Skip to content

Commit 116997c

Browse files
hvitvedhvitved
authored
Merge pull request #961 from calumgrant/cs/cve-2019-0657
C#: Update cs/use-of-vulnerable-package to detect CVE-2019-0657
2 parents 8921620 + 1534196 commit 116997c

File tree

4 files changed

+41
-10
lines changed

4 files changed

+41
-10
lines changed

‎change-notes/1.20/analysis-csharp.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
| Use of default ToString() (`cs/call-to-object-tostring`) | Fewer results | Results have been removed when the object is an interface or an abstract class. |
2020
| Unused format argument (`cs/format-argument-unused`) | Fewer false positives | Results have been removed where the format string is empty. This is often used as a default value and is not an interesting result. |
2121
| Double-checked lock is not thread-safe (`cs/unsafe-double-checked-lock`) | Fewer false positives, more true positives | Results have been removed where the underlying field was not updated in the `lock` statement, or where the field is a `struct`. Results have been added where there are other statements inside the `lock` statement. |
22+
| Using a package with a known vulnerability (`cs/use-of-vulnerable-package`) | More results | This query detects packages vulnerable to CVE-2019-0657. |
2223

2324
## Changes to code extraction
2425

‎csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -312,3 +312,24 @@ class CVE_2018_0786 extends Vulnerability {
312312
fixed = "4.0.2"
313313
}
314314
}
315+
316+
class CVE_2019_0657 extends Vulnerability {
317+
CVE_2019_0657() { this = "CVE-2019-0657" }
318+
319+
override predicate matchesRange(string name, Version affected, Version fixed) {
320+
name = "Microsoft.NETCore.App" and
321+
(
322+
affected = "2.1.0" and fixed = "2.1.8"
323+
or
324+
affected = "2.2.0" and fixed = "2.2.2"
325+
)
326+
}
327+
328+
override predicate matchesVersion(string name, Version affected, Version fixed) {
329+
name = "System.Private.Uri" and
330+
affected = "4.3.0" and
331+
fixed = "4.3.1"
332+
}
333+
334+
override string getUrl() { result = "https://github.com/dotnet/announcements/issues/97" }
335+
}

