@cdxgen/cdxgen 13.3.0 → 13.5.0

package/data/rules/dependency-sources.yaml

@@ -234,3 +234,70 @@
       "registry": $prop($, 'cdx:pypi:registry'),
       "resolvedFrom": $prop($, 'cdx:pypi:resolved_from')
     }
+- id: PKG-012
+  name: "Terraform module from mutable VCS reference"
+  description: "Terraform modules sourced from git or mercurial without a commit or tag pin are not locked, so the next init can fetch different code"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:tf:kind') and $prop($, 'cdx:tf:kind') = 'module'
+      and $hasProp($, 'cdx:tf:module:sourceType')
+      and ($prop($, 'cdx:tf:module:sourceType') = 'git' or $prop($, 'cdx:tf:module:sourceType') = 'hg')
+      and ($prop($, 'cdx:tf:module:pinning') = 'branch' or $prop($, 'cdx:tf:module:pinning') = 'none')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Terraform module '{{ name }}@{{ version }}' tracks VCS source '{{ $prop($, 'cdx:tf:module:source') }}' at a mutable reference"
+  mitigation: "Pin the module source with `?ref=<commit sha>` or a reviewed, signed tag; the dependency lock file does not cover modules"
+  evidence: |
+    {
+      "source": $prop($, 'cdx:tf:module:source'),
+      "sourceType": $prop($, 'cdx:tf:module:sourceType'),
+      "ref": $prop($, 'cdx:tf:module:ref'),
+      "pinning": $prop($, 'cdx:tf:module:pinning')
+    }
+- id: PKG-013
+  name: "Terraform registry module not pinned to an exact version"
+  description: "Registry modules whose version argument is a range or absent resolve to whatever the registry serves at the next init"
+  severity: low
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:tf:kind') and $prop($, 'cdx:tf:kind') = 'module'
+      and $hasProp($, 'cdx:tf:module:sourceType') and $prop($, 'cdx:tf:module:sourceType') = 'registry'
+      and ($prop($, 'cdx:tf:module:pinning') = 'range' or $prop($, 'cdx:tf:module:pinning') = 'none')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Terraform registry module '{{ $prop($, 'cdx:tf:address') }}' is not pinned to an exact version (pinning: {{ $prop($, 'cdx:tf:module:pinning') }})"
+  mitigation: "Set the module's `version` argument to a single exact version and review upgrades deliberately"
+  evidence: |
+    {
+      "constraints": $prop($, 'cdx:tf:constraints'),
+      "pinning": $prop($, 'cdx:tf:module:pinning'),
+      "address": $prop($, 'cdx:tf:address')
+    }
+- id: PKG-014
+  name: "Terraform module source embeds credentials"
+  description: "A module source string carries a credential such as URL userinfo, a git sshkey parameter or S3 keys, exposing the secret to every reader of the configuration"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:tf:module:credentialInSource')
+      and $prop($, 'cdx:tf:module:credentialInSource') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Terraform module '{{ name }}@{{ version }}' resolves from a source that embeds credentials"
+  mitigation: "Rotate the exposed credential, move authentication to git credential helpers or an SSH agent, and keep the source URL credential-free"
+  evidence: |
+    {
+      "source": $prop($, 'cdx:tf:module:source'),
+      "sourceType": $prop($, 'cdx:tf:module:sourceType'),
+      "credentialInSource": $prop($, 'cdx:tf:module:credentialInSource')
+    }

package/data/rules/go-binaries.yaml

@@ -0,0 +1,46 @@
+# Go binary toolchain rules
+# Category: go-security
+# Evaluates the cdx:go:buildVersion property recorded for executable file
+# components during container/rootfs scans.
+
+- id: GO-TLS-001
+  name: "Go binary built with a toolchain that lacks the CVE-2026-111943 distrust list"
+  description: "Go links its standard library statically, so a binary keeps the trust behaviour of the toolchain it was built with. Releases before go1.26.10, and go1.27.0 through go1.27.2, lack the eight SPKI hashes Go uses to distrust the CVE-2026-111943 intermediate CA keys, and older release lines (1.25 and earlier) will never receive them. Release candidates of newer lines (go1.28rc1) already carry the fix."
+  severity: high
+  category: go-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and $hasProp($, 'cdx:go:buildVersion')
+      and (
+        $prop($, 'cdx:go:buildVersion') = 'unknown-pre-1.18'
+        or (
+          $m := $match($prop($, 'cdx:go:buildVersion'), /^go(\d+)\.(\d+)(?:\.(\d+))?/);
+          $m != null
+          and $number($m.groups[0]) = 1
+          and (
+            $number($m.groups[1]) < 26
+            or (
+              $number($m.groups[1]) = 26
+              and ($m.groups[2] != null ? $number($m.groups[2]) : 0) < 10
+            )
+            or (
+              $number($m.groups[1]) = 27
+              and ($m.groups[2] != null ? $number($m.groups[2]) : 0) < 3
+            )
+          )
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Go binary '{{ name }}' was built with {{ $prop($, 'cdx:go:buildVersion') }}, which lacks the CVE-2026-111943 distrust list"
+  mitigation: "Rebuild the binary with go1.26.10, go1.27.3 or newer so its crypto/x509 rejects the distrusted intermediate CA keys."
+  evidence: |
+    {
+      "buildVersion": $prop($, 'cdx:go:buildVersion'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }

