Missing CakePHP Security Advisories without CVE ID

[ravage84]

According to About the GitHub Advisory database:

We add advisories to the GitHub Advisory Database from the following sources:
[...]
The FriendsOfPHP database

But of the seven currently listed CakePHP framework security advisories in FriendsOfPHP/security-advisories, only one can be found int he GHSA database.

Namely the only one with a CVE:

https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/CVE-2019-11458.yaml
GHSA-qhrx-hcm6-pmrw

The other four do not have a CVE:

https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2014-04-29.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-07.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-28.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-08-06.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-11-05.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2018-05-20.yaml

Listed security advisories on Packagist (lists FriendsOfPHP/security-advisories & GHSA).

1. Is a linked CVE available in the raw data of FriendsOfPHP/security-advisories a requirement for being imported into the GSA database?
2. If so, could this be documented?
3. If not, how can these missing CakePHP security advisories be imported into the GHSA database?

Could be related to #115

[KateCatlin]

Hey @ravage84, thanks for reaching out!

It looks like the advisories that are not in our database are all from years prior to us importing from FriendsOfPHP. We are constantly backfilling older advisories and historical FriendsofPHP advisories are on our radar to get to!

In the interim, we're going to go ahead and backfill these six advisories since you brought them to our attention.

Cheers,

Kate Catlin
Senior Product Manager, GitHub Advisory Database

[ravage84]

@KateCatlin I am going to close this issue as it seems all of the past security advisories in question have been imported:

1. GHSA-829q-v5g8-hhxc
2. GHSA-j9q2-f9q7-jhgq
3. GHSA-q79m-c546-2g63
4. GHSA-6hg4-vp5q-47mw
5. GHSA-p76f-wr22-4rv6
6. GHSA-xwhj-pqcg-8rcr

Thank you very much!

[KateCatlin]

Thanks @ravage84! Sorry we didn't get back to you on that, but yes we did indeed prioritize getting these in the system!