search

OSSIndex / vulns

Report missing advisories and corrections on OSS Index
17 stars 12 forks source link

Incorrect vulnerability details #245

Closed garyrussell closed 1 year ago

garyrussell commented 2 years ago

Vulnerability URL Provide the URL to the vulnerability. For example:

https://ossindex.sonatype.org/vulnerability/582c0431-063e-4781-99ae-014899f1438d?component-type=maven&component-name=io.projectreactor.kafka.reactor-kafka

Component URL Provide the URL to the component. For example:

https://ossindex.sonatype.org/component/pkg:maven/io.projectreactor.kafka/reactor-kafka@1.3.10

Description That report is incorrect; this project moved to Apache Kafka 2.6.1 in version 1.3.2 and to 2.8.1 in version 1.3.8.

POM: https://repo1.maven.org/maven2/io/projectreactor/kafka/reactor-kafka/1.3.10/reactor-kafka-1.3.10.pom

ken-duck commented 2 years ago

Hi! Sorry for the delay, but I respond with good news.

OSS Index is going through a major upgrade, as described here: https://ossindex.sonatype.org/updates-notice

The most clear and obvious benefit is far fewer false negatives and false positives, and vulnerabilities will be added to the system on a much more frequent and rapid basis. Once the upgrade is completed you should see most (if not all) of the reported data issues be resolved.

ken-duck commented 1 year ago

Closing old issues. This particular issue was resolved by the aforementioned upgrade.