Comments (6)
@hogo6002 can you please take a look?
from osv.dev.
DSA-5649-1 doesn't have any affected versions info, so we skipped this one.
We only convert DSA with vulnerable and fixed packages info, such as
from osv.dev.
We also don't have its Debian security tracker information in our database (https://osv.dev/vulnerability/CVE-2024-3094) because this vuln doesn't affect any stable Debian release. For the Debian unstable release, the vulnerability has not yet assigned
as its urgency level, and we don't include vulnerabilities with that tag in our OSV.
"CVE-2024-3094":{"description":"....","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.4.1-0.2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.5-2.1~deb11u1","bullseye-security":"5.2.5-2.1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.6.2-2"},"fixed_version":"5.6.1+really5.4.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.6.2-2"},"fixed_version":"5.6.1+really5.4.5-1","urgency":"not yet assigned"}}}}
from osv.dev.
Thanks for investigating! I wonder if we need to ask the upstream Debian Security Tracker maintainers about this particular case?
from osv.dev.
Thanks for investigating! I wonder if we need to ask the upstream Debian Security Tracker maintainers about this particular case?
Yeah, I do see some cases where the urgency tag remains not yet assigned
and never changes. I will send them an email to ask this type of cases.
from osv.dev.
I will close this issue as the DSA behaviour is as expected.
For Debian Security Tracker issues, track here (#2482)
from osv.dev.
Related Issues (20)
- Crucial bug: osv-scanner does not detect known malicious package in lockfiles HOT 8
- Git analysis: relax branch computation
- Update Documentation Logos for Dark Theme Consistency
- Solution hashes for a vulnerability lies in an external fork HOT 3
- Missing `Packages` for some malicious packages HOT 1
- Export an `all.zip` containing every vulnerability.
- Invalidate `last_update_date` when source changes
- Sustainably ensure invalidly prefixed records are not imported HOT 3
- The importer does not honour ignore_patterns for REST sources HOT 1
- Automate submodule updates
- Strange behaviour in PyPI versions HOT 7
- Data quality issue with GHSA-4943-9vgg-gr5r HOT 2
- Improve CVE entry management in OSV HOT 15
- Affected methods by a vulnerability HOT 1
- Query API for Ubuntu `linux` packages HOT 7
- Combine all `not yet assigned` Debian Security Tracker issues into OSV
- Missing CVSS_V4 Severity Type in osvSeverityType Enum in Swagger Definition
- CI/CD: Add GitHub Actions Workflow to validate Swagger documentation
- `Fix available` tags are not accurate when multiple ecosystems are combined together
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from osv.dev.