ipython showing up as vulnerable, but installed version looks OK

Hello, and thanks for the effort to create this!

I just tried out a test run against several projects. I bumped into this false positive result related to ipython.

$ pip-audit
Name         Version ID             Fix Versions
------------ ------- -------------- -----------------
...
ipython      7.27.0  PYSEC-2014-21  1.2.0
...

• the installed ipython version is 7.27.0.
• the vulnerable ipython version is 1.2.0 (also prevalent from the vuln-id that says 2014)

The right thing would have been to understand that the installed version is newer than the vulnerable version and not show this entry at all.

Let me know if I can help with any other information.

[tetsuo-cpp]

Thanks for the information @c00kiemon5ter!

From looking at the data source in OSV (which is where PyPI is getting the vulnerability data), it looks like the affected versions data is incorrect as it doesn’t match with the introduced/fixed data. Either that or there are fix versions missing from the data.

CC: @di @oliverchang

[woodruffw]

As a side note, we should probably add an issue template here that directs people there for these types of issues.

Yep, I was just thinking that yesterday. I’ll work on adding some issue templates today.