Andrew Pollock

icon company OpenSSF icon location Brisbane icon location I'm an independent technologist, with an interest in open source vulnerability management and related software supply chain security

Results 283 comments of Andrew Pollock

Data quality issue with CVE-2021-42384

Version enumeration does not appear to be identifying 1.30.1 or the 1_30_1 tag, by the looks of it, so it stands to reason it's also not enumerating the related commits...

Data quality issue with CVE-2021-42384

My current conclusion is that this is an issue in the version enumeration/repository analysis code and not the CVE conversion itself.

GHSA-c5pj-mqfh-rvc3 Still in osv

Based on: https://osv.dev/GHSA-c5pj-mqfh-rvc3 clearly marks the record as withdrawn and https://osv.dev/GHSA-c5pj-mqfh-rvc3.json has the `withdrawn` field set I don't think there is anything actionable here. As @michaelkedar has pointed out, [the...