Wrong "Package" for advisory GHSA-687q-32c6-8x68

[Marcono1234]

Hello,
it looks like the "Package" for the advisory GHSA-687q-32c6-8x68 is incorrect. It is avideo/avideo instead of wwbn/avideo.

Note that there are actually two distinct variants of GHSA-687q-32c6-8x68 (due to how GitHub's vulnerability reporting works):

• repository advisory https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68
  The incorrect metadata in this one can only be fixed by a maintainer.
• database advisory https://github.com/advisories/GHSA-687q-32c6-8x68
  The incorrect metadata can be fixed by anyone (through the "Suggest improvements for this vulnerability" link at the bottom right corner). In case you don't want to edit it, I can give it a try.

Also, it seems some of the recent advisories have 'surprising' affected versions, are those intended?

• GHSA-5m4q-5cvx-36mw, GHSA-ghx5-7jjg-q2j7 (repo-advisory only): <= 27.0 even though 27.0 has not been released yet (?) and both vulnerabilities have commits mentioning them on master, so should this rather be <= 26.0?
• GHSA-f359-r3pv-2phf (repo & db advisory): <= 14.3; given that this is a pretty recent report and a commit mentioning it has also recently been pushed to master, shouldn't that be <= 26.0 potentially?

[DanielnetoDotCom]

Thanks for the detailed report!

You are correct on all points. Our master branch always reflects the latest release — we just published release 29.0 which includes the fixes for all the referenced vulnerabilities. The affected versions for GHSA-5m4q-5cvx-36mw, GHSA-ghx5-7jjg-q2j7, and GHSA-f359-r3pv-2phf should all be <= 26.0, and we will update the advisories accordingly.

Regarding GHSA-687q-32c6-8x68, the correct package name is wwbn/avideo — we'll fix the repository advisory. Feel free to also submit the suggestion on the database advisory if you'd like, that would be appreciated.

[Marcono1234]

Thanks!

I think I found two others which might also have the wrong version:
Should GHSA-4wmm-6qxj-fpj4 and GHSA-v467-g7g7-hhfh (both repo and db advisory) have <= 25.0 (it seems they were fixed in 26.0)? Currently they say <= 14.0.

[DanielnetoDotCom]

thanks, but there is no option for me to edit them

[Marcono1234]

For the advisories in the advisory database (https://github.com/advisories) there should be a "Suggest improvements for this vulnerability" link at the bottom right, respectively you can just append /improve to the URL, e.g. https://github.com/advisories/GHSA-v467-g7g7-hhfh/improve
I have created PRs to fix those two advisories as well, see GitHub references above.

[Marcono1234]

but there is no option for me to edit them

Or did you mean repository advisories? I think there should be an "Edit advisory" button at the top right.
I think the following repository advisories still need changes:

• https://github.com/WWBN/AVideo/security/advisories/GHSA-5m4q-5cvx-36mw: affected version <= 0.26
• https://github.com/WWBN/AVideo/security/advisories/GHSA-ghx5-7jjg-q2j7: affected version <= 0.26
• https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf: affected version <= 0.26
• https://github.com/WWBN/AVideo/security/advisories/GHSA-4wmm-6qxj-fpj4: affected version <= 0.25
• https://github.com/WWBN/AVideo/security/advisories/GHSA-v467-g7g7-hhfh: affected version <= 0.25

Thanks that you checked and approved the edits to the global advisories in the advisory DB already!

[github-actions]

This issue has been automatically closed because it has not had activity in over 3 months. Feel free to reopen if it is still relevant. Thank you for your contributions.

[github-actions]

This issue has been automatically closed due to inactivity. Feel free to reopen if you still need help.