question: how handle `affected[].ranges[].events` + `affectedversions-field`
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
- Issue type
- Documentation
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- github, json
- Domain
- documentation, security
Research direction
Start by reading the referenced OSV schema and the GHSA-h4j7-5rxr-p4wc advisory, then compare its ranges, versions, and GitHub UI with the linked Microsoft issue. Done means explaining how these fields should be interpreted together and documenting any discrepancy; the payload names no repository files or tests to run.
Written by the indexing model from the issue text.
Description
Description
Hello! Thanks for your work!
I found 1 confusing case:
https://github.com/advisories/GHSA-h4j7-5rxr-p4wc advisory contains affected[].ranges[].events + affectedversions-field:
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.Build.Tasks.Core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "17.13.9"
},
{
"fixed": "17.14.8"
}
]
}
],
"versions": [
"17.13.9"
]
}
OSV schema says:
affected[].versions field
The affected object’s versions field is a JSON array of strings. Each string is a single affected version in whatever version syntax is used by the given package ecosystem.
...
affected[].ranges[].events fields
The ranges object’s events field is a JSON array of objects. Each object describes a single version that either:
Introduces a vulnerability: {"introduced": string}
Fixes a vulnerability: {"fixed": string}
IIUC it means that affected versions are >=17.13.9 < 17.14.8 range + 17.13.9 version.
But this range contains 17.13.9 so it means that affected versions are >=17.13.9 < 17.14.8 range
GitHub UI shows the following versions:
This is correct for microsoft information - https://github.com/dotnet/msbuild/issues/118469
But this is not equal OSV file.
Can you help to understand this case?
Perhaps i am missing something.
Best Regards, Dmitriy
Related Issues:
- Dominant language
- No language data
- Stars
- 2.5k
- Forks
- 772
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 46
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/advisory-database
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#9255 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#9164 · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8994 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#8898 · 4 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8841 ·
All issues in github/advisory-database
Similar issues
-
content
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
GDQuest/learn-gdscript#1395 ·
-
rules
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
HttpClient
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
symfony/symfony-docs#23092 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Difficulty 1/5 Under an hour Newbie friendliness 95/100
huggingface/sentence-transformers#4074 ·