search

OSSIndex / vulns

Report missing advisories and corrections on OSS Index
17 stars 12 forks source link

Bug: `node-canvas` Incorrect vulnerability details #326

Open vladmandic opened 2 years ago

vladmandic commented 2 years ago

Vulnerability URL https://ossindex.sonatype.org/vulnerability/sonatype-2019-0142

Description

pkg:npm/canvas@2.10.0 - 1 vulnerability found!

  Vulnerability Title:  1 vulnerability found
  ID:  sonatype-2019-0142
  Description:  1 non-CVE vulnerability found. To see more details, please create a free account at https://ossindex.sonatype.org/ and request for this information using your registered account
  CVSS Score:  8.6
  CVSS Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  Reference:  https://ossindex.sonatype.org/vulnerability/sonatype-2019-0142

however, this vulnerability was fixed long time ago - it clearly states that it only impacts versions 1.6.9 and below and here vulnerability is reported for version 2.10.0!

see for fix confirmation https://github.com/advisories/GHSA-vpq5-4rc8-c222

this seems to be a NEW false-positive as it was not reported for recent versions, so there may be a semver compare mismatch on ossindex side?

ken-duck commented 1 year ago

Sorry for the delay.

Thank you for your report. We are migrating to a new email-based reporting system in order to better mesh with our internal processes, which will allow us to be more reactive to our users. I have moved your request to the internal tracking system and the research team will look into the issue shortly.

If you notice further issues or would like to follow up on this one, please email ossindex@sonatype.org