[GHSA-6c5p-j8vq-pqhj] python-jose algorithm confusion with OpenSSH ECDSA keys #6668
Conversation
github-actions
bot
changed the base branch from
main
to
MachineNativeOps/advisory-improvement-6668
There was a problem hiding this comment.
Pull request overview
This pull request updates a security advisory for python-jose algorithm confusion vulnerability (CVE-2024-33663). The PR removes the CVSS v3 score while retaining the CVSS v4 score and updates the modification timestamp.
Changes:
- Removed CVSS v3 severity scoring
- Updated the modification timestamp
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "type": "CVSS_V3", | ||
| "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" | ||
| }, | ||
| { |
There was a problem hiding this comment.
The removal of the CVSS_V3 score appears inconsistent with the PR description which states "Updates CVSS v3". Many similar advisories in this repository maintain both CVSS_V3 and CVSS_V4 scores simultaneously. Consider whether the CVSS_V3 score should be updated rather than removed entirely, or clarify if the removal is intentional and update the PR description accordingly.
| { | |
| { | |
| "type": "CVSS_V3", | |
| "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" | |
| }, | |
| { |
Updates
Comments
Fix