False Positive on Hangfire.SqlServer

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

https://owasp.org/www-project-dependency-check/

Apache License 2.0

6.34k stars 1.27k forks source link

False Positive on Hangfire.SqlServer #1859

Open christopher-gill opened 5 years ago

christopher-gill commented 5 years ago

False positive:

Reported By dependency-check command line V5.0
Library Hangfire.SqlServer
Version 1.6.19
Detected Vulnerability https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16055

Detecting this library as a node package. Possibly the same as reported in https://github.com/jeremylong/DependencyCheck/issues/1388

christopher-gill commented 5 years ago

Hi,

I've just tested this with the latest release 5.2.0 and it still seems to be happening.

Note I've downloaded the bintray version

jeremylong commented 5 years ago

Using 5.2.0 I just ran:

dotnet add package HangFire.SqlServer --version 1.7.5
dotnet publish
dependency-check.sh -s . -o reports

The only identifier is the package-url (i.e. no CPE was identified):

pkg:nuget/HangFire.SqlServer@1.7.5 (Confidence:Highest)

How is your project setup?

christopher-gill commented 5 years ago

We're using Hangfire.SqlServer.1.6.19

MD5: 3eefc49896999c2fb081ccbb3997557e SHA1: 654bb005fc6a1968a78a6d5354406a46f6ace8c3 SHA256:1730229e234c85445ea7ee795dfda9e77d01c8a179d0053772162fb277297bf8 Evidence Identifiers

cpe:2.3:a:sqlserver_project:sqlserver:1.6.19:*:*:*:*:*:*:*  (Confidence:High)

Published Vulnerabilities

CVE-2017-16055

sqlserver was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

CWE-200 Information Exposure

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

jeremylong commented 5 years ago

That I understand - what I meant is are you dotnet core, msbuild, etc. What is your actual build tools and dependency management system? For example looking at https://www.nuget.org/packages/Hangfire.SqlServer/ they list package manager, .net cli, package reference, or paket cli.

christopher-gill commented 5 years ago

We're using .net 4.5, msbuild & nuget for our package managment system