Problems with GHSA-2v4p-qf9q-27wj
Nessuno ha ancora preso questa issue.
Valutazione
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Idoneità per principianti
- 38/100
Direzione di ricerca
Start by reading GHSA-2v4p-qf9q-27wj and comparing its patched-version metadata with advisory-database PR #9608. Trace how the advisory database records and publishes the affected range, then verify that scanners no longer report grpc-go 1.84.0 as vulnerable; confirm whether any further maintainer action is required.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Descrizione
The grpc-go team recently published a security advisory: https://github.com/advisories/GHSA-2v4p-qf9q-27wj
The fix for the above vulnerability was made to our master branch after we cut the branch for release 1.84.0. The advisory initially mentioned that the vulnerability affected versions <=1.83.1, because at that point the most recent release was 1.83.1. As part of publishing the advisory we also pushed out a couple of patch releases, 1.82.2 and 1.83.2 and marked them as the patched versions in the advisory.
After publishing the advisory, we cherry-picked the change into the 1.84.x branch and pushed out 1.84.0 release that contained the fix.
But scanning tools are listing 1.84.0 to be affected by this vulnerability and downstream users of grpc-go using 1.84.0 are showing up as vulnerable.
How do we go about fixing this?
- I updated the patched versions in the advisory. I don't know if this is sufficient.
- I also approved https://github.com/github/advisory-database/pull/9608 that directly fixes the database. When and by whom would this PR be merged? Is this sufficient?
Please let us know if there is something more needs to be done from our side.
Thanks
- Lingua principale
- Nessun dato sulla lingua
- Stelle
- 2.5k
- Fork
- 772
- Merge medio
- 4g 17h
- PR unite (30g)
- 75
Guida per i contributori
Apri la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di github/advisory-database
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 68/100
github/advisory-database#9255 ·
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
github/advisory-database#9164 · 1 reazione ·
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
github/advisory-database#8994 ·
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 68/100
github/advisory-database#8898 · 4 commenti · 1 reazione ·
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
github/advisory-database#8841 ·
Tutte le issue di github/advisory-database
Issue simili
-
bug
Difficoltà 2/5 1-3 ore Idoneità per principianti 82/100
hanami/hanami-cli#449 ·
-
external-issue to-triage
Difficoltà 2/5 1-3 ore Idoneità per principianti 88/100
-
SqliteSaver.list(filter=...) silently misses nested metadata values containing non-ASCII text Apertaexternal
Difficoltà 2/5 1-3 ore Idoneità per principianti 65/100
langchain-ai/langgraph#9074 · 1 commento ·
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 92/100
litestar-org/sqlspec#816 ·
-
JIT-compiled number -> Decimal conversion silently overflows instead of raising DECIMAL_OVERFLOW Apertafuzz
Difficoltà 2/5 1-3 ore Idoneità per principianti 82/100
ClickHouse/ClickHouse#122114 ·