Skip to content

summit v0.6.3 - range-based CVEs, modern database, YAML specs

Choose a tag to compare

View all tags
@incr3d1ble incr3d1ble released this 16 Oct 04:20
· 46 commits to main since this release
v0.6.3
1047b85

The CVE database grows up - from exact-string matching to proper version ranges, plus new dependencies that earn their place.

New dependencies (requirements.txt / pyproject)

  • packaging>=23.0 - correct PEP-440 version comparison for CVE ranges (0.3 < 0.10 the way humans mean it)
  • pyyaml>=6.0 - YAML OpenAPI specs load natively, no conversion step

CVE database modernized

  • ranges replace exact strings: >=2.4.49,<2.4.50 style, matched with packaging
  • Heartbleed (CVE-2014-0160) added for OpenSSL 1.0.1 through 1.0.1f (non-PEP440 versions handled via exact lists)
  • Ghostcat (CVE-2020-1938) added with per-branch Tomcat ranges (fixed in 9.0.31 / 8.5.51 / 7.0.100 / 6.0.53 - boundary tests prove 9.0.30 fires and 9.0.31 does not)
  • CVE-2019-11043 (PHP) widened to its real affected range with the "certain configurations" caveat stated

Docs

  • examples/openapi.yaml proves YAML spec loading end to end

Boundary tests: 2.4.48 (below) and 2.4.51 (above) do NOT match; 2.4.49 and 2.4.50 do. 68 tests, evidence 21/21. CI green.

Assets 2
Loading