Skip to content

Update vulns/CVE-2021-25740.json#32

Open
PushkarJ wants to merge 6 commits intomainfrom
vulns-CVE-2021-25740.json
Open

Update vulns/CVE-2021-25740.json#32
PushkarJ wants to merge 6 commits intomainfrom
vulns-CVE-2021-25740.json

Conversation

@PushkarJ
Copy link
Member

This PR updates vulns/CVE-2021-25740.json

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: PushkarJ

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 28, 2026
@PushkarJ
Copy link
Member Author

/hold

These are open issues, so need to gain consensus on whether they should be part of this feed or not

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 28, 2026
@PushkarJ
Copy link
Member Author

Related to this: kubernetes/sig-security#135

@tabbysable
Copy link

Per discussion in SIG Security meeting on Feb 6 2026, we would like to get these open unfixed CVEs published here in order to maintain parity with the Kubernetes Official CVE Feed

@tabbysable
Copy link

During the SIG Security Tooling meeting Feb 13 2026, we noticed that these generated documents incorrectly state that these CVEs are fixed starting from (next version after publication).

I assume this is just an artifact of some assumptions baked into the generation tooling. Let's not merge these until we can get that fixed, to prevent these OSV documents from being misleading.

@PushkarJ
Copy link
Member Author

Sounds like we need to remove the last affected field for these unfixed CVEs based on this example : https://ossf.github.io/osv-schema/#examples

PushkarJ and others added 6 commits February 14, 2026 14:00
Changes `introduced` to v0.0.1 and removes fixed version as there is no fix available
Reflect no fix and all versions affected status from github issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants