Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add helper to split a ranges with patch backports #127

Open
pombredanne opened this issue Nov 14, 2023 · 0 comments
Open

Add helper to split a ranges with patch backports #127

pombredanne opened this issue Nov 14, 2023 · 0 comments

Comments

@pombredanne
Copy link
Member

reported by @kwwall in this comment

Is there a way that this new version notation for dependency and vulnerability ranges can be made to work for back-ported vulnerability patching like Red Hat and other Linux vendors often do? We get a lot of FPs in SCA tools because they don't recognized back-ported patches.

Say you have a range of vulnerable versions from 3.0 to 5.4, and that a patch fix the vulnerability in 5.5 is backported to 3.5 and 4.5, I would like to have a simpler way to obtain a new range looking like this: from 3.0 to before 3.5, from 4.0 to before 4.5, from 5.0 to 5.4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant