Add Spring Security Advisories as data source for GHSA database

Open

#4,843 opened on Sep 25, 2024 1 comment 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 5/5
Estimated time: Over a week
Newbie friendliness: 25/100

Issue type: Feature
Clarity: Needs clarification
Activity status: Stale
Tech stack: java, spring
Domain: databases, security

Research direction

No files, tests, or implementation entry points are identified in the issue. Start by reviewing how the GHSA database currently ingests NVD data, then compare the Spring Security Advisories information for CVE-2024-38809; done would require an agreed import approach and reliable advisory coverage without waiting for NVD publication.

Written by the indexing model from the issue text.

Description

Hi there!

We have noticed that some CVEs affecting Spring libraries are not reported by Dependabot. This is caused by the fact that some CVEs are taking a long time to be included in the National Vulnerabilities Database(NVD) with a full description and CVSS score. As far as I know, the NVD is currently the only data source used by the GHSA database which will contain Java- and Spring-related vulnerabilities.

One example which was not reported by Dependabot: CVE-2024-38809. This CVE affects org.springframework:spring-web in most versions prior to 6.1.12.
This CVE is reported as reserved in the MITRE CVE database, but its details have not been published yet. It is not published in the NVD too, which leads to Dependabot failing to recognize it when scanning our Spring repositories.

Thanks to the wonderful Github Enterprise support, this CVE has now received an entry in the GHSA database, while it is still not included in the NVD: Link to GHSA

To avoid such situations in the future, I'd suggest to use Spring Security Advisories as an additional data source for the GHSA database. The CVE mentioned above has been published there for over a month before it was added to the GHSA database: Spring Security Advisory for CVE-2024-38809

Me and my colleagues think this would be a valuable addition to the GHSA database. Spring is widely used and many organizations use Dependabot to scan their Spring projects. What do the maintainers of the GHSA database think about our suggestion?

Dominant language: No language data
Stars: 2.5k
Forks: 772
Avg merge: 3d 15h
Merged PRs (30d): 46

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

sync build ignores local_timeout when opening kv.db and scripts.db Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

atuinsh/atuin#4247 · 1 comment · Opened Sep 23, 2026
Disability Profile: Increase character limit of note fields Open

Business User Story

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

bcgov/SIMS#6658 · Opened Sep 23, 2026
[Documentation Request] vLLM kv_load_failure_policy doesn't apply to load failures in L2 adapters Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

LMCache/LMCache#5326 · Opened Sep 23, 2026
[Bug]: Event executions make the originating request panic (nil JobInsertResult in queue log middleware) when the OTLP log exporter is enabled Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

zitadel/zitadel#12811 · Opened Sep 23, 2026
Cannot reset column width Open

0. Needs triage bug

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

nextcloud/tables#3025 · Opened Sep 23, 2026

More Databases issues