Recent GHSA not matching PURL

[Falco20019]

@baywet GHSA-v5pm-xwqc-g5wc is having an invalid package name. Please use „Microsoft.OpenApi“, as the generated PURL is case sensitive and therefore not matching right now.

See DependencyTrack/dependency-track#6565

[baywet]

Hi @Falco20019,
Thank you for using the SDK and for reaching out.

I've corrected the advisory casing.

Let me know if you have any additional comments or questions.

[Falco20019]

@baywet Sorry, I just see that the version is also wrong...

https://www.nuget.org/packages/Microsoft.OpenApi/2.0.0-preview.11

Should be 2.0.0-preview.11 and not 2.0.0-preview11

https://semvercompare.azurewebsites.net/?version=2.0.0-preview.12&version=2.0.0-preview11&version=2.0.0-preview.11

Currently the previews would not match as they are considered older (and safe).

[baywet]

Fixed as well!

[Falco20019]

I can confirm that the local advisory in the repository is correct now. GHSA-v5pm-xwqc-g5wc will most probably be updated automatically at some later point in time, right? Once that's done, DependencyTrack should be able to pick it up. Thanks again for the quick reaction!

[Falco20019]

@baywet I did some check-up of the advisory database and it seems to not be updated automatically. So I suggested the correction there through a PR: github/advisory-database#8480

According to github/advisory-database#11 you should be able to approve and merge it yourself :)