‎csharp/ql/test/query-tests/Security Features/CWE-937/VulnerablePackage.expected‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
1-
| csproj.config:10:5:10:77 | System.Text.Encodings.Web 4.3.0 | Package 'System.Text.Encodings.Web 4.3.0' has vulnerability $@, and should be upgraded to version 4.3.1. | https://github.com/dotnet/corefx/issues/19535 | Microsoft Security Advisory 4021279 |
2-
| csproj.config:11:5:11:75 | system.text.encodings.web 4.3 | Package 'system.text.encodings.web 4.3' has vulnerability $@, and should be upgraded to version 4.3.1. | https://github.com/dotnet/corefx/issues/19535 | Microsoft Security Advisory 4021279 |
3-
| csproj.config:12:5:12:67 | System.Net.Http 4.1.1 | Package 'System.Net.Http 4.1.1' has vulnerability $@, and should be upgraded to version 4.1.2. | https://github.com/dotnet/corefx/issues/19535 | Microsoft Security Advisory 4021279 |
4-
| csproj.config:13:5:13:67 | System.Net.Http 4.1.2 | Package 'System.Net.Http 4.1.2' has vulnerability $@, and should be upgraded to version 4.3.4. | https://github.com/dotnet/announcements/issues/88 | CVE-2018-8292 |
1+
| csproj.config:4:5:4:77 | System.Text.Encodings.Web 4.3.0 | Package 'System.Text.Encodings.Web 4.3.0' has vulnerability $@, and should be upgraded to version 4.3.1. | https://github.com/dotnet/corefx/issues/19535 | Microsoft Security Advisory 4021279 |
2+
| csproj.config:5:5:5:75 | system.text.encodings.web 4.3 | Package 'system.text.encodings.web 4.3' has vulnerability $@, and should be upgraded to version 4.3.1. | https://github.com/dotnet/corefx/issues/19535 | Microsoft Security Advisory 4021279 |
3+
| csproj.config:6:5:6:67 | System.Net.Http 4.1.1 | Package 'System.Net.Http 4.1.1' has vulnerability $@, and should be upgraded to version 4.1.2. | https://github.com/dotnet/corefx/issues/19535 | Microsoft Security Advisory 4021279 |
4+
| csproj.config:7:5:7:67 | System.Net.Http 4.1.2 | Package 'System.Net.Http 4.1.2' has vulnerability $@, and should be upgraded to version 4.3.4. | https://github.com/dotnet/announcements/issues/88 | CVE-2018-8292 |
5+
| csproj.config:8:5:8:70 | System.Private.Uri 4.3.0 | Package 'System.Private.Uri 4.3.0' has vulnerability $@, and should be upgraded to version 4.3.1. | https://github.com/dotnet/announcements/issues/97 | CVE-2019-0657 |
6+
| csproj.config:9:5:9:73 | Microsoft.NETCore.App 2.1.0 | Package 'Microsoft.NETCore.App 2.1.0' has vulnerability $@, and should be upgraded to version 2.1.8. | https://github.com/dotnet/announcements/issues/97 | CVE-2019-0657 |
7+
| csproj.config:10:5:10:73 | Microsoft.NETCore.App 2.2.1 | Package 'Microsoft.NETCore.App 2.2.1' has vulnerability $@, and should be upgraded to version 2.2.2. | https://github.com/dotnet/announcements/issues/97 | CVE-2019-0657 |
58
| packages.config:9:3:9:79 | System.IO.Pipelines 4.5.0 | Package 'System.IO.Pipelines 4.5.0' has vulnerability $@, and should be upgraded to version 4.5.1. | https://github.com/aspnet/Announcements/issues/316 | CVE-2018-8409 |
69
| packages.config:10:3:10:81 | System.IO.Pipelines 4.5.0.0 | Package 'System.IO.Pipelines 4.5.0.0' has vulnerability $@, and should be upgraded to version 4.5.1. | https://github.com/aspnet/Announcements/issues/316 | CVE-2018-8409 |
710
| packages.config:11:3:11:84 | microsoft.aspnetcore.all 2.0.0 | Package 'microsoft.aspnetcore.all 2.0.0' has vulnerability $@, and should be upgraded to version 2.0.9. | https://github.com/aspnet/Announcements/issues/300 | ASPNETCore-Mar18 |

‎csharp/ql/test/query-tests/Security Features/CWE-937/csproj.config‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,22 @@
11
<Project>
22
<ItemGroup>
3-
<!-- These are GOOD -->
4-
<PackageManagement Include="Microsoft.AspNetCore.All" Version="2.1.5" />
5-
<PackageReference Include="System.Net.Http" Version="4.3.4" />
6-
<PackageReference Include="System.Text.Encodings.Web" Version="4.2.9" />
7-
<PackageReference Include="System.Text.Encodings.Web" Version="4.3.1" />
8-
93
<!-- These are BAD -->
104
<PackageReference Include="System.Text.Encodings.Web" Version="4.3.0" />
115
<PackageReference Include="system.text.encodings.web" Version="4.3" />
126
<PackageReference Include="System.Net.Http" Version="4.1.1" />
137
<PackageReference Include="System.Net.Http" Version="4.1.2" />
8+
<PackageReference Include="System.Private.Uri" Version="4.3.0" />
9+
<PackageReference Include="Microsoft.NETCore.App" Version="2.1.0" />
10+
<PackageReference Include="Microsoft.NETCore.App" Version="2.2.1" />
11+
12+
<!-- These are GOOD -->
13+
<PackageManagement Include="Microsoft.AspNetCore.All" Version="2.1.5" />
14+
<PackageReference Include="System.Net.Http" Version="4.3.4" />
15+
<PackageReference Include="System.Text.Encodings.Web" Version="4.2.9" />
16+
<PackageReference Include="System.Text.Encodings.Web" Version="4.3.1" />
17+
<PackageReference Include="System.Private.Uri" Version="4.3.1" />
18+
<PackageReference Include="Microsoft.NETCore.App" Version="2.1.8" />
19+
<PackageReference Include="Microsoft.NETCore.App" Version="2.2.2" />
1420

1521
</ItemGroup>
1622
</Project>

0 commit comments

Comments
 (0)