GHSA-9cxr-76pm-j3wf: more accurate version ranges

[raboof]

Based on the machine-readable ranges in
https://www.cve.org/CVERecord?id=CVE-2024-53299

[darakian]

I'm not seeing the new fix versions your suggesting listed in the json
https://cveawg.mitre.org/api/cve/CVE-2024-53299
It seems that our ranges are simplified based on the appropriate fixes. Am I missing something?

[raboof]

I'm not seeing the new fix versions your suggesting listed in the json https://cveawg.mitre.org/api/cve/CVE-2024-53299 It seems that our ranges are simplified based on the appropriate fixes. Am I missing something?

I agree the notation for this one is a bit unusual, but since defaultStatus in unaffected, I'm reading:

{
    "status" : "affected",
    "version" : "8.0.0-M1"
    "lessThanOrEqual" : "8.16.*",
}

as meaning 8.17.0 would be outside of this range (and outside the others as well) so once it gets released, it would be unaffected (https://github.com/CVEProject/cve-schema/blob/main/schema/docs/versions.md#version-status-decisions). What do you think?

[darakian]

I can see that reasoning for sure, but 8.17.0 and 7.19.0 don't seem to exist and the branches may be EOL
https://central.sonatype.com/artifact/org.apache.wicket/wicket-core/10.4.0/versions

[raboof]

The 8.17.0 release process is in progress (https://lists.apache.org/thread/2qjovt1b8pqmyng07j00nso7fsw46vkf). I'm not sure about 7.19.0, indeed that version line is EOL but if it'd ever get released presumably it'd have the fix.

[darakian]

I think for 7.19.0 maybe we wait for an actual release to be made. For 8.17.0, do we know for certain that the bug is fixed? I took a quick look and the original mailing list link is sadly lacking in detail
https://lists.apache.org/thread/gyp2ht00c62827y0379lxh5dbx3hhho5
The 8.17.0 link you shared calls out two jira tickets
https://issues.apache.org/jira/browse/WICKET-7024
and
https://issues.apache.org/jira/browse/WICKET-7137
Of which WICKET-7024 is tagged for the appropriate releases, but I'm not certain its the same issue.

You don't have any other references that link the CVE to this jira ticket or which expand on the core issue do you?

[raboof]

I'll ask, though possibly they kept that obscure intentionally in order to avoid making things too easy for malicious actors. I generally trust the advisory is likely accurate ;)

[darakian]

If you know the author(s) and can provide some public reference that would be amazing 🙇