Add Spring Security Advisories as data source for GHSA database
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Aptitud para principiantes
- 25/100
Línea de trabajo
El issue no identifica archivos, pruebas ni puntos de entrada de implementación. Empieza por revisar cómo ingiere actualmente datos de NVD la base de datos de GHSA y, después, compara la información de Spring Security Advisories sobre CVE-2024-38809; para darlo por terminado se requerirían un enfoque de importación acordado y una cobertura fiable de los avisos sin esperar a la publicación por parte de NVD.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Hi there!
We have noticed that some CVEs affecting Spring libraries are not reported by Dependabot. This is caused by the fact that some CVEs are taking a long time to be included in the National Vulnerabilities Database(NVD) with a full description and CVSS score. As far as I know, the NVD is currently the only data source used by the GHSA database which will contain Java- and Spring-related vulnerabilities.
One example which was not reported by Dependabot: CVE-2024-38809. This CVE affects org.springframework:spring-web in most versions prior to 6.1.12.
This CVE is reported as reserved in the MITRE CVE database, but its details have not been published yet. It is not published in the NVD too, which leads to Dependabot failing to recognize it when scanning our Spring repositories.
Thanks to the wonderful Github Enterprise support, this CVE has now received an entry in the GHSA database, while it is still not included in the NVD: Link to GHSA
To avoid such situations in the future, I'd suggest to use Spring Security Advisories as an additional data source for the GHSA database. The CVE mentioned above has been published there for over a month before it was added to the GHSA database: Spring Security Advisory for CVE-2024-38809
Me and my colleagues think this would be a valuable addition to the GHSA database. Spring is widely used and many organizations use Dependabot to scan their Spring projects. What do the maintainers of the GHSA database think about our suggestion?
- Lenguaje dominante
- Sin datos de lenguaje
- Estrellas
- 2.5k
- Forks
- 772
- Merge medio
- 3 d 15 h
- PR fusionados (30 d)
- 46
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de github/advisory-database
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
github/advisory-database#9255 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
github/advisory-database#9164 · 1 reacción ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
github/advisory-database#8994 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
github/advisory-database#8898 · 4 comentarios · 1 reacción ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
github/advisory-database#8841 ·
Todos los issues de github/advisory-database
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
-
Business User Story
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
-
[Documentation Request] vLLM kv_load_failure_policy doesn't apply to load failures in L2 adapters Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
-
Cannot reset column width Abierto0. Needs triage bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100