Skip to content

Commit f8f33f2

Browse files
committed
tests: Add new expected vulnerabilities to test results
1 parent a939f18 commit f8f33f2

File tree

4 files changed

+44
-8
lines changed

4 files changed

+44
-8
lines changed

docs/multiple-tests/all-patterns/results.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,12 @@
2121
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2021-44832: log4j-core: remote code execution via JDBC Appender) (update to 2.17.1)"
2222
severity="warning"
2323
/>
24+
<error
25+
source="vulnerability_medium"
26+
line="1"
27+
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2. ...) (update to 2.25.3)"
28+
severity="warning"
29+
/>
2430
<error
2531
source="vulnerability_critical"
2632
line="2"

docs/multiple-tests/pattern-vulnerability-critical/results.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@
77
message="Insecure dependency golang/[email protected] (CVE-2024-24790: golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses) (update to 1.21.11)"
88
severity="error"
99
/>
10+
<error
11+
source="vulnerability_critical"
12+
line="8"
13+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operations) (no fix available)"
14+
severity="error"
15+
/>
1016
</file>
1117

1218
<file name="gradle/gradle.lockfile">

docs/multiple-tests/pattern-vulnerability-high/results.xml

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -85,19 +85,13 @@
8585
<error
8686
source="vulnerability_high"
8787
line="5"
88-
message="Insecure dependency golang/[email protected] (CVE-2025-58186: Despite HTTP headers having a default limit of 1MB, the number of cook ...) (update to 1.24.8)"
89-
severity="high"
90-
/>
91-
<error
92-
source="vulnerability_high"
93-
line="5"
94-
message="Insecure dependency golang/[email protected] (CVE-2025-58187: Due to the design of the name constraint checking algorithm, the proce ...) (update to 1.24.9)"
88+
message="Insecure dependency golang/[email protected] (CVE-2025-58183: golang: archive/tar: Unbounded allocation when parsing GNU sparse map) (update to 1.24.8)"
9589
severity="high"
9690
/>
9791
<error
9892
source="vulnerability_high"
9993
line="5"
100-
message="Insecure dependency golang/[email protected] (CVE-2025-58183: golang: archive/tar: Unbounded allocation when parsing GNU sparse map) (update to 1.24.8)"
94+
message="Insecure dependency golang/[email protected] (CVE-2025-61729: crypto/x509: Excessive resource consumption when printing error string for host certificate validation in crypto/x509) (update to 1.24.11)"
10195
severity="high"
10296
/>
10397
</file>

docs/multiple-tests/pattern-vulnerability-medium/results.xml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,9 +170,33 @@
170170
message="Insecure dependency golang/[email protected] (CVE-2025-58188: crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509) (update to 1.24.8)"
171171
severity="warning"
172172
/>
173+
<error
174+
source="vulnerability_medium"
175+
line="3"
176+
message="Insecure dependency golang/[email protected] (CVE-2025-58186: golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http) (update to 1.24.8)"
177+
severity="warning"
178+
/>
179+
<error
180+
source="vulnerability_medium"
181+
line="3"
182+
message="Insecure dependency golang/[email protected] (CVE-2025-58187: crypto/x509: Quadratic complexity when checking name constraints in crypto/x509) (update to 1.24.9)"
183+
severity="warning"
184+
/>
185+
<error
186+
source="vulnerability_medium"
187+
line="3"
188+
message="Insecure dependency golang/[email protected] (CVE-2025-61727: golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs) (update to 1.24.11)"
189+
severity="warning"
190+
/>
173191
</file>
174192

175193
<file name="gradle/gradle.lockfile">
194+
<error
195+
source="vulnerability_medium"
196+
line="1"
197+
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2. ...) (update to 2.25.3)"
198+
severity="warning"
199+
/>
176200
<error
177201
source="vulnerability_medium"
178202
line="1"
@@ -188,6 +212,12 @@
188212
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2021-44832: log4j-core: remote code execution via JDBC Appender) (update to 2.17.1)"
189213
severity="warning"
190214
/>
215+
<error
216+
source="vulnerability_medium"
217+
line="14"
218+
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2. ...) (update to 2.25.3)"
219+
severity="warning"
220+
/>
191221
</file>
192222

193223
<file name="javascript/package-lock.json">

0 commit comments

Comments
 (0)