Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Schema issue with CAN-2022-1000071

See original GitHub issue

Hello, I maybe wrong where to report this issue but let me try.

CAN-2022-1000071 in https://osv-vulnerabilities.storage.googleapis.com/GSD/all.zip violates the OSV schema.

{
  "id": "CAN-2022-1000071",
  "summary": "Default Credentials in XB6 Fibre+ Gateway version XB6_0821",
  "details": "In Shaw Communications Inc XB6 Fibre+ Gateway version XB6_0821 a Default Credentials exists in the Router/Modem that can be attacked via local access resulting in Admin access to router",
  "modified": "2022-02-01T19:38:14.238938Z",
  "published": "2022-02-01T19:38:14.238938Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://support.shaw.ca/t5/internet-articles/guide-fibre-gateway-xb6-xb7/ta-p/5114"
    },
    {
      "type": "WEB"
    }
  ],
  "affected": [
    {
      "package": {
        "name": "XB6 Fibre+ Gateway",
        "ecosystem": "GSD"
      },
      "versions": [
        "XB6_0821"
      ],
      "database_specific": {
        "source": "https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000071.json"
      }
    }
  ],
  "schema_version": "1.3.0"
}

reference (in references) should have url but not. I cannot find the original data source. So maybe there is something wrong the original data side not osv.dev side.

Issue Analytics

State:
Created a year ago
Comments:20 (13 by maintainers)

Top GitHub Comments

1reaction

kurtseifriedcommented, Oct 6, 2022

Correct. As I said we’re still working on our file format. Hopefully, in a few weeks, we’ll have a solution and converted data.

0reactions

andrewpollockcommented, Oct 24, 2022

@oliverchang what are your thoughts on:

Marking CAN-2022-1000071 (and the other single-digit number of CAN-* records) as invalid

Marking GSD-2022-1006324 as invalid

Then I think we can call this specific issue closed, and focus on the broader issues captured earlier on this issue.

Sounds good to me!

CAN-2022-1000071 CAN-2022-1000284 CAN-2022-1002518

marked as invalid

GSD-2022-1006324

marked as invalid