@blamejs/exceptd-skills 0.19.21 → 0.19.23

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.19.23 — 2026-08-11
+
+Every CVE in the catalog now records the controls it requires. The last 34 entries complete the set at 1025 of 1025 — 2,176 control requirements drawn from 143 distinct controls — so `framework-gap` reports the controls a CVE needs that no framework carries for any entry in the catalog, not a subset of it. The closing set includes PHP-CGI, Samba, Apache Tomcat, XStream, Oracle WebLogic, Cisco IOS XE and ASA, Ivanti EPMM, Mirth Connect, and consumer routers from Zyxel and D-Link.
+
+Some populations are defined by a combination, not a product. The PHP-CGI entry applies only to Windows hosts running Apache with PHP-CGI below the fixed builds; a Linux host, or a Windows host serving PHP through another interface, is not an instance of it. The requirement says so, because an emergency batch scoped to "PHP" spends its window on hosts that were never exposed. It also names why a request filter written against the obvious payload proves nothing here: the injection arrives as a soft hyphen that Windows remaps to a dash, so a rule has to be validated by replaying the encoded byte rather than the character the rule author had in mind.
+
+Where the vulnerable interface is the reason the device exists, the entry says what isolation cannot do. Several of the closing entries are consumer routers and access points whose management interface is reachable from the network they serve, so restricting reachability bounds who can send the request and repairs nothing — and for the models with no fixed firmware, removal is the requirement rather than a step after patching.
+
+## 0.19.22 — 2026-08-11
+
+Another 38 CVEs report the controls they require, taking coverage to 991 of 1025. The set includes Citrix NetScaler, Apache ActiveMQ and RocketMQ, Adobe ColdFusion, Oracle Fusion Middleware, Zimbra, Ivanti's Cloud Services Appliance, Qlik Sense, Cisco NX-OS, and the Fortinet FortiSandbox and Trend Micro Apex One entries.
+
+Three entries put the flaw inside the security product itself. A sandbox appliance exists so hostile content detonates somewhere other than production; an endpoint-protection console exists to control the fleet; a migration tool exists to move firewall configurations. Each is carried as tooling rather than as an asset, which is how each stays outside the inventory that would have clocked it — and the migration tool holds, in its own record, the usernames, cleartext passwords, configurations and device API keys of every firewall it has handled. The requirement puts these on the tier their contents justify rather than the tier their role suggests, and states what the upgrade does not undo: credentials that passed through the tool stay valid until they are re-issued on the devices themselves.
+
+Where an exploit's precondition is administrative access, the administrator population is the attack surface. The endpoint-protection entry needs console access before its uninstaller module can be driven into executing commands — so the requirement raises those accounts above ordinary application administrators, reachable through a privileged-access path rather than from any workstation on the corporate segment. Recording the flaw as needing a patch and stopping there leaves the prerequisite untouched.
+
+A second-order injection is not visible at the point it is submitted. The sandbox appliance stores a value from one feature and executes it as an operating-system command later, so a check that validates input on submission sees nothing wrong. The requirement is that the configuration-accepting endpoint neutralises the value before it can reach a command sink, and the distinguishing test exercises the stored path rather than the submission path.
+
 ## 0.19.21 — 2026-08-11
 
 Another 39 CVEs report the controls they require, taking coverage to 953 of 1025. The set includes Jenkins, PAN-OS, Ivanti EPMM and the Cloud Services Appliance, Juniper's J-Web, Veeam Cloud Connect, Veritas Backup Exec, SolarWinds Web Help Desk, Apache OFBiz, Adobe Acrobat, and IP cameras from Reolink and NUUO.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-11T17:45:39.617Z",
+  "generated_at": "2026-08-11T20:35:50.100Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "675104078ee6e6848b997894d2c38100c5ef55e98cbc70a1b2acbb35bd06244b",
+    "manifest.json": "1e56ecce2864d711243241a23737e958c028f1c4fd52887f643d5d3921cd2ac2",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "e6b9bae2be71e9b73848c1c2ca7175ac4ab0c8e153565f3c0fda3824e668c3a1",
-    "data/cve-catalog.json": "13cf279a8ea22fdcc2c1485689a4dbea2dadfa65171bd7a3df1950e998d81b23",
+    "data/cve-catalog.json": "c01d0157297cc3e287d7ab89ce5e159100ef5d04a04eb0ed36de0f68d97c0cc5",
     "data/cwe-catalog.json": "7b2223f0773d2f033d72fdcbf00cba9cdfdc2dff6bfb1366c9b30144396945f6",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "2ad6f59b641c83e65c4050db106ed22e8f4b87bdbe5947470b71d342b3cdbd60",
+    "data/zeroday-lessons.json": "43a1276c2cfde43c857d8d1e2c788487c4f123d0a21ddc11b2498eb1d0cdf01e",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/cve-catalog.json

