Repo specific advisories with CVE IDs don't make it into the global set
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 30/100
调研方向
从 Grafana advisory GHSA-2x6g-h2hg-rq84 开始，将其分配的 CVE-2022-39306 与 GitHub Advisory Database 的搜索结果进行比较。追踪带有 CVE IDs 的仓库专属 advisory 是如何处理的，并在该 CVE 出现在全局数据库中时将 issue 视为已解决。
由索引模型根据 Issue 内容生成。
描述
It looks like if a repo has an advisory that was not marked to enter the global database, and that advisory is assigned a CVE ID, the CVE ID in question is not present in the GitHub Advisory Database.
I feel like I'm not explaining this well, so I have an example.
This Grafana advisory
https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84
Has been assigned CVE-2022-39306
If you search the GitHub advisory database, that ID doesn't show up.
It is nice to use the GitHub database, even for unreviewed IDs, because it's vastly more complete and accurate for supported ecosystems than other sources. Incomplete CVE data means multiple data sources must be queried to get a full picture of which IDs exist.
Related is https://github.com/github/advisory-database/issues/2963 where I suggest allowing community contributions for non supported ecosystems, it would be a service to the world to have a public place to store useful details uncovered during investigations
- 主要语言
- 没有语言数据
- 星标
- 2.5k
- 派生
- 772
- 平均合并
- 3 天 15 小时
- 30 天内合并 PR
- 46
贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/advisory-database 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
github/advisory-database#9255 ·
-
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#9164 · 1 个 reaction ·
-
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#8994 ·
-
难度 2/5 1-3 小时 新手友好度 68/100
github/advisory-database#8898 · 4 条评论 · 1 个 reaction ·
-
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#8841 ·
查看 github/advisory-database 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
-
Business User Story
难度 2/5 1-3 小时 新手友好度 75/100
-
[Documentation Request] vLLM kv_load_failure_policy doesn't apply to load failures in L2 adapters 未关闭
难度 2/5 1-3 小时 新手友好度 65/100
-
难度 2/5 1-3 小时 新手友好度 65/100
-
0. Needs triage bug
难度 2/5 1-3 小时 新手友好度 75/100