update-*.md files, especially their final sections. Compare each advisory's Updated Packages Information section with the surrounding advisory content. Done means every listed advisory contains the package-update information needed to mitigate its vulnerability.

Written by the indexing model from the issue text.

Assessment

Domain
documentation, security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.