advisory-database
advisory-database copied to clipboard
RustSec advisory Omission on potentially actionable fix(es)
Follow-Up from: https://github.com/github/advisory-database/issues/683 as another issue
We typically strive hard to include actionable advice as to any fixes if any on informational advisories.
Currently GHSA Is omitting to include that actionable advice we've included -
This means when Dependabot raises issue with the repo maintainer they don't really know how to resolve it.
e.g. ansi_term we provided advice as to how to fix it: https://rustsec.org/advisories/RUSTSEC-2021-0139.html
But GHSA omitted this: https://github.com/advisories/GHSA-74w3-p89x-ffgh
Problem with omitting this information is that people tend to ignore advisories that have no actionable fixes.
Perhaps even saying in GHSA that the RustSec advisory referenced may contain actionable fixes as to how to resolve the advisory can help the advisory consumer.