Proposal: Add MITRE CVE List V5 as an Advisory Data Source
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 5/5
- 預估耗時
- 一週以上
- 新手友好度
- 30/100
- Issue 類型
- 功能
- 描述清晰度
- 需要釐清
- 活躍度
- 冷清
- 領域
- security
研究方向
首先查看 CVEProject/cvelistV5 儲存庫，以及此 issue 中已列出的 advisory 來源，以了解可用記錄和擷取方式。確定將 MITRE CVE List V5 新增至 GitHub Advisory Database pipeline 的可行性與對應策略後，即可視為完成。
由索引模型根據 Issue 內容生成。
描述
Hello GitHub Advisory Database Team,
First, thank you for maintaining and continuously improving the GitHub Advisory Database. It has become an invaluable resource for the open-source ecosystem.
I would like to propose adding the MITRE CVE List V5 repository as an additional advisory source:
https://github.com/CVEProject/cvelistV5
Currently, the GitHub Advisory Database ingests advisories from sources such as:
- Security advisories reported on GitHub
- National Vulnerability Database (NVD)
- npm Security Advisories Database
- FriendsOfPHP Database
- Go Vulnerability Database
- Python Packaging Advisory Database
- Ruby Advisory Database
- RustSec Advisory Database
- Community contributions
The MITRE CVE List V5 repository contains the authoritative CNA-submitted CVE records and often includes rich product metadata before or independent of downstream enrichment. Many records already contain ecosystem-specific package information that could potentially be mapped directly into GitHub Advisory Database package ecosystems.
For example, Apache-related CVEs frequently include package references that align with Maven coordinates, making them suitable candidates for automated package matching and advisory enrichment.
Potential benefits include:
- Faster availability of newly published CVEs.
- Access to authoritative CNA-provided metadata.
- Improved package ecosystem coverage.
- Additional package mappings that may not yet be present in other advisory feeds.
- Better support for dependency and supply-chain vulnerability detection.
I would be interested in helping evaluate feasibility, mapping strategies, and implementation approaches for integrating CVE List V5 data into the GitHub Advisory Database pipeline.
Thank you for considering this suggestion.
- 主要語言
- 沒有語言資料
- 星號
- 2.5k
- 分支
- 819
- 平均合併
- 5 天 16 小時
- 30 天內合併 PR
- 56
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
github/advisory-database 的其他 Issue
-
Update https://github.com/advisories/GHSA-5pf6-cq2v-23ww to include patched version可能已有人在做 @GreyforgeLabs 於 13 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 76/100
github/advisory-database#9879 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 68/100
github/advisory-database#9255 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
github/advisory-database#9164 · 1 個 reaction ·
維護者通常 1 天內回覆
-
CVE-2026-5598 has incorrect fixed versions for bcprov-jdk packages可能已有人在做 @ECD5A 於 56 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 72/100
github/advisory-database#8994 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 68/100
github/advisory-database#8898 · 4 則留言 · 1 個 reaction ·
維護者通常 1 天內回覆
查看 github/advisory-database 的全部 Issue
相似的 Issue
-
fix(frontend): correct VITE_IS_DEVELPOMENT typo in shared/app.ts and align dev environment flags未關閉
難度 2/5 1-3 小時 新手友好度 75/100
vicharanashala/ajrasakha#1439 ·
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 88/100
aws/aws-advanced-go-wrapper#612 ·
-
agent:triaged bug bughunt pm:bundler priority:p1
難度 2/5 1-3 小時 新手友好度 70/100
SocketDev/socket-patch#1573 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 2/5 半天 新手友好度 62/100
ibm-granite/granite.build#504 ·
維護者通常 2 天內回覆
-
[Studio][Bug] Invalid ACL wildcard entries inflate the risk score可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉
難度 2/5 1-3 小時 新手友好度 72/100
apache/rocketmq-dashboard#6716 ·
維護者通常 3 天內回覆