Not picking up async vulnerability in 1.5.2

[abhirpat]

Question

Can you please confirm if Github advisory is scanning async v1.5.2 correctly?

1. Go to https://nvd.nist.gov/vuln/detail/CVE-2021-43138
2. Then section "Known Affected Software Configurations"
3. Expand "Hide Matching CPE(s)"
4. Notice 1.5.2 listed in that list as cpe:2.3:a:async_project:async:1.5.2:::::::* but not mentioned in GHSA-fwr7-v2mv-hh25. Additional context here

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