Open bhav1234 opened 2 years ago
Hi @bhav1234,
I believe Coverity SAST is a commercial offering, so I'm not sure how we could review and enact changes to address the 150 to 180 vulnerabilities
that you claim it is reporting?
Thanks, Jeremy
@mwiede It looks like Coverity offers a free service for open source projects here: https://scan.coverity.com/
Do you want to sign JSch up for this so we can see what it reports?
@norrisjeremy the project is setup at https://scan.coverity.com/projects/mwiede-jsch?tab=overview Unfortunately the results are not public but it is possible to authenticate using GitHub login.
Please click "add me to the project" so you can see the defects.
@mwiede Ok, thanks! I'm waiting on them to authorize me.
There are approx. 150 to 180 vulnerabilities reported by coverity SAST tool from low to high risk. Some high risks are following: 1.Cleartext transmission of sensitive data (SENSITIVE_DATA_LEAK) in session.connect(). 2.Very weak password hashing (WEAK_PASSWORD_HASH),weak_hash_no_salt: Hashing a password using a computationally cheap cryptographic hash function and no salt. If password hashes leak to an attacker, they can use readily-available hash lookup tables to recover large numbers of passwords with little effort. in byte[] hpass = sha512.digest(password); in BCrypt.java