advisory-database
advisory-database copied to clipboard
pypa
Contested advisory: GHSA-rwqr-c348-m5wr / CVE-2022-33124
This hasn't landed in the PyPA advisory database yet, but we should probably either manually purge it or mark it as contested (if possible) when it does.
Context: upstream does not believe that this advisory corresponds to a meaningful weakness or exploitable state (and I agree): https://github.com/aio-libs/aiohttp/issues/6801
GHSA: https://github.com/advisories/GHSA-rwqr-c348-m5wr
CVE: CVE-2022-33124 (already marked as disputed)
One point of confusion: pip-audit is already showing this vulnerability when using the default PyPI service, despite it not being present in this database. I guess that's because the PyPI service is pulling from other sources as well?
I guess that's because the PyPI service is pulling from other sources as well?
FYI I think I've seen some mentions of the CVE database while translating Warehouse.
CVE: CVE-2022-33124 (already marked as disputed)
I believe you meant to link https://nvd.nist.gov/vuln/detail/CVE-2022-33124 and not the same GH Advisory as in the previous line.
We should also document how reverts and contested advisories should work within this repo.
PyPI only gets it's data from OSV, but OSV may be pulling from other data sources including GHSA.
I believe you meant to link https://nvd.nist.gov/vuln/detail/CVE-2022-33124 and not the same GH Advisory as in the previous line.
Ugh, that looks like GitHub being too clever: I actually didn't link to the CVE at all, but GitHub auto-linked to their own advisory. I'll fix that now.
Edit: Fixed.
I think we should just be able to populate the withdrawn date? I believe we did it in the past for a loguru one. I can try to find it a bit later
I think we should just be able to populate the withdrawn date? I believe we did it in the past for a loguru one. I can try to find it a bit later
+1. withdrawn is intended for cases like this. Perhaps adding a line to the README.md would suffice?
Looks like this "vuln" has finally made its way in: https://github.com/pypa/advisory-database/commit/596fad27a24cb2fa855dbd1236628f6262177015
I'll look at marking it as withdrawn.
CC @Julian
https://github.com/pypa/advisory-database/pull/169 should withdraw this on the PYSEC side. I still haven't heard anything from MITRE (and I suspect we never will).