-
Notifications
You must be signed in to change notification settings - Fork 78
Open
Labels
Description
For example, in CVE-2019-17567:
Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.
the term URL
is not extracted.
Additional remark
This is also a good example that shows that verbs should be extracted too: configured
is not extracted (with the current noun-only approach), but configuration
appears in some commit messages and it is potentially relevant to identify the fix commit.