Unable to improve advisory database for C / C++ packages

Open

#2,963 opened on Nov 21, 2023 8 comments 10 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 5/5
Estimated time: Over a week
Newbie friendliness: 25/100

Issue type: Feature
Clarity: Needs clarification
Activity status: Stale
Tech stack: c, cpp
Domain: database, security

Research direction

Start with the supported-ecosystems section of the README, then review advisory GHSA-mq29-j5xf-cjwr and the linked zlib issue discussion. Done would require a decided, documented way to improve bulletins for C and C++ packages, including how the proposed workflow addresses the reported confusion.

Written by the indexing model from the issue text.

Description

Indeed it is documented in the README that contributions are not accepted for advisories outside the supported ecosystems. But some of the most high-impact vulnerability bulletins that need improvements are in C and C++ packages that don't have an "ecosystem" as such. They are part of all the ecosystems.

I would really like to be able to improve https://github.com/advisories/GHSA-mq29-j5xf-cjwr in light of all the confusion seen in https://github.com/madler/zlib/issues/868#issuecomment-1821577241. But there's no way to do this.

What could possibly be done to improve these bulletins?

Dominant language: No language data
Stars: 2.5k
Forks: 772
Avg merge: 3d 15h
Merged PRs (30d): 46

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

PATCH /interviews/{id} 的 goal 字段没有任何长度上限，500KB 字符串直接落库且每次 GET detail 都全量带回 Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

xinnan-tech/xiaozhi-fde-talk#263 · Opened Sep 24, 2026
count of missing values in series wrong Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

ices-eg/wg_WGEEL#398 · Opened Sep 24, 2026
Remaining datasource health checks that ignore the passed context (Couchbase, NATS KV, Badger, Elasticsearch Info) Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

gofr-dev/gofr#4325 · Opened Sep 24, 2026
Declare the hidden key, and keep hidden concepts out of search results Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

avniproject/avni-server#1074 · Opened Sep 24, 2026
S3 credentials are logged in plaintext again: redactRcloneCredentials stopped matching after the shell-quote change Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

Dokploy/dokploy#5519 · 1 comment · Opened Sep 24, 2026

More Databases issues