ALIAS is not taking into account for RLSA and DLA (OSV source) about dependency-track HOT 5 CLOSED

this issue is corrected here : ellipse2v@fb7d6f4

from dependency-track.

Thanks for reporting, and thanks for raising a PR!

However, the current behavior is in fact intended.
aliases are meant to mean "exactly the same". This is not true for related:

The related field gives a list of IDs of closely related vulnerabilities, such as:

• A similar but completely different vulnerability.
• A similar OSV entry that bundles multiple distinct vulnerabilities in the same entry.
• Cases that do not satisfy the strict definition of aliases.

The aliases feature in DT works based on the above assumption, extending it to related will break it.

from dependency-track.

Hi ok I understand. Thanks for the answer.
I will removed the push request or you will reject it ?

from dependency-track.

I declined. But thank you anyway for contributing, much appreciated!

from dependency-track.

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

from dependency-track.