GHSA improperly consumes and re-publishes CVE version metadata

[daniel-beck]

Whatever process is used to create GitHub Security Advisories does not consume version ranges from CVE metadata properly.

This results, for example, in GHSA-g975-f26h-93g8 claiming that version 2.24.2 is affected, when https://github.com/CVEProject/cvelist/blob/9a1d65a12274643c9bad407acb8368f2b60d2b5c/2022/43xxx/CVE-2022-43408.json#L22-L25 specifically excludes it.

This creates a ton of unnecessary confusion for users and false positive security scan results, and should be fixed.

[darakian]

Apologies about that. I've updated our advisory to reflect the CVE and I'll dig into what went wrong there. Thanks 👍

[daniel-beck]

@darakian Thanks! To clarify, the above is an example of a very common problem for us, there are almost 100 more CVEs in which we exclude backports since 2020, and almost all of them are improperly represented in their corresponding GHSAs. I reviewed our CVE entries that specify backports as exclusions from the range and list the results below. I hope this review/feedback helps you identify possible problems in the GHSA process.

That said, after thinking about this a bit, I consider CVE JSON v4 as underspecified. It does not seem to specify the semantics of overlapping version specifiers/ranges, other than the example being

"Product X between versions 10.2 and 10.8"

which probably involves a >= and a <= range (but might be !> and !< with no inclusion range at all). To keep ranges reasonable, we interpret it as exclusions taking precedence over inclusions for our otherwise straightforward ranges. That way, our metadata doesn't have to look like GHSA-rvg5-f5fj-mxvg which could result in reading/comprehension issues. If we're indeed wrong about this, I would appreciate if you could point us to the documentation for this.

Review of GHSA 2020-2022

• Correct 👍
  • CVE-2022-29036
  • CVE-2022-43408
• Correct affected ranges, but missing the latest fix version, only listing the backport
  • CVE-2022-29045
  • CVE-2022-29049
• Does not exclude backports, and additionally simplification of SHA-based version results in non-existent fix version, or potentially a bad affected range boundary
  • CVE-2022-20613 (affected)
  • CVE-2022-20614 (affected)
  • CVE-2022-25175 (fixed)
  • CVE-2022-43401 (affected)
  • CVE-2022-43402 (affected)
  • CVE-2022-43403 (affected)
  • CVE-2022-43404 (affected)
  • CVE-2022-43405 (affected)
  • CVE-2022-43407 (both)
• Does not exclude backports, and no fix version specified even though it was announced as fixed
  • CVE-2022-23106
  • CVE-2022-25179
  • CVE-2022-34176
  • CVE-2022-34177
• Does not exclude backports
  • CVE-2020-2252
  • CVE-2020-2279
  • CVE-2020-2299
  • CVE-2020-2300
  • CVE-2020-2301
  • CVE-2020-2305
  • CVE-2020-2306
  • CVE-2020-2307
  • CVE-2020-2308
  • CVE-2020-2309
  • CVE-2021-21648
  • CVE-2021-21649
  • CVE-2021-21650
  • CVE-2021-21651
  • CVE-2022-20615
  • CVE-2022-20616
  • CVE-2022-20618
  • CVE-2022-20619
  • CVE-2022-20620
  • CVE-2022-20621
  • CVE-2022-23107
  • CVE-2022-25173
  • CVE-2022-25174
  • CVE-2022-25176
  • CVE-2022-25177
  • CVE-2022-25178
  • CVE-2022-25180
  • CVE-2022-25181
  • CVE-2022-25182
  • CVE-2022-25183
  • CVE-2022-25187
  • CVE-2022-30947
  • CVE-2022-30948
  • CVE-2022-30952
  • CVE-2022-30953
  • CVE-2022-30954
  • CVE-2022-36881
  • CVE-2022-36882
  • CVE-2022-36883
  • CVE-2022-36884
  • CVE-2022-36885
  • CVE-2022-36886
  • CVE-2022-36889
  • CVE-2022-36890
  • CVE-2022-36891
  • CVE-2022-43409
• Unreviewed
  • CVE-2020-2253
  • CVE-2020-2254
  • CVE-2020-2255
  • CVE-2020-2258
  • CVE-2020-2302
  • CVE-2020-2303
  • CVE-2020-2311
  • CVE-2020-2322 (but this exclusion does not matter as it's not in the range, basically bad data from us but should not impact consumers)
  • CVE-2021-21621
  • CVE-2021-21623
  • CVE-2021-21626
  • CVE-2021-21641
  • CVE-2021-21647
  • CVE-2021-21678
  • CVE-2021-21680
  • CVE-2021-21684
  • CVE-2022-23105
  • CVE-2022-25184
  • CVE-2022-27195
  • CVE-2022-27196
  • CVE-2022-27197
  • CVE-2022-27198
  • CVE-2022-27199
  • CVE-2022-29041
  • CVE-2022-29047
  • CVE-2022-30945
  • CVE-2022-30946
  • CVE-2022-38663

[darakian]

Hey @daniel-beck,

Ya digging into this we ignore the cve product versions as they are a. uncommon and b. under specified leading to them being an unreliable source of information. We're in the process of migrating to CVE JSON v5 as well so, I don't expect our v4 support to change anytime soon.

For that list of CVEs I've made an internal issue for us to re-review them. I'll update you here when we can process them. Many thanks for letting us know 👍