Data quality issue with CVE-2019-1387

The CVE ID
CVE-2019-1387

Describe the data quality issue observed
Git 2.43 is not affected (affects 2.24 and earlier), yet passing the Git 2.43 commit sha as input yields CVE-2019-1387 as a vulnerability.

curl -d \
  '{"commit": "564d0252ca632e0264ed670534a51d18a689ef5d"}' \
  "https://api.osv.dev/v1/query"

This is the head commit for Git 2.43:

commit 564d0252ca632e0264ed670534a51d18a689ef5d (HEAD -> v2.43.0, tag: v2.43.0, origin/maint)
Author: Junio C Hamano <gitster@pobox.com>
Date:   Mon Nov 20 08:47:38 2023 +0900

    Git 2.43

    Signed-off-by: Junio C Hamano <gitster@pobox.com>

Suggested changes to record
Should affect 2.24 and earlier.

Additional context
Add any other context about the problem here.

The root cause here is this is a CVE that is actually no longer being generated (because no viable fixed commits could be determined) and it should be deleted/withdrawn. I am going to work on #1467 which will take care of this and any other such records.

Adjust how converted records are copied

Adjust how converted records are copied to GCS (#2023)

This now behaves as expected:

$ curl -d \
  '{"commit": "564d0252ca632e0264ed670534a51d18a689ef5d"}' \
  "https://api.osv.dev/v1/query"
{}

Navigation Menu

Repository navigation

Data quality issue with CVE-2019-1387 #1961

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Data quality issue with CVE-2019-1387 #1961

Description

Activity

andrewpollock commented on Feb 19, 2024

andrewpollock commented on Apr 2, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions