Skip to content

Incorrect 'fixed' version for some Red Hat packages #422

@jasinner

Description

@jasinner

Take for example RHSA-2024:4420 The fixed in version in the corresponding OSV record have the incorrect fixed version, but only for the Red Hat:enterprise_linux:8::crb ecosystem:

RHSA-2024:4420

{
    "package": {
      "name": "SLOF-20210217-2.module+el8.10.0+20141+6faa2812.src.rpm",
      "ecosystem": "Red Hat:enterprise_linux:8::crb",
      "purl": "pkg:rpm/redhat/SLOF"
    },
    "ranges": [
      {
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "virt-devel:rhel"
          }
        ],
        "type": "ECOSYSTEM"
      }
    ]
  },

Expected Behavior:
Expect the record to look like this:

  {
     "package": {
       "name": "SLOF-20210217-2.module+el8.10.0+20141+6faa2812.src.rpm",
       "ecosystem": "Red Hat:enterprise_linux:8::crb",
       "purl": "pkg:rpm/redhat/SLOF"
     },
     "ranges": [
       {
         "events": [
           {
             "introduced": "0"
           },
           {
             "fixed": "2.module+el8.10.0+20141+6faa2812.src"
           }
         ],
         "type": "ECOSYSTEM"
       }
     ]
   },

Affects at least this OSV record and RHSA-2020:4058

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions