Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix version was missing for certain packages for osv #136

Merged
merged 1 commit into from
May 23, 2024

Conversation

prabhu
Copy link
Contributor

@prabhu prabhu commented May 23, 2024

With this PR, the fix version shows up for certain python packages that have a start version of 0.

python vdb/cli.py --search "pkg:pypi/ujson@5.2.0"

+----------------+-----------------+--------------------+---------------+---------+------------+---------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Id             | Package         | Affected Version   | Fix Version   | CWE     | Severity   |   Score | Description                                                                                                                                                                                                                      |
+================+=================+====================+===============+=========+============+=========+==================================================================================================================================================================================================================================+
| CVE-2022-31117 | pypi:pypi:ujson | >=1.15-<=5.3.0     | 5.4.0         | CWE-415 | MEDIUM     |     5.9 | # Potential double free of buffer during string decoding                                                                                                                                                                         |
|                |                 |                    |               |         |            |         | ### Impact                                                                                                                                                                                                                       |
|                |                 |                    |               |         |            |         | _What kind of vulnerability is it? Who is impacted?_                                                                                                                                                                             |

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu
Copy link
Contributor Author

prabhu commented May 23, 2024

python vdb/cli.py --search "pkg:pypi/gunicorn@20.0.4"
| CVE-2024-1135 | pypi:pypi:gunicorn | >=0.1-<=21.2.0     | 22.0.0        | CWE-444 | HIGH       |     8.2 | # Request smuggling leading to endpoint restriction bypass in Gunicorn                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
|               |                    |                    |               |         |            |         | Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability has been shown to allow access to endpoints restricted by gunicorn. This issue has been addressed in version 22.0.0. |
|               |                    |                    |               |         |            |         |                                                                                                       

@prabhu prabhu merged commit 6ae5e8c into release/5.x May 23, 2024
15 checks passed
@prabhu prabhu mentioned this pull request May 23, 2024
@prabhu prabhu deleted the fix/osv-fix-version-fallback branch May 23, 2024 11:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant