search

google / osv.dev

Open source vulnerability DB and triage service.
https://osv.dev
Apache License 2.0
1.49k stars 180 forks source link

Data quality issue with https://osv.dev/vulnerability/PYSEC-2024-71 #2568

Closed edufresne closed 1 week ago

edufresne commented 1 week ago

It looks like this issue was solved in fix version: 5.0.0 but this vulnerability is still labelled as 5.* as an affected version.

Additional context Looking at the flask-cors last 5.0.0 release, it looks to have addressed this issue:

Should this vulnerability be marked as having a fix version? Maybe this is an issue with the project itself and not a data integrity issue?

MindaugasBernatavicius commented 1 week ago

Indeed, this affects pip-audit results and delays "time to resolution" metrics in environments that track this for auditing purposes.

Issue alias is listed as "fix available": https://osv.dev/vulnerability/GHSA-hxwh-jpp2-84pm . PYSEC-2024-71 has it's import datasource as: https://github.com/pypa/advisory-database/blob/main/vulns/flask-cors/PYSEC-2024-71.yaml from pypa advisory. Pypa say that they use nist feeds https://nvd.nist.gov/vuln/data-feeds and this tool: https://github.com/google/osv.dev/tree/master/vulnfeeds - to match vulnerabilities by ids or something like that.

Does this need to be fixed upstream in Pypa advisory repo? Or even the original vuln report: https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d ?

hogo6002 commented 1 week ago

PYSEC-2024-71 has it's import datasource as: https://github.com/pypa/advisory-database/blob/main/vulns/flask-cors/PYSEC-2024-71.yaml from pypa advisory.

That is correct. It's imported from upstream, including the affected versions.

Does this need to be fixed upstream in Pypa advisory repo? Or even the original vuln report: https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d ?

Yes, it will need to be fixed in the PyPa advisory repo first. I guess we don't have anything to do here until upstream fixes this. Do you have anything to add on this issue @andrewpollock ?

github-actions[bot] commented 1 week ago

:sparkles: Thank you for your interest in OSV.dev's data quality! :sparkles:

Please review our FAQ entry on how to most efficiently have this addressed.

andrewpollock commented 1 week ago

Yes, from OSV.dev's perspective, the upstream record is https://github.com/pypa/advisory-database/blob/main/vulns/flask-cors/PYSEC-2024-71.yaml and should be corrected by following https://github.com/pypa/advisory-database?tab=readme-ov-file#contributing-advisories