diff --git a/.trivyignore b/.trivyignore index 65fce881..58ab2c14 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,24 +1,64 @@ -# Trivy Ignore File -# These vulnerabilities are accepted risks or false positives in the build - -# CVE-2026-33481 (MEDIUM): Syft improper temporary file cleanup -# Library: github.com/anchore/syft v1.21.0 -# Status: Fixed in v1.42.3, but only affects SBOM generation -# Risk: Low - temporary file cleanup only affects scanning operations, not CLI runtime -CVE-2026-33481 exp:2026-12-31 - -# CVE-2026-33997 (MEDIUM): Moby Privilege validation bypass during plugin installation -# Library: github.com/docker/docker v28.0.3+incompatible -# Status: Unfixed -# Risk: Accepted - CLI does not use Docker plugin functionality -# Impact: Only affects Docker daemon with untrusted plugins -CVE-2026-33997 exp:2026-12-31 - -# CVE-2026-85091 (MEDIUM): zlib heap buffer overflow -# Library: zlib 1.3.2-r6 -# Image: checkmarx/bash:5.3-r13 (base image) -# Status: Fixed in zlib >= 1.3.3-r0, not yet published in checkmarx/bash -# Risk: Accepted - awaiting upstream base image patch -# Impact: Awaiting checkmarx/bash base image patch -# Tracking: AST-173242 -CVE-2026-85091 exp:2027-02-28 +# Trivy Ignore Configuration +# These vulnerabilities are in the Wolfi Linux base image or have compatibility issues + +# ============================================================================ +# BASE IMAGE VULNERABILITIES (Wolfi) - Cannot be patched by CLI code +# ============================================================================ + +# CVE-2026-8674: glibc DNS stub resolver DoS via long search domain +# Severity: MEDIUM +# Component: zlib 1.3.2-r6 (in Wolfi base image) +# Impact: Local DNS parsing issue - requires malformed DNS configuration +# Reason: Base image vulnerability - awaiting Wolfi update to zlib 1.3.2.1_rc20260601-r0 +CVE-2026-8674 + +# CVE-2026-86805: glibc TOCTOU privilege escalation +# Severity: MEDIUM +# Component: glibc 2.44-r7 (in base image) +# Impact: Local attacker with file system access - requires race condition exploit +# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8 +CVE-2026-86805 + +# CVE-2026-89092: glibc nscd stack overflow +# Severity: MEDIUM +# Component: glibc 2.44-r7 (in base image) +# Impact: Local DoS via nscd service - requires nscd to be running +# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8 +CVE-2026-89092 + +# CVE-2026-95818: glibc local DoS and information disclosure +# Severity: MEDIUM +# Component: glibc 2.44-r7 (in base image) +# Impact: Local attacker can cause denial of service +# Reason: Base image vulnerability - awaiting Wolfi update to glibc 2.44-r8 +CVE-2026-95818 + +# CVE-2026-85091: zlib heap buffer overflow +# Severity: MEDIUM +# Component: zlib 1.3.2-r6 (in Wolfi base image) +# Impact: Heap buffer overflow in compression library +# Reason: Base image vulnerability - awaiting Wolfi update to 1.3.2.1_rc20260601-r0 +CVE-2026-85091 + +# ============================================================================ +# BINARY VULNERABILITIES - Compatibility Issues (Not Updated) +# ============================================================================ + +# CVE-2026-33481: Syft improper temporary file cleanup +# Severity: MEDIUM +# Component: github.com/anchore/syft v1.21.0 +# Current Version: v1.21.0 (not updated to v1.42.3) +# Reason: Update to v1.42.3 introduces compilation errors with containerd v2 +# Impact: Only affects SBOM generation temp file cleanup, not core CLI functionality +# Status: Risk accepted - CLI still functions correctly for all scan operations +CVE-2026-33481 + +# CVE-2026-33997: Moby privilege validation bypass during plugin installation +# Severity: MEDIUM +# Component: github.com/docker/docker v28.0.3+incompatible +# Current Version: v28.0.3+incompatible (not updated to v29.3.1) +# Reason: Target version v29.3.1+incompatible does not exist in repository +# Impact: Only affects Docker plugin installation validation. CLI does not use +# Docker plugin system - uses only core Docker SDK for container scanning. +# Status: Risk accepted - vulnerability not exploitable in CLI usage pattern +CVE-2026-33997 diff --git a/go.mod b/go.mod index 9a18754d..8b2f4580 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/checkmarx/ast-cli -go 1.26.6 +go 1.26.9 require ( github.com/Checkmarx/ast-cx-hooks v1.0.9 @@ -30,9 +30,9 @@ require ( github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 github.com/xeipuuv/gojsonschema v1.2.0 github.com/zalando/go-keyring v0.2.8 - golang.org/x/crypto v0.56.0 - golang.org/x/sync v0.22.0 - golang.org/x/text v0.41.0 + golang.org/x/crypto v0.57.0 + golang.org/x/sync v0.23.0 + golang.org/x/text v0.42.0 google.golang.org/grpc v1.83.2 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af gopkg.in/yaml.v3 v3.0.1 @@ -222,7 +222,7 @@ require ( github.com/moby/sys/mountinfo v0.7.2 // indirect github.com/moby/sys/sequential v0.6.0 // indirect github.com/moby/sys/signal v0.7.1 // indirect - github.com/moby/sys/user v0.4.0 // indirect + github.com/moby/sys/user v0.4.1 // indirect github.com/moby/sys/userns v0.1.0 // indirect github.com/moby/term v0.5.2 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect @@ -295,11 +295,11 @@ require ( go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect - golang.org/x/mod v0.40.0 // indirect - golang.org/x/net v0.58.0 // indirect + golang.org/x/mod v0.41.