GHSA SYNC: 1 new advisory; 2 modified advisories

[jasnow]

GHSA SYNC: 1 new advisory; 2 modified advisories

• Modified:
  • rubies/jruby/CVE-2011-4838.yml
  • rubies/ruby/CVE-2011-4815.yml
• New:
  • rubies/jruby/CVE-2019-16254.yml

[postmodern]

If we want to indicate that a CVE is related to another CVE, related: cve: is already supported.

related:
  cve:
    - CVE-....
  url:
    - ...

[postmodern]

Should rubies/jruby/CVE-2011-4838.yml and rubies/ruby/CVE-2011-4815.yml also get related: cve: like the rubies/jruby/CVE-2019-16254.yml file? I am OK with merging this in it's current state.

[jasnow]

Should rubies/jruby/CVE-2011-4838.yml and rubies/ruby/CVE-2011-4815.yml also get related: cve: like the rubies/jruby/CVE-2019-16254.yml file? I am OK with merging this in it's current state.

My vote is keep them because it keeps the information separate.
I will be glad to move the URL:/CVE: line up to URL and notes: to description: field.

[postmodern]

Should rubies/jruby/CVE-2011-4838.yml and rubies/ruby/CVE-2011-4815.yml also get related: cve: like the rubies/jruby/CVE-2019-16254.yml file? I am OK with merging this in it's current state.

My vote is keep them because it keeps the information separate. I will be glad to move the URL:/CVE: line up to URL and notes: to description: field.

Agreed. Let us use related: cve: for when the same bundled gem in Ruby's stdlib has to be updated in both Ruby and JRuby due to a vulnerability.