CVE status for GHSA-8wmh-xr5f-qvj7

[sunder-oss]

Hi @Eugeny, thanks for fixing the SSH agent forwarding issue in 1.0.236.

I'm the reporter of GHSA-8wmh-xr5f-qvj7. The advisory shows a CVE was requested last month, but no CVE has been assigned yet, and I can no longer comment on the advisory.

Could you please:

1. Check whether the CVE request still shows as "pending" in the advisory.
2. Correct the affected version range. It currently says "< 1.0.235", but 1.0.235 is affected. It should be "<= 1.0.235" (patched: 1.0.236).
3. If the request is still pending, contact GitHub Support (security advisory / CVE category) with the GHSA ID and the request date.

GitHub normally reviews CVE requests within 72 hours.

Thanks!

[Eugeny]

Unfortunately GitHub is sometimes taking excessively long to assign a CVE, im seeing it on other projects too. A month is on the higher end but I have already seen longer

[sunder-oss]

Okay thanks for the update !