rubysec/bundler-audit

v0.8.0.rc1 does not print GHSA IDs for vulnerabilities with no other identifiers

mikesaelim opened this issue · 2 comments

mikesaelim commented

I was looking at the changes between v0.7.0.1 and v0.8.0.rc1, to prepare the ruby_audit gem to be compatible with your upcoming release (we love your work, by the way), and I think that the Bundler::Audit::CLI::Formats::Text class lost some of the changes introduced in #217 to print out GHSA IDs. So when a vulnerability only has a GHSA ID, no identifier is printed out.

postmodern commented

Good catch. I could add an Advisory#identifier method that returns the first available identifier (cve_id vs ghsa_id vs osvdb_id (legacy)), or we could use the Advisory#id which is derived from the advisory file-name (sans the .yml ext).

  • 👍1
mikesaelim commented

Either sounds good to me. Thanks for looking into this issue!