Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A command injection vulnerability existed in the Maven scanning flow of cdxgen before version 12.4.3. When cdxgen scanned an attacker-controlled Maven project, repository-controlled paths could be used in the Maven command construction. In affected versions, some Maven invocations were executed with shell: true. A directory name containing shell metacharacters could therefore be interpreted by the shell instead of being treated only as a filesystem path. This could allow an attacker who controls a scanned repository to execute commands in the cdxgen process context. The issue affected both the CLI and server mode. The issue is patched in 12.4.3. Affected asset - Project: cdxgen - Tested version: 12.4.1 - Mode tested: server mode - Endpoint: POST /sbom - Scanner path: Java / Maven project scanning Patch Version 12.4.3 includes hardening for this issue with PR #4059 The patch adds multiple mitigations: - Maven command invocations no longer use unconditional shell execution on…
Recommended action: Upgrade to 12.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Docker registry auth substring match forwards credentials to a different registry Repository cdxgen/cdxgen Affected product/package - Ecosystem: npm - Package: @cyclonedx/cdxgen - Reviewed tree version: 12.3.3 - Reviewed commit: b1e179869fd7c6032c3d483c3f7bd4d7154ec22b - Affected file: lib/managers/docker.js - Affected from: v9.9.5 The Single Executable Applications (SEA) binaries and container images are also affected. Weakness CWE-522 / CWE-346. Summary When cdxgen scans or pulls container images through the Docker daemon API, it builds an X-Registry-Auth header from Docker credentials in DOCKERCONFIG/config.json. The credential selection logic matches configured registry keys with substring checks: This is not an origin-safe registry comparison. For example, credentials configured for private-registry.example.com are selected for a requested image under registry.example.com, because: The selected credentials are then serialized into X-Registry-Auth for the Docker API pull request…
Recommended action: Upgrade to 12.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.
Recommended action: Upgrade to 11.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.