Tomcat entry updates

未关闭

#4,590 创建于 2024年7月9日 1 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 5/5
预计耗时: 一周以上
新手友好度: 25/100

Issue 类型: 缺陷
描述清晰度: 需要澄清
活跃度: 停滞
技术栈: java
领域: security

调研方向

首先查看链接的电子表格，并将其中的组件映射与所引用的 GitHub advisories 进行比较，包括 GHSA-3p86-xgrq-m6p6 和 GHSA-f4qf-m5gf-8jm8。在进行更改之前，先与 advisory-database 维护者确认应如何提交此语料库，以及哪些条目属于范围；当已接受的更新能够识别受影响的 Tomcat 组件，而不是聚合的项目包时，即视为完成。

由索引模型根据 Issue 内容生成。

描述

Hello,

I have a spreadsheet with a large number of Tomcat advisory updates (this sheet is not current with the latest Tomcat vulnerabilities)
https://docs.google.com/spreadsheets/d/1b8XqUEK1PuOfTjm1jj-YSIoQa92A7uwjVfF06kd4bXg/edit?gid=0#gid=0

Many GitHub advisories for tomcat reference the package org.apache.tomcat:tomcat, which is not an installable jar. For example
https://github.com/advisories/GHSA-3p86-xgrq-m6p6

Vulnerability scanners should be detecting specific components of the Tomcat project rather than the project itself, and vulnerabilities affect specific Tomcat jars, not all Tomcat jars.

There are some GitHub Tomcat advisories that do capture the specific components that a vulnerability affects
https://github.com/advisories/GHSA-f4qf-m5gf-8jm8

In the spreadsheet I have identified the Tomcat component(s) affected by the given vulnerabilities in column D. Some of the vulnerabilities couldn't be figured out, or are documentation or example updates. I left them in for posterity.

I have a few questions about how to submit this large corpus of updates. I would like to work with the GitHub team to minimize friction. I'm very open to suggestions. I can submit one big PR, many small PRs. I'm happy to trickle them in if that's easier. Whatever works best for the GitHub team.

主要语言: 没有语言数据
星标: 2.5k
派生: 772
平均合并: 3 天 15 小时
30 天内合并 PR: 46