package/data/rules/golem-go.yaml

@@ -227,3 +227,83 @@
       "goModExcludeCount": $prop($, 'cdx:golem:goModExcludeCount'),
       "excludeModule": $prop($, 'cdx:golem:excludeModule')
     }
+
+- id: GOLEM-SEC-008
+  name: "Go component configures a custom TLS root pool"
+  description: "Golem reported a tls.Config RootCAs or x509.VerifyOptions Roots override, so the module validates certificates against a pool it supplies instead of the system roots"
+  severity: low
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-TLS-CUSTOM-ROOTS' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' sets a custom TLS root CA pool"
+  mitigation: "Review where the custom pool comes from and refresh it from a trusted source; a stale pool keeps trusting revoked or distrusted intermediates"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }
+
+- id: GOLEM-SEC-009
+  name: "Go component replaces certificate verification"
+  description: "Golem reported a VerifyPeerCertificate or VerifyConnection callback, so the module performs its own certificate validation instead of (part of) the standard chain verification"
+  severity: medium
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-TLS-CUSTOM-VERIFY' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' installs a custom certificate verification callback"
+  mitigation: "Check that the callback still calls Certificate.Verify, or that its custom checks are at least as strict; hand-rolled verification can miss revoked or distrusted intermediates"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }
+
+- id: GOLEM-SEC-010
+  name: "Go component disables TLS verification while customising it"
+  description: "Golem reported an InsecureSkipVerify setting on a tls.Config that also customises verification, the pattern where Go's own distrust list no longer applies"
+  severity: high
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-TLS-VERIFY-REPLACED' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' sets InsecureSkipVerify together with custom verification"
+  mitigation: "Remove InsecureSkipVerify and implement the required checks inside VerifyPeerCertificate on top of the standard chain verification"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }
+
+- id: GOLEM-SEC-011
+  name: "Go component embeds a certificate pool"
+  description: "Golem reported a package-level //go:embed variable fed to x509.CertPool.AppendCertsFromPEM, so a private trust anchor travels inside the binary"
+  severity: low
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-X509-EMBEDDED-POOL' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' appends an embedded PEM bundle to an x509 pool"
+  mitigation: "Track the embedded bundle like any other trust store: refresh it when CAs change and confirm it contains none of the distrusted keys"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }

