Work with Github to fix their Advisory Database importer? about security-advisories HOT 3 CLOSED

Unfortunately, we don't have the resources nor the time to talk to consumers of this database. Let's close here as I won't be able to do anything here. Of course, I would be more than happy if more projects would try to fix the issue with Github.

from security-advisories.

Looks like they stopped importing this database at all.

For the silverstripe case, I would say that the ones appearing on github are the ones that have a CVE assigned, because they are imported by Github from the CVE database.

from security-advisories.

Thanks for looking into this! We've got CVEs (through Mitre) for 57 vulns, yet Github lists only 7. See NVD for "silverstripe" vendor. So even for the CVE import (which they appear to be doing through NVD) I'm not quite sure how that importer functions.

Symfony appears to have the same issue: 16 advisories in Github, and well over 30 advisories in symfony.com.

Maybe you could try contacting them? Github Advisories are such a useful feature for the PHP community if they can make them accurate. I've tried my luck already, might carry more weight if it comes from another PHP project and the maintainer of the source they've claimed to import before?

from security-advisories.