@@ -27286,7 +27286,7 @@
       "NIST-800-53-SC-7": "Boundary/WAF rules keyed on literal '-' options miss the Best-Fit 0xAD encoding, so perimeter filtering fails to block the argument injection.",
       "ISO-27001-2022-A.8.9": "Configuration management does not flag the insecure Windows Apache + PHP-CGI + Best-Fit code-page combination that is the precondition for this bug.",
       "NIS2-Art21-patch-management": "Patch-management timelines are far slower than the observed same-week weaponization of this critical RCE.",
-      "PCI-DSS-4.0-6.3.3": "The patch-security-vulnerabilities requirement does not mandate moving off PHP-CGI to a safer SAPI (PHP-FPM), leaving the injectable interpreter mode deployed.",
+      "PCI-DSS-4.0-6.3.3": "The patch-security-vulnerabilities requirement is satisfied by the fixed PHP build and says nothing about the interpreter mode that made the flaw reachable, so the CGI SAPI stays deployed on an estate that patches diligently. There is no drop-in alternative on the affected platform either — PHP-FPM is a Unix SAPI and is not shipped for Windows, which is the only environment this CVE affects — so removing the injectable mode means either dropping the mapping that routes requests to the CGI binary where the deployment permits it, or moving the workload to a platform where a non-CGI SAPI is available. Neither is a patching action, and neither is prompted by the requirement.",
       "UK-CAF-D1": "CAF response-and-recovery planning does not account for the same-week ransomware weaponization observed here, where an internet-facing PHP-CGI RCE (EPSS ~1.0) is mass-exploited faster than an incident-response cycle can spin up.",
       "AU-Essential-8-Patch": "Essential-Eight application-patch timelines trail the near-immediate, ransomware-linked mass exploitation of exposed Windows PHP-CGI hosts, where the Best-Fit code-page bypass turns a routine RCE into a same-day compromise."
     },
@@ -30757,12 +30757,12 @@
     ],
     "atlas_refs": [],
     "framework_control_gaps": {
-      "NIST-800-53-SI-2": "Patch alone (4.13.8 / 5.5.8) doesn't remediate an already-compromised security key from before the update — rotation is a separate required action the patch cannot force.",
-      "NIS2-Art21-vulnerability-management": "Vulnerability management processes typically close once a patch is applied; this flaw needs an additional secret-rotation step that standard patch-tracking doesn't capture.",
+      "NIST-800-53-SI-2": "Flaw remediation closes on the fixed release (4.13.8 / 5.5.8), which is what remediates this CVE — but the exploit precondition is a security key compromised before the update, and SI-2 has no trigger for rotating a secret whose exposure the vulnerability reveals. The upgrade closes the injection path and leaves a key the attacker may hold still in service for everything else it protects.",
+      "NIS2-Art21-vulnerability-management": "Vulnerability management records a CVE as open or closed, with no state for the interim measure the vendor names for installs that cannot update promptly — rotating the security key. A site running that measure is neither exposed as reported nor remediated, and standard patch-tracking cannot express the difference or carry the dated upgrade item it still owes.",
       "UK-CAF-B4": "Secure-by-default secrets handling should prevent the security key from being derivable/leakable via any other vector in the first place, since this CVE is only exploitable after that precondition is met.",
       "GDPR-Art32": "Security-of-processing is directly undermined when a leaked application security key enables remote code execution against a system that may process personal data.",
-      "AU-Essential-8-Patch": "Patch-application guidance doesn't address the compensating action (key rotation) required when the precondition for exploitation is a secret compromised before the patch existed.",
-      "ISO-27001-2022-A.8.24": "A.8.24 use-of-cryptography and key-management is the operative control here: the RCE is only reachable when the Craft security key is already compromised, so patching does not remediate it — key-management lifecycle (rotation on suspected exposure, non-derivable storage) is required, which technical-vulnerability tracking does not trigger."
+      "AU-Essential-8-Patch": "Patch-application guidance measures whether the fixed release landed inside the window. It has no expression for the vendor-provided interim mitigation available to installs that cannot meet it, so a site that rotated its key while remaining below the fixed release is reported identically to one that did nothing.",
+      "ISO-27001-2022-A.8.24": "A.8.24 use-of-cryptography and key-management governs both ends of this CVE that patching does not: the precondition, a security key derivable or leakable through some other vector, and the rotation a key suspected of exposure warrants once the fixed release is in place. The upgrade remediates the code-injection path; it does not un-disclose the key, and technical-vulnerability tracking never triggers that rotation."
     },
     "patch_available": true,
     "patch_required_reboot": false,