advisory-database icon indicating copy to clipboard operation
advisory-database copied to clipboard

RustSec advisory Omission on potentially actionable fix(es)

Open pinkforest opened this issue 3 years ago • 0 comments

Follow-Up from: https://github.com/github/advisory-database/issues/683 as another issue

We typically strive hard to include actionable advice as to any fixes if any on informational advisories.

Currently GHSA Is omitting to include that actionable advice we've included -

This means when Dependabot raises issue with the repo maintainer they don't really know how to resolve it.

e.g. ansi_term we provided advice as to how to fix it: https://rustsec.org/advisories/RUSTSEC-2021-0139.html

But GHSA omitted this: https://github.com/advisories/GHSA-74w3-p89x-ffgh

Problem with omitting this information is that people tend to ignore advisories that have no actionable fixes.

Perhaps even saying in GHSA that the RustSec advisory referenced may contain actionable fixes as to how to resolve the advisory can help the advisory consumer.

pinkforest avatar Sep 17 '22 07:09 pinkforest