search

google / osv.dev

Open source vulnerability DB and triage service.
https://osv.dev
Apache License 2.0
1.52k stars 188 forks source link

`Fix available` tags are not accurate when multiple ecosystems are combined together #2491

Open hogo6002 opened 2 months ago

hogo6002 commented 2 months ago

The vulnerability list page on OSV.dev currently displays a Fix available tag for vulnerabilities if at least one affected package has a fix. But when filtering vulnerabilities by a specific ecosystem, the Fix available tag remains the same even if the fix is only available for a package in a different ecosystem. It would be more accurate to display the Fix available tag based on the currently selected ecosystem filter.

Example: https://osv.dev/vulnerability/CVE-2024-43374 (no fix for Debian) image

github-actions[bot] commented 2 weeks ago

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.