Skip to content

Commit ee8f203

Browse files
pedrobpereirapedrobpereira
authored
feature: adds new severity high pattern CF-1779 (#167)
1 parent 1db741e commit ee8f203

File tree

31 files changed

+616
-168
lines changed

31 files changed

+616
-168
lines changed

‎.circleci/config.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ version: 2.1
22

33
orbs:
44
codacy: codacy/[email protected]
5-
codacy_plugins_test: codacy/plugins-test@2.0.11
5+
codacy_plugins_test: codacy/plugins-test@2.1.0
66

77
references:
88
install_trivy_and_download_dbs: &install_trivy_and_download_dbs

‎docs/description/vulnerability.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
## Insecure dependencies detection (critical and high severity)
2-
Detects insecure dependencies (critical and high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.
1+
## Insecure dependencies detection (critical severity)
2+
Detects insecure dependencies (critical severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.

‎docs/description/vulnerability_high.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
## Insecure dependencies detection (high severity)
2+
Detects insecure dependencies (high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.

‎docs/multiple-tests/all-patterns/patterns.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
<module name="root">
33
<module name="secret" />
44
<module name="vulnerability" />
5+
<module name="vulnerability_high" />
56
<module name="vulnerability_medium" />
67
<module name="vulnerability_minor" />
78
</module>

‎docs/multiple-tests/all-patterns/results.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@
2828
severity="error"
2929
/>
3030
<error
31-
source="vulnerability"
31+
source="vulnerability_high"
3232
line="3"
3333
message="Insecure dependency maven/org.apache.seatunnel/[email protected] (CVE-2023-49198: Apache SeaTunnel SQL Injection vulnerability) (update to 1.0.1)"
34-
severity="error"
34+
severity="high"
3535
/>
3636
<error
3737
source="vulnerability_medium"

‎docs/multiple-tests/pattern-vulnerability-high/patterns.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module name="root">
3+
<module name="vulnerability_high" />
4+
</module>