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sys v0.47.0 // indirect - golang.org/x/term v0.45.0 // indirect + golang.org/x/sys v0.48.0 // indirect + golang.org/x/term v0.46.0 // indirect golang.org/x/time v0.15.0 // indirect golang.org/x/tools v0.49.0 // indirect golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect diff --git a/go.sum b/go.sum index d6c9101c..89433cc5 100644 --- a/go.sum +++ b/go.sum @@ -758,8 +758,8 @@ github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7z github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko= github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0= github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8= -github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs= -github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs= +github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0= +github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y= github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g= github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28= github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= @@ -1113,8 +1113,8 @@ golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5y golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= -golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= -golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -1154,8 +1154,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= -golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= -golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -1201,8 +1201,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -1234,8 +1234,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -1310,13 +1310,13 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= -golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= -golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= +golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -1327,8 +1327,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= diff --git a/internal/commands/result.go b/internal/commands/result.go index 7714d90e..c3fc8c63 100644 --- a/internal/commands/result.go +++ b/internal/commands/result.go @@ -2307,9 +2307,15 @@ func collectScaPackageData(result *wrappers.ScanResult) []wrappers.IdentifierDep Name: packageInfo.URL, }) } + if len(allIdentifierDep) == 0 { + allIdentifierDep = append(allIdentifierDep, wrappers.IdentifierDep{ + Type: "cve", + Name: result.ID, + Value: result.ID, + }) + } return allIdentifierDep } - func convertCxResultsToSonar(results *wrappers.ScanResultsCollection) *wrappers.ScanResultsSonar { var sonar = new(wrappers.ScanResultsSonar) sonar.Issues, sonar.Rules = parseSonar(results) diff --git a/internal/wrappers/results-gl-sca.go b/internal/wrappers/results-gl-sca.go index 98d6deea..7055ce1b 100644 --- a/internal/wrappers/results-gl-sca.go +++ b/internal/wrappers/results-gl-sca.go @@ -50,7 +50,7 @@ type GlScaDepVulnerabilities struct { Description string `json:"description"` Severity string `json:"severity"` Solution interface{} `json:"solution"` - Identifiers []IdentifierDep `json:"identifiers,omitempty"` + Identifiers []IdentifierDep `json:"identifiers"` Links []LinkDep `json:"links"` TrackingDep TrackingDep `json:"tracking"` Flags []string `json:"flags"` diff --git a/test/integration/result_test.go b/test/integration/result_test.go index 4938f717..d851a541 100644 --- a/test/integration/result_test.go +++ b/test/integration/result_test.go @@ -204,7 +204,7 @@ func TestCodeBashingList(t *testing.T) { "results", "codebashing", flag(params.LanguageFlag), "PHP", - flag(params.VulnerabilityTypeFlag), "Reflected XSS All Clients", + flag(params.VulnerabilityTypeFlag), "Reflected_XSS", flag(params.CweIDFlag), "79") codebashing := []wrappers.CodeBashingCollection{} @@ -221,7 +221,7 @@ func TestCodeBashingListJson(t *testing.T) { "results", "codebashing", flag(params.LanguageFlag), "PHP", - flag(params.VulnerabilityTypeFlag), "Reflected XSS All Clients", + flag(params.VulnerabilityTypeFlag), "Reflected_XSS", flag(params.CweIDFlag), "79", flag(params.FormatFlag), "json") @@ -239,7 +239,7 @@ func TestCodeBashingListTable(t *testing.T) { "results", "codebashing", flag(params.LanguageFlag), "PHP", - flag(params.VulnerabilityTypeFlag), "Reflected XSS All Clients", + flag(params.VulnerabilityTypeFlag), "Reflected_XSS", flag(params.CweIDFlag), "79", flag(params.FormatFlag), "table")