The current heuristic for parsing OSV advisories ignores the introduced version when last_known_affected_version_range is available in database_specific field, which is incorrect.
Example:
GHSA-cgjx-mwpx-47jv has following affected range
{
"package": {
"ecosystem": "npm",
"name": "express-restify-mongoose"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 3.0.1"
}
}and current osv parser resolves this to:
impacted_packages:
- purl: pkg:npm/express-restify-mongoose
affected_versions: vers:npm/<=3.0.1
fixed_versions: vers:npm/3.1.0this is incorrect more accurate affected_versions would be vers:npm/>=3.0.0|<=3.0.1.
The current heuristic for parsing OSV advisories ignores the
introducedversion whenlast_known_affected_version_rangeis available indatabase_specificfield, which is incorrect.Example:
GHSA-cgjx-mwpx-47jv has following affected range
{ "package": { "ecosystem": "npm", "name": "express-restify-mongoose" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.0" } ] } ], "database_specific": { "last_known_affected_version_range": "<= 3.0.1" } }and current osv parser resolves this to:
this is incorrect more accurate affected_versions would be
vers:npm/>=3.0.0|<=3.0.1.