Commit bd47c8e
committed
Picky change to example justification in the spec
I feel like the statement
> The vulnerable code was removed with a custom patch
fits `vulnerable_code_not_present`:
> The vulnerable component is included in artifact, but the vulnerable code is not present. Typically, this case occurs when source code is configured or built in a way that excluded the vulnerable code.
better than `component_not_present`:
> The product is not affected by the vulnerability because the component is not included. The status justification may be used to preemptively inform product users who are seeking to understand a vulnerability that is widespread, receiving a lot of attention, or is in similar products.
The statement specifically states "vulnerable *code* was removed" via a patch. Rather than the whole component being removed.
Signed-off-by: Gareth Rushgrove <gareth@morethanseven.net>1 parent 808f7a8 commit bd47c8e
1 file changed
+1
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
221 | 221 | | |
222 | 222 | | |
223 | 223 | | |
224 | | - | |
| 224 | + | |
225 | 225 | | |
226 | 226 | | |
227 | 227 | | |
| |||
0 commit comments