[GHSA-qphf-w3cq-jpmx] IPAddress Infinite Loop vulnerability

[mike-jumper]

Updates

• Affected products
• CVSS
• Severity

Comments
This shouldn't be flagged as a vulnerability at all. Per seancfoley/IPAddress#118 (comment), an infinite loop case exists only for cases that the developer supplies invalid arguments. There is no security model being violated here, and no implicit requirement that all functions must halt for contrived inputs.

[darakian]

Ohhh, ya that does look like it shouldn't have been assigned. We can go ahead and withdraw this instead if you think that's more appropriate. If so, I would also like to ask that someone involved with the project reach out to mitre to get the CVE rejected as well
https://cveform.mitre.org/

[seancfoley]

@darakian I am the project manager of the IPAddress library, and the repository owner, and I have submitted a rejection request to the address you provided. Thanks for the suggestion.

@mike-jumper

[seancfoley]

Mitre has acknowledged the request, CVE Request 1586075

[darakian]

Awesome. I'll put this through for withdrawal in our system. The Advisory will still be visible but all dependabot alerts will halt 👍

[advisory-database]

Hi @mike-jumper! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!