Update CVE-2025-13083 to include D7

Thanks for filing this issue and posting the proposed json.

Could you share an "interdiff" from the original file compared to this one? I've found that formatting issues and the vulnrichment data can make it hard to compare the data.

Currently we take the version info from the advisory and pass that along. If we need to add more versions to it then I guess we could add that info to the json and merge it on the end of the version we get from the advisory? I'm not sure I love that solution, but we should sort it out.

I think this is still needs work for this part:

Currently we take the version info from the advisory and pass that along. If we need to add more versions to it then I guess we could add that info to the json and merge it on the end of the version we get from the advisory? I'm not sure I love that solution, but we should sort it out.

Looking at the conversation so far, let me see if I get the gist.

1. There is an existing process that extracts information from an SA to create a CVE json (I'm assuming this process is automated)
2. Current DST policy does not allow D7 versions to be included as inputs to the above process, and changing that is a bigger dealio
3. One way forward that avoids a policy discussion is simply to merge an amendment to the result of the process above
4. JD is suggesting that we can put the appendix in scripts/cves/sa-data.json
5. greggles points out that that may be fine but there isn't a way to perform that merge, currently

If I've got that right, is the answer:
1. Merge it manually for now to unblock this
2. Submit a ticket to alter the pipeline for future instances

Or, we could just do #2 and make this issue the test case. (I can take this on if we like that approach.)

On reconsidering this, I think my concern and proposed solution from #2 is not quite right. I'd been thinking of the script that generates the CVE json as the source of truth. However, the vulnrichment program makes its own adjustments so...the only source of truth is the MITRE CVE database.

I've now made the change proposed here - please double check if you can and let me know any oversights.

Thanks for this, greggles...small version number fix needed.

JD asked for "through 7.103" but the CVE now says "affected from 7.0 before 7.103."

Would you mind submitting that change? Thank you!

Good call - I think it's fixed now (caching can vary depending on your source).

Thanks for the help with this greggles. And I just noticed that the contribution record lists me as volunteering.

My work on these issues is actually under HeroDevs. No need to go back and fix things but if you were able to put this work on behalf of HD (just like JD), we would appreciate that.

Please let me know if you need anything from me to make that happen as I don't have perfect knowledge of the credit system.

Thanks again!

Hi aangel - As a project maintainer for this project I can add credit to people. Then you as the individual manage credit to volunteering or the right company for each issue. At least...I think that's how it works. If you can't figure it out I'm happy to keep digging and try to find where/ how that attribution is controlled.

I think that's how it works....if the assignment process doesn't include the company as an option you can set then it's up to me to ensure the attribution is correct, which I can do.

I've updated the record here. Thanks.