Some advisories do not explicitly mention the version in the solution field
For about 570 advisories (~8%), we do not explicitly show the version to which we should upgrade to in the solution
field. For example: https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/master/pypi/SOAPpy/CVE-2014-3243.yml. The
---
identifier: "CVE-2014-3243"
package_slug: "pypi/SOAPpy"
title: "Billion laughs attack vulnerability"
description: "It is vulnerable to a Billion laughs attack."
date: "2014-05-13"
pubdate: "2014-05-12"
affected_range: ">=0.0,<0.12.6"
fixed_versions:
- "0.12.6"
affected_versions: "All versions starting from 0.0 before 0.12.6"
solution: "Upgrade to the latest version."
urls:
- "http://en.wikipedia.org/wiki/Billion_laughs"
- "http://www.pnigos.com/?p=260"
cvss_v2: "AV:N/AC:L/Au:N/C:N/I:N/A:P"
uuid: "7ed94d3b-cacd-49d0-91e2-4c2fb1537781"
As the fixed_version
array already contains the fixed version we can just re-generate the solution field accordingly. We should also add a CI check that makes sure that if a fixed_version
is defined, it should be mentioned in the solution field.