[GHSA-v4g2-cm5v-cxv7] Digital products download without proper payment status check - #9295
[GHSA-v4g2-cm5v-cxv7] Digital products download without proper payment status check#9295nikpivkin wants to merge 1 commit into
Conversation
|
Hi there @aimeos! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
🟢 Approval recommended
The corrected range matches the linked fix commit and release tag.
Pull request overview
Corrects the 2024 affected range for GHSA-v4g2-cm5v-cxv7.
Changes:
- Removes the conflicting
< 2024.04.4supplemental range. - Retains
2024.04.5as the first patched version. - Updates the modification timestamp.
File summaries
| File | Description |
|---|---|
GHSA-v4g2-cm5v-cxv7.json |
Corrects affected-version metadata. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Updates
Comments
The first affected entry has the version range
>= 2024.04.1, < 2024.04.4, but the fix for this branch landed in 2024.04.5. Version 2024.04.4 is still affected, so the range should be>= 2024.04.1, < 2024.04.5. The first patched version2024.04.5is correct and needs no change. The other four entries are consistent and need no change either.Evidence: the advisory already links the fix commit aimeos/ai-client-html@12d8aad. That commit is the 2024.04.5 tag itself, and it is not contained in 2024.04.4.