Rust Sec DB ambiguous version ranges

[sbs2001]

https://github.com/rustsec/advisory-db/blob/main/crates/futures-util/RUSTSEC-2020-0059.md has intersecting affecting and patched version ranges.

It mentions:

Affected Range: >= 0.3.2
Patched Range: >= 0.3.7

Hence VC gets confused about whether >= 0.3.7 are really patched.

In a trivial case like this somehow we could infer ">=0.3.2, <0.3.7" is vulnerable. But in complex cases of multiple affected ranges and patched ranges, pairing the ranges to form closed interval will be non trivial and sometimes wrong.

Also the OSV version of the advisory at https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2020-0059.json doesn't really help since the "events" are not connected.

[pombredanne]

@sbs2001 IMHO the latest vers approach makes these kind of cases always non-ambiguous.
Check the approach at package-url/purl-spec#139

Here the conversion using univers to a vers would get the trivial case you have mentioned as >=0.3.2|<0.3.7 because eventually there is no such thing as a "patched range", there are only vulnerable ranges and patched versions. So Patched Range: >= 0.3.7 should always be interpreted as a single fixed event in the versions timeline.

[sbs2001]

@pombredanne tbh I don't really understand what you meant.

1. How would we obtain >=0.3.2|<0.3.7 in a somewhat non trivial case like :
   Affected Range: >=0.3.2, >=0.4.3
   Patched Range: >=0.3.7, .>=0.4.5

2. Why do we have only vulnerable ranges and patched versions ? Is it a convention to follow ? If yes then are we simply calling the version range which doesn't satisfy the patched version range as "vulnerable range" ?

Also we need the solution to work in the rust sec db context and ranges they use. These don't seem to follow the semantics of vers ;)