search

junit-team / junit4

A programmer-oriented testing framework for Java.
https://junit.org/junit4
Eclipse Public License 1.0
8.53k stars 3.29k forks source link

CVE-2020-15250 doesn't affect versions prior to 4.7 but claims it did #1676

Closed bodewig closed 4 years ago

bodewig commented 4 years ago

https://github.com/advisories/GHSA-269g-pwp5-87pp says it affects any version prior to 4.13.1 which is not true as rules didn't exist before 4.7. So the proper range would be 4.7 up to 4.13.

This is probably not terribly important but it caused dependabot to cry wolf on projects that are (deliberately) still using older versions - like extensions for JUnit 3 that happen to be still maintained. The same is/will soon be true for a bunch of other static code analyzers checking oldish code bases.

marcphilipp commented 4 years ago

Thanks for raising the issue! You're right, of course.

@jlleitschuh I changed it here but that doesn't seem to update the published advisory. Do you know how that can be achieved?

JLLeitschuh commented 4 years ago

I'll send an email

bodewig commented 4 years ago

Many thanks @marcphilipp and @JLLeitschuh . The advisory has been updated.

gamma commented 4 years ago

Sorry to bother here, but it seems that the given CVE is still recognised by OSSINDEX for version 4.13.1, see https://ossindex.sonatype.org/component/pkg:maven/junit/junit@4.13.1

marcphilipp commented 4 years ago

I raised https://github.com/OSSIndex/vulns/issues/127 to get it fixed.