Problems with GHSA-2v4p-qf9q-27wj

未关闭

#9,772 创建于 2026年9月24日 1 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 4/5
预计耗时: 3-5 天
新手友好度: 38/100

Issue 类型: 缺陷
描述清晰度: 基本清楚
活跃度: 活跃
技术栈: go
领域: databases, security

调研方向

Start by reading GHSA-2v4p-qf9q-27wj and comparing its patched-version metadata with advisory-database PR #9608. Trace how the advisory database records and publishes the affected range, then verify that scanners no longer report grpc-go 1.84.0 as vulnerable; confirm whether any further maintainer action is required.

由索引模型根据 Issue 内容生成。

描述

The grpc-go team recently published a security advisory: https://github.com/advisories/GHSA-2v4p-qf9q-27wj

The fix for the above vulnerability was made to our master branch after we cut the branch for release 1.84.0. The advisory initially mentioned that the vulnerability affected versions <=1.83.1, because at that point the most recent release was 1.83.1. As part of publishing the advisory we also pushed out a couple of patch releases, 1.82.2 and 1.83.2 and marked them as the patched versions in the advisory.

After publishing the advisory, we cherry-picked the change into the 1.84.x branch and pushed out 1.84.0 release that contained the fix.

But scanning tools are listing 1.84.0 to be affected by this vulnerability and downstream users of grpc-go using 1.84.0 are showing up as vulnerable.

How do we go about fixing this?

I updated the patched versions in the advisory. I don't know if this is sufficient.
I also approved https://github.com/github/advisory-database/pull/9608 that directly fixes the database. When and by whom would this PR be merged? Is this sufficient?

Please let us know if there is something more needs to be done from our side.

Thanks

主要语言: 没有语言数据
星标: 2.5k
派生: 772
平均合并: 4 天 17 小时
30 天内合并 PR: 75

贡献指南

打开贡献指南

从这里开始

先读完整个 Issue，再读项目的贡献指南。
在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
Fork 仓库，在一个分支上完成修改。
提交 Pull Request，并在描述里引用这个 Issue 编号。

github/advisory-database 的其他 Issue

GHSA-vxq2-vhm7-7mhq: expand fetch-page-assets affected versions beyond = 1.2.9 未关闭

难度 2/5 1-3 小时新手友好度 68/100

github/advisory-database#9255 · 2026年8月28日创建
GHSA-2jcg-qqmg-46q6 monorepo-symlink-test placeholder version false positive 未关闭

难度 2/5 1-3 小时新手友好度 72/100

github/advisory-database#9164 · 1 个 reaction · 2026年8月19日创建
CVE-2026-5598 has incorrect fixed versions for bcprov-jdk packages 未关闭

难度 2/5 1-3 小时新手友好度 72/100

github/advisory-database#8994 · 2026年8月5日创建
GHSA-mh99-v99m-4gvg (brace-expansion): flat `<= 5.0.7` range misses backported fixes in 1.x, 2.x and 3.x 未关闭

难度 2/5 1-3 小时新手友好度 68/100

github/advisory-database#8898 · 4 条评论 · 1 个 reaction · 2026年7月30日创建
LDAP Injection in CMAK (Cluster Manager for Apache Kafka) via Search Filter 未关闭

难度 2/5 1-3 小时新手友好度 72/100

github/advisory-database#8841 · 2026年7月28日创建

查看 github/advisory-database 的全部 Issue

相似的 Issue

db commands hand psql the user and password still percent encoded 未关闭

bug

难度 2/5 1-3 小时新手友好度 82/100

hanami/hanami-cli#449 · 2026年9月25日创建
fix(pg-meta): schemas.update and schemas.remove DO blocks fail when a name contains "$$" 未关闭

external-issue to-triage

难度 2/5 1-3 小时新手友好度 88/100

supabase/supabase#50882 · 2026年9月24日创建
SqliteSaver.list(filter=...) silently misses nested metadata values containing non-ASCII text 未关闭

external

难度 2/5 1-3 小时新手友好度 65/100

langchain-ai/langgraph#9074 · 1 条评论 · 2026年9月24日创建
bug(arrow-odbc): SQL Server event store index guard never matches 未关闭

难度 2/5 1-3 小时新手友好度 92/100

litestar-org/sqlspec#816 · 2026年9月24日创建
JIT-compiled number -> Decimal conversion silently overflows instead of raising DECIMAL_OVERFLOW 未关闭

fuzz

难度 2/5 1-3 小时新手友好度 82/100

ClickHouse/ClickHouse#122114 · 2026年9月24日创建

更多 Databases Issue

精选适合新手参与的 GitHub issue 摘要。