‎docs/multiple-tests/pattern-vulnerability-high/results.xml‎

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<checkstyle version="1.5">
3+
<file name="dart/pubspec.lock">
4+
<error
5+
source="vulnerability_high"
6+
line="20"
7+
message="Insecure dependency pub/[email protected] (CVE-2021-31402: dio vulnerable to CRLF injection with HTTP method string) (update to 5.0.0)"
8+
severity="high"
9+
/>
10+
</file>
11+
<file name="golang/go.mod">
12+
<error
13+
source="vulnerability_high"
14+
line="8"
15+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2024-12055: ollama: DoS using malicious gguf model file in ollama/ollama) (no fix available)"
16+
severity="high"
17+
/>
18+
</file>
19+
<file name="golang/go.mod">
20+
<error
21+
source="vulnerability_high"
22+
line="8"
23+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2024-45436: Ollama can extract members of a ZIP archive outside of the parent directory) (update to 0.1.47)"
24+
severity="high"
25+
/>
26+
</file>
27+
<file name="golang/go.mod">
28+
<error
29+
source="vulnerability_high"
30+
line="8"
31+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2024-8063: ollama: Divide by Zero in ollama/ollama) (no fix available)"
32+
severity="high"
33+
/>
34+
</file>
35+
<file name="golang/go.mod">
36+
<error
37+
source="vulnerability_high"
38+
line="8"
39+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2025-0312: ollama: NULL Pointer Dereference in ollama/ollama) (no fix available)"
40+
severity="high"
41+
/>
42+
</file>
43+
<file name="golang/go.mod">
44+
<error
45+
source="vulnerability_high"
46+
line="8"
47+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2025-0315: ollama: Allocation of Resources Without Limits or Throttling in ollama/ollama) (no fix available)"
48+
severity="high"
49+
/>
50+
</file>
51+
<file name="golang/go.mod">
52+
<error
53+
source="vulnerability_high"
54+
line="8"
55+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2025-0317: ollama: Divide By Zero in ollama/ollama) (no fix available)"
56+
severity="high"
57+
/>
58+
</file>
59+
<file name="golang/go.mod">
60+
<error
61+
source="vulnerability_high"
62+
line="8"
63+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2025-1975: ollama: Improper Validation of Array Index in ollama/ollama) (no fix available)"
64+
severity="high"
65+
/>
66+
</file>
67+
<file name="golang/go.mod">
68+
<error
69+
source="vulnerability_high"
70+
line="8"
71+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2024-12886: ollama: Out-Of-Memory (OOM) Vulnerability in ollama/ollama) (no fix available)"
72+
severity="high"
73+
/>
74+
</file>
75+
<file name="golang/go.mod">
76+
<error
77+
source="vulnerability_high"
78+
line="7"
79+
message="Insecure dependency golang/golang.org/x/[email protected] (CVE-2023-39325: golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)) (update to 0.17.0)"
80+
severity="high"
81+
/>
82+
</file>
83+
<file name="golang/go.mod">
84+
<error
85+
source="vulnerability_high"
86+
line="5"
87+
message="Insecure dependency golang/[email protected] (CVE-2023-45288: golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS) (update to 1.21.9)"
88+
severity="high"
89+
/>
90+
</file>
91+
<file name="golang/go.mod">
92+
<error
93+
source="vulnerability_high"
94+
line="5"
95+
message="Insecure dependency golang/[email protected] (CVE-2024-34156: encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion) (update to 1.22.7)"
96+
severity="high"
97+
/>
98+
</file>
99+
<file name="gradle/gradle.lockfile">
100+
<error
101+
source="vulnerability_high"
102+
line="1"
103+
message="Insecure dependency maven/org.apache.seatunnel/[email protected] (CVE-2023-49198: Apache SeaTunnel SQL Injection vulnerability) (update to 1.0.1)"
104+
severity="high"
105+
/>
106+
</file>
107+
<file name="javascript/package-lock.json">
108+
<error
109+
source="vulnerability_high"
110+
line="14"
111+
message="Insecure dependency npm/[email protected] (CVE-2021-3749: nodejs-axios: Regular expression denial of service in trim function) (update to 0.21.2)"
112+
severity="high"
113+
/>
114+
</file>
115+
<file name="javascript/package-lock.json">
116+
<error
117+
source="vulnerability_high"
118+
line="14"
119+
message="Insecure dependency npm/[email protected] (CVE-2025-27152: axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests) (update to 0.30.0)"
120+
severity="high"
121+
/>
122+
</file>
123+
<file name="javascript/yarn.lock">
124+
<error
125+
source="vulnerability_high"
126+
line="5"
127+
message="Insecure dependency npm/[email protected] (CVE-2021-3749: nodejs-axios: Regular expression denial of service in trim function) (update to 0.21.2)"
128+
severity="high"
129+
/>
130+
</file>
131+
<file name="javascript/yarn.lock">
132+
<error
133+
source="vulnerability_high"
134+
line="5"
135+
message="Insecure dependency npm/[email protected] (CVE-2025-27152: axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests) (update to 0.30.0)"
136+
severity="high"
137+
/>
138+
</file>
139+
<file name="python/requirements.txt">
140+
<error
141+
source="vulnerability_high"
142+
line="2"
143+
message="Insecure dependency pypi/[email protected] (CVE-2023-1625: openstack-heat: information leak in API) (update to 20.0.0)"
144+
severity="high"
145+
/>
146+
</file>
147+
<file name="scala/build.sbt.lock">
148+
<error
149+
source="vulnerability_high"
150+
line="13"
151+
message="Insecure dependency maven/ch.qos.logback/[email protected] (CVE-2023-6378: logback: serialization vulnerability in logback receiver) (update to 1.2.13)"
152+
severity="high"
153+
/>
154+
</file>
155+
<file name="swift/Package.resolved">
156+
<error
157+
source="vulnerability_high"
158+
line="67"
159+
message="Insecure dependency swift/github.com/apple/[email protected] (CVE-2022-0618: Denial of service via HTTP/2 HEADERS frames padding) (update to 1.20)"
160+
severity="high"
161+
/>
162+
</file>
163+
<file name="swift/Package.resolved">
164+
<error
165+
source="vulnerability_high"
166+
line="67"
167+
message="Insecure dependency swift/github.com/apple/[email protected] (CVE-2022-24666: swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length) (update to 1.19.2)"
168+
severity="high"
169+
/>
170+
</file>
171+
<file name="swift/Package.resolved">
172+
<error
173+
source="vulnerability_high"
174+
line="67"
175+
message="Insecure dependency swift/github.com/apple/[email protected] (CVE-2022-24667: swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding) (update to 1.19.2)"
176+
severity="high"
177+
/>
178+
</file>
179+
<file name="swift/Package.resolved">
180+
<error
181+
source="vulnerability_high"
182+
line="67"
183+
message="Insecure dependency swift/github.com/apple/[email protected] (CVE-2022-24668: swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames) (update to 1.19.2)"
184+
severity="high"
185+
/>
186+
</file>
187+
</checkstyle>

‎docs/multiple-tests/pattern-vulnerability-high/src/c/conan.lock‎

Whitespace-only changes.

‎docs/multiple-tests/pattern-vulnerability-high/src/csharp/packages.lock.json‎

Whitespace-only changes.

‎docs/multiple-tests/pattern-vulnerability-high/src/csharp/sample.deps.json‎

Whitespace-only changes.

0 commit comments

Comments
 (0)