Problems with GHSA-2v4p-qf9q-27wj
Ninguém assumiu esta issue ainda.
Avaliação
- Dificuldade
- 4/5
- Tempo estimado
- 3-5 dias
- Facilidade para iniciantes
- 38/100
Direção de pesquisa
Start by reading GHSA-2v4p-qf9q-27wj and comparing its patched-version metadata with advisory-database PR #9608. Trace how the advisory database records and publishes the affected range, then verify that scanners no longer report grpc-go 1.84.0 as vulnerable; confirm whether any further maintainer action is required.
Escrita pelo modelo de indexação a partir do texto da issue.
Descrição
The grpc-go team recently published a security advisory: https://github.com/advisories/GHSA-2v4p-qf9q-27wj
The fix for the above vulnerability was made to our master branch after we cut the branch for release 1.84.0. The advisory initially mentioned that the vulnerability affected versions <=1.83.1, because at that point the most recent release was 1.83.1. As part of publishing the advisory we also pushed out a couple of patch releases, 1.82.2 and 1.83.2 and marked them as the patched versions in the advisory.
After publishing the advisory, we cherry-picked the change into the 1.84.x branch and pushed out 1.84.0 release that contained the fix.
But scanning tools are listing 1.84.0 to be affected by this vulnerability and downstream users of grpc-go using 1.84.0 are showing up as vulnerable.
How do we go about fixing this?
- I updated the patched versions in the advisory. I don't know if this is sufficient.
- I also approved https://github.com/github/advisory-database/pull/9608 that directly fixes the database. When and by whom would this PR be merged? Is this sufficient?
Please let us know if there is something more needs to be done from our side.
Thanks
- Linguagem predominante
- Sem dados de linguagem
- Estrelas
- 2.5k
- Forks
- 772
- Merge médio
- 4d 17h
- PRs com merge (30d)
- 75
Guia de contribuição
Primeiros passos
- Leia a issue inteira e depois o guia de contribuição do projeto.
- Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
- Faça um fork do repositório e trabalhe em uma branch.
- Abra um pull request que referencie o número da issue.
Mais de github/advisory-database
-
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 68/100
github/advisory-database#9255 ·
-
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 72/100
github/advisory-database#9164 · 1 reação ·
-
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 72/100
github/advisory-database#8994 ·
-
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 68/100
github/advisory-database#8898 · 4 comentários · 1 reação ·
-
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 72/100
github/advisory-database#8841 ·
Todas as issues de github/advisory-database
Issues semelhantes
-
bug
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 82/100
hanami/hanami-cli#449 ·
-
external-issue to-triage
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 88/100
-
SqliteSaver.list(filter=...) silently misses nested metadata values containing non-ASCII text Abertaexternal
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 65/100
langchain-ai/langgraph#9074 · 1 comentário ·
-
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 92/100
litestar-org/sqlspec#816 ·
-
JIT-compiled number -> Decimal conversion silently overflows instead of raising DECIMAL_OVERFLOW Abertafuzz
Dificuldade 2/5 1-3 horas Facilidade para iniciantes 82/100
ClickHouse/ClickHouse#122114 ·