I am analyzing CVE-2022-0839.
When checking the commit, I don't understand why the commit is on a test class. I mean, how does a test class fix a vulnerable component? shouldn't the fix be done in the guilty class?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Because the fix was already released before the vulnerability was published.
The CVE was for versions before 4.8. But 4.8 came out a week before the CVE was published.
So, there is no point in fixing what was fixed. The question is: why was this commit used in the CVE when it doesn't seem relevant?
It's because it is that test that this vulnerability was fixed.
Or the link in the CVE is wrong