Change in affected versions for GHSA-5mg8-w23w-74h3 not picked up by OSV

For Maven package com.google.guava:guava, the affected version range was changed from <= 30.0 to <= 29.0 both on GHSA as well as on NVD, but OSV did not update the list of affected versions. It seems the change is registered in the Last affected field, but not in the list of affected versions.

See the following references:

• https://osv.dev/vulnerability/GHSA-5mg8-w23w-74h3
• https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-5mg8-w23w-74h3/GHSA-5mg8-w23w-74h3.json
• https://nvd.nist.gov/vuln/detail/CVE-2020-8908

[oliverchang]

29.0 on its own does not exist for com.google.guava:guava. Instead, the available versions for this package are 29.0-android and 29.0-jre according to https://deps.dev/maven/com.google.guava%3Aguava.

Both of these sort after 29.0 according to the Maven spec, so last_affected does not capture these. If these 29.0-* versions are intended to be included, we’ll need to suggest the change to GitHub’s advisory entry to include them.

[p3pijn]

@oliverchang Thanks for the clear explanation and the fix!