Backported fixes missing in advisory data
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 52/100
Research direction
Start with advisories/python/PSF-2023-2.json and compare its fixed-version data with the linked CPython backport commit and the NVD entry for CVE-2023-27043. Check whether other advisory files have the same omission; the work is done when the relevant backported fixes are accurately represented in the advisory data.
Written by the indexing model from the issue text.
Description
The issue first showed up for PSF-2023-2 aka CVE-2023-27043 for me, but I suspect it may affect many more issues. For brevity I'll focus on this one.
The advisory data says it is fixed in https://github.com/python/cpython/commit/4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19, i.e. 3.13.0. From looking around I can find e.g. https://github.com/python/cpython/commit/ee953f2b8fc12ee9b8209ab60a2f06c603e5a624, which fixes the same thing in 3.9.20. This information is sadly not reflected in the above advisory file.
Even the NVD database meanwhile has versions for this one that look reasonable to me: https://nvd.nist.gov/vuln/detail/CVE-2023-27043
- Dominant language
- Python
- Stars
- 49
- Forks
- 14
- Avg merge
- 4h 44m
- Merged PRs (30d)
- 15
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from psf/advisory-database
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
psf/advisory-database#162 · 5 comments ·
Maintainers usually reply within 1 day
-
Maintain all fixed versions on CVE record after upstream git branches are deletedMay be free again @sethmlarson claimed this 190 days ago, and no pull request is open. Open
psf/advisory-database#121 · 1 assignee ·
Maintainers usually reply within 1 day
-
Consider providing a template for record feedbackPossibly taken @speco29 claimed this 354 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 48/100
psf/advisory-database#60 · 1 comment ·
Maintainers usually reply within 1 day
All issues in psf/advisory-database
Similar issues
-
plot_graph crashes when a mesh node has no m2m edgePossibly taken @tygvi claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
mllam/neural-lam#883 · 1 comment ·
Maintainers usually reply within 2 days
-
enhancement possible-duplicate
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
AOSSIE-Org/PictoPy#1715 · 2 comments ·
Maintainers usually reply within 6 days
-
SQLite connector omits generated columns from the catalog, and drops relationships sourced on themOpen
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
NVIDIA/auto-ontology#511 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
ethereum/execution-specs#3996 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
cpp-best-practices/project_validator#267 ·
Maintainers usually reply within 1 day