tree 2a924003e4cbcfc22b46190f3c79bfa5d55bb047
parent edf27d220c6e9607478c3e3402a10dd0b4838e01
author Tatiana Bradley <tatianabradley@google.com> 1701116955 -0500
committer Tatiana Bradley <tatianabradley@google.com> 1701119722 +0000

internal/report: fix bug in CVE5 generation

Fixes a bug in which incorrect version ranges were sometimes generated
when converting reports to CVE5. The bug happens when operating on a report
with no fixed version.

The problem is that the CVE JSON 5.0 format only allows version ranges
of the form "versions X to Y are affected", "versions X to Y are NOT affected"
or "version X is affected".

It does not directly allow the statement "version X and above are affected" - this must be expressed as "version 0 through X are unaffected, all others are affected". This change allows that to be expressed.

This bug became clear when we published GO-2023-2328. The CVE for that report
is also re-generated as a part of this change.

Change-Id: I0c61168581d65b13850d3a763a3300c04594b84c
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/545295
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>