search

CycloneDX / cdxgen

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server. Google chat: https://chat.google.com/room/AAAA6l2dO60?cls=7
https://cyclonedx.github.io/cdxgen/
Apache License 2.0
580 stars 156 forks source link

CVE-2024-0057 in cyclonedx/cdxgen-deno:v10.11.0 #1453

Closed cmontemuino closed 5 hours ago

cmontemuino commented 19 hours ago

Our Trivy scan is reporting CVE-2024-0057. 

Vulnerability information: 
+--------------------------------------------------------------------------------------------------------------+-------------------------+----------+-------------------+--------------------------------------------------+------------------------------------------------------------+-------------------------------------------+
|                                                     Type                                                     |         Library         | Severity | Installed Version |                  Fixed Version                   |                          Summary                           |                More Details               |
+--------------------------------------------------------------------------------------------------------------+-------------------------+----------+-------------------+--------------------------------------------------+------------------------------------------------------------+-------------------------------------------+
| usr/lib64/dotnet/sdk/8.0.110/Containers/tasks/net8.0/Microsoft.NET.Build.Containers.deps.json (dotnet-core)  | NuGet.Packaging (None)  | CRITICAL |   6.8.1-rc.32767  | 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1 | dotnet: X509 Certificates - Validation Bypass across Azure | https://avd.aquasec.com/nvd/cve-2024-0057 |
|                        usr/lib64/dotnet/sdk/8.0.110/MSBuild.deps.json (dotnet-core)                          | NuGet.Packaging (None)  | CRITICAL |   6.8.1-rc.32767  | 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1 | dotnet: X509 Certificates - Validation Bypass across Azure | https://avd.aquasec.com/nvd/cve-2024-0057 |
|                usr/lib64/dotnet/sdk/8.0.110/NuGet.CommandLine.XPlat.deps.json (dotnet-core)                  | NuGet.Packaging (None)  | CRITICAL |   6.8.1-rc.32767  | 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1 | dotnet: X509 Certificates - Validation Bypass across Azure | https://avd.aquasec.com/nvd/cve-2024-0057 |
|                         usr/lib64/dotnet/sdk/8.0.110/dotnet.deps.json (dotnet-core)                          | NuGet.Packaging (None)  | CRITICAL |   6.8.1-rc.32767  | 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1 | dotnet: X509 Certificates - Validation Bypass across Azure | https://avd.aquasec.com/nvd/cve-2024-0057 |
+--------------------------------------------------------------------------------------------------------------+-------------------------+----------+-------------------+--------------------------------------------------+------------------------------------------------------------+-------------------------------------------+
No allowlisted vulnerabilities
aryan-rajoria commented 18 hours ago

Thank you @cmontemuino, for clarification wanted to ask if 6.8.1-rc.32767 is affected version, since the scan has mentioned installed version as 6.8.1-rc.32767 and corresponding fixed version is 6.8.1.

Could you please share the result from dep-scan

prabhu commented 16 hours ago

We bundle dotnet 8. Don't know why trivy is reporting incorrect versions, so feel free to file a defect in their repo.

In general, these reports are unnecessary. The docker images are automatically rebuilt every day, so there is nothing else we could do. The users are responsible for maintaining their own images.

cmontemuino commented 5 hours ago

Hi @prabhu -- I couldn't really find where that dependency is coming from in this repo, so let's close the issue as false positive.