The CVE ID
ALPINE-CVE-2023-45853
Describe the data quality issue observed
The OSV record incorrectly shows all Alpine branches (v3.15 – v3.22) as affected with an unbounded range:
"events": [{"introduced":"0"},{"fixed":"0"}]This causes tools to treat every version of zlib, including 1.3.1, as vulnerable.
However, according to Alpine’s own security tracker, the vulnerable range is zlib < 1.3.1, since the issue (in MiniZip, not core zlib) was fixed upstream in 1.3.1.
Source of truth:
🔗 https://security.alpinelinux.org/vuln/CVE-2023-45853
The tracker clearly lists:
Match rules → zlib >= None and < 1.3.1
and notes “MiniZip is not a supported part of the zlib product” and “fixed upstream”.
Suggested changes to record
For each affected Alpine branch, change the range to:
"events": [
{"introduced": "0"},
{"fixed": "1.3.1"}
]Optionally, refine the package scope to minizip (or add a clarification in database_specific) since the CVE concerns the MiniZip component, not core zlib.
Additional context
The CVE ID
ALPINE-CVE-2023-45853
Describe the data quality issue observed
The OSV record incorrectly shows all Alpine branches (
v3.15–v3.22) as affected with an unbounded range:This causes tools to treat every version of
zlib, including 1.3.1, as vulnerable.However, according to Alpine’s own security tracker, the vulnerable range is zlib < 1.3.1, since the issue (in MiniZip, not core zlib) was fixed upstream in 1.3.1.
Source of truth:
🔗 https://security.alpinelinux.org/vuln/CVE-2023-45853
The tracker clearly lists:
Suggested changes to record
For each affected Alpine branch, change the range to:
Optionally, refine the package scope to
minizip(or add a clarification indatabase_specific) since the CVE concerns the MiniZip component, not core zlib.Additional context
This indicates the OSV Alpine importer (
cve-osv-conversionbucket) either used stale data or mis-parsed the< 1.3.1boundary.