Automatic update of OpenVEX Statements for erlang/otp #10381
Conversation
|
|
CT Test Results 3 files 135 suites 49m 25s ⏱️ Results for commit 45df779. ♻️ This comment has been updated with latest results. To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass. See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally. Artifacts
// Erlang/OTP Github Action Bot |
fixes wrong starting version of "CVE-2023-48795". as such, it is included the correct generated version starting from `ssh-5.0`
| { | ||
| "pkg:otp/[email protected]": "CVE-2023-48795", | ||
| "status": { | ||
| "affected": "Mitigation: If strict KEX availability cannot be ensured on both connection sides, affected encryption modes(CHACHA and CBC) can be disabled with standard ssh configuration. This will provide protection against vulnerability, but at a cost of affecting interoperability", | ||
| "fixed": [ | ||
| "pkg:otp/[email protected]" | ||
| ] | ||
| } | ||
| }, |
There was a problem hiding this comment.
the starting version I wrote for this table was not correct.
the script was able to detect that we were missing the correct version, ssh-5.0, but could not re-generate the correct versions by itself for the otp-26.openvex.json file.
This is a special case, simply because the script generates the correct versions assuming it starts from 0.
In cases where we manually write wrongly the versions, we have to simply remove the CVE and run .github/scripts/otp-compliance.es vex run -b otp-26 to generate the correct versions.
This is what my commit shows.
Automatic Action. There is a vulnerability from GH Advisories without a matching OpenVEX statement