TYPO3 offering support enriching unreviewed advisories

[ohader]

Due to a recent change in unreviewed advisories that caused some confusion in our user base, on behalf of the TYPO3 security team, I would like to offer support for triaging and enriching some of our past advisories. We will update the corresponding OSV JSON files over the next few weeks.

This initiative aims to reduce the workload for the GitHub staff and enables us to double-check the changes ourselves since we are actively working on them.

Most of the historical data is already available in our security advisory collections, and we are eager to consolidate it with the GitHub advisory database.

List TYPO3-related advisories we might be tackling

• unreviewed/2022/04/GHSA-58vj-r9cf-29fq/GHSA-58vj-r9cf-29fq.json: typo3-core-sa-2011-001
• unreviewed/2022/04/GHSA-hqp4-wxg3-hmh3/GHSA-hqp4-wxg3-hmh3.json: typo3-core-sa-2011-001
• unreviewed/2022/04/GHSA-wxxh-m2j3-p2vq/GHSA-wxxh-m2j3-p2vq.json: typo3-core-sa-2011-001
• unreviewed/2022/05/GHSA-3w4h-r27h-4r2w/GHSA-3w4h-r27h-4r2w.json: typo3-core-sa-2019-012
• unreviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json: typo3-core-sa-2013-002
• unreviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json: typo3-core-sa-2014-001
• unreviewed/2022/05/GHSA-59pj-7mjh-4465/GHSA-59pj-7mjh-4465.json: typo3-core-sa-2019-025
• unreviewed/2022/05/GHSA-8545-g96p-q9hh/GHSA-8545-g96p-q9hh.json: typo3-core-sa-2015-001
• unreviewed/2022/05/GHSA-876v-jwwg-mx7g/GHSA-876v-jwwg-mx7g.json: typo3-core-sa-2015-010
• unreviewed/2022/05/GHSA-8fhr-q64r-cg3f/GHSA-8fhr-q64r-cg3f.json: typo3-core-sa-2013-004
• unreviewed/2022/05/GHSA-ffcm-vhcw-p32r/GHSA-ffcm-vhcw-p32r.json: typo3-core-sa-2016-006
• unreviewed/2022/05/GHSA-h7wf-jg4f-x2wc/GHSA-h7wf-jg4f-x2wc.json: typo3-core-sa-2014-001
• unreviewed/2022/05/GHSA-h857-jmgh-2v5g/GHSA-h857-jmgh-2v5g.json: typo3-core-sa-2011-004
• unreviewed/2022/05/GHSA-j5v7-9xr5-m7gx/GHSA-j5v7-9xr5-m7gx.json: typo3-core-sa-2015-012
• unreviewed/2022/05/GHSA-m4hw-r893-xh4g/GHSA-m4hw-r893-xh4g.json: typo3-core-sa-2012-004
• unreviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json: typo3-core-sa-2013-003
• unreviewed/2022/05/GHSA-q68v-vcjg-r3vp/GHSA-q68v-vcjg-r3vp.json: typo3-core-sa-2012-001
• unreviewed/2022/05/GHSA-rcgc-4xfc-564v/GHSA-rcgc-4xfc-564v.json: typo3-core-sa-2019-026
• unreviewed/2022/05/GHSA-xx7m-8rq2-cw2v/GHSA-xx7m-8rq2-cw2v.json: typo3-core-sa-2015-015

[darakian]

Any and all help is welcome. Opening PRs is definitely the most direct way to help too! 😃

I know you've already opened a number of PRs with us, but just for anyone else reading. We don't accept contributions on just anything. We limit ourselves to our supported ecosystem list
https://github.com/github/advisory-database?tab=readme-ov-file#sources
of which composer/packagist is probably the most relevant for the typo3 community. I'll also say that if there are any advisories you know of which are out of scope for us we can also look at labeling them in our internal system so that we don't accidentally work on them too. 👍