package/data/rules/hbom-compliance.yaml

@@ -16,26 +16,38 @@
       - "1.1 Establish and Maintain Detailed Enterprise Asset Inventory"
   condition: |
     metadata.component[
-      $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
-      and $count(
-        $$.components[
-          $prop($, 'cdx:hbom:hardwareClass') = 'board'
-          and (
-            $hasProp($, 'cdx:hbom:boardVendor')
-            or $hasProp($, 'cdx:hbom:boardName')
-            or $hasProp($, 'cdx:hbom:biosVendor')
-            or $hasProp($, 'cdx:hbom:biosVersion')
-            or $hasProp($, 'cdx:hbom:firmwareDate')
-          )
-        ]
-      ) = 0
+      (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
+        and $count(
+          $$.components[
+            $prop($, 'cdx:hbom:hardwareClass') = 'board'
+            and (
+              $hasProp($, 'cdx:hbom:boardVendor')
+              or $hasProp($, 'cdx:hbom:boardName')
+              or $hasProp($, 'cdx:hbom:biosVendor')
+              or $hasProp($, 'cdx:hbom:biosVersion')
+              or $hasProp($, 'cdx:hbom:firmwareDate')
+            )
+          ]
+        ) = 0
+      )
+      or (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'windows'
+        and $not(
+          $hasProp($, 'cdx:hbom:boardVendor')
+          or $hasProp($, 'cdx:hbom:boardName')
+          or $hasProp($, 'cdx:hbom:biosVendor')
+          or $hasProp($, 'cdx:hbom:biosVersion')
+          or $hasProp($, 'cdx:hbom:firmwareDate')
+        )
+      )
     ]
   location: |
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
   message: "HBOM for '{{ name }}' lacks board or firmware provenance fields needed for governance review"
-  mitigation: "Enable richer firmware/board collection on supported Linux hosts, validate SMBIOS access, and ensure the inventory captures board vendor, board name, BIOS vendor, BIOS version, and firmware date where available."
+  mitigation: "Enable richer firmware/board collection on supported Linux hosts, validate SMBIOS access, and ensure the inventory captures board vendor, board name, BIOS vendor, BIOS version, and firmware date where available. On Windows these come from the windows-cim-platform batch, which a network logon (SSH, WinRM) as a non-administrator cannot run: collect from a local session or an elevated one."
   evidence: |
     {
       "platform": $prop($, 'cdx:hbom:platform'),
@@ -142,7 +154,7 @@
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
   message: "HBOM for '{{ name }}' includes storage volumes but no explicit encryption posture evidence"
-  mitigation: "Enable volume-level enrichment on supported platforms or pair the HBOM with equivalent host controls evidence so encryption compliance can be verified."
+  mitigation: "Enable volume-level enrichment on supported platforms or pair the HBOM with equivalent host controls evidence so encryption compliance can be verified. On Windows, BitLocker status comes from the --privileged batch, so rerun from an elevated (Run as administrator) prompt with --privileged."
   evidence: |
     {
       "storageVolumeCount": $count($$.components[$prop($, 'cdx:hbom:hardwareClass') = 'storage-volume']),
@@ -219,8 +231,8 @@
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
-  message: "HBOM for '{{ name }}' hit permission-denied enrichments that likely require a rerun with --privileged"
-  mitigation: "Where policy allows, rerun HBOM collection with --privileged so cdx-hbom can use the documented non-interactive sudo path for permission-sensitive Linux enrichments."
+  message: "HBOM for '{{ name }}' hit permission-denied enrichments that likely require {{ $safeStr($prop($, 'cdx:hbom:platform')) = 'windows' ? 'a rerun from a local or elevated session' : 'a rerun with --privileged' }}"
+  mitigation: "Where policy allows, rerun HBOM collection with --privileged. On Linux, cdx-hbom then uses the documented non-interactive sudo path for permission-sensitive enrichments. On Windows it never elevates or prompts: run it from a local session (a non-administrator over SSH or WinRM is denied every WMI query) and, for the TPM, BitLocker and storage-reliability batch, from an elevated (Run as administrator) prompt."
   evidence: |
     {
       "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
@@ -260,7 +272,7 @@
 
 - id: HBC-009
   name: "HBOM board and BIOS provenance was blocked by permissions"
-  description: "When dmidecode-backed firmware and board enrichment is blocked, the HBOM may miss board-vendor, board-name, BIOS-version, and related governance evidence."
+  description: "When dmidecode-backed firmware and board enrichment is blocked on Linux, or Windows denies WMI to the whole session (a network logon), the HBOM may miss board-vendor, board-name, BIOS-version, and related governance evidence."
   severity: medium
   category: hbom-compliance
   dry-run-support: full
@@ -270,15 +282,21 @@
       - "SI-7 Software, Firmware, and Information Integrity"
   condition: |
     metadata.component[
-      $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
-      and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'dmidecode-firmware-board')
+      (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
+        and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'dmidecode-firmware-board')
+      )
+      or (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'windows'
+        and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'windows-cim-platform:network-logon')
+      )
     ]
   location: |
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
-  message: "HBOM for '{{ name }}' could not capture full board and BIOS provenance because dmidecode enrichment was blocked"
-  mitigation: "Where policy allows, rerun with --privileged or equivalent access so the collector can gather firmware vendor, BIOS version, board vendor, and board name data."
+  message: "HBOM for '{{ name }}' could not capture full board and BIOS provenance because {{ $safeStr($prop($, 'cdx:hbom:platform')) = 'windows' ? 'WMI was denied to this network logon' : 'dmidecode enrichment was blocked' }}"
+  mitigation: "Where policy allows, rerun with --privileged or equivalent access so the collector can gather firmware vendor, BIOS version, board vendor, and board name data. On Windows, run HBOM from a local session or an elevated one instead of over SSH or WinRM as a non-administrator."
   evidence: |
     {
       "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),

package/data/rules/hbom-performance.yaml

@@ -32,7 +32,7 @@
 
 - id: HBP-002
   name: "Storage health is degraded or wear is near exhaustion"
-  description: "Degraded SMART state or high wear percentage is a strong leading indicator of latency, failure, or replacement pressure."
+  description: "Degraded SMART state, a Warning or Unhealthy Windows storage health status, or high wear percentage is a strong leading indicator of latency, failure, or replacement pressure."
   severity: high
   category: hbom-performance
   dry-run-support: full
@@ -50,6 +50,10 @@
           and $lowercase($safeStr($prop($, 'cdx:hbom:smartStatus'))) != 'ok'
           and $lowercase($safeStr($prop($, 'cdx:hbom:smartStatus'))) != 'passed'
         )
+        or (
+          $lowercase($safeStr($prop($, 'cdx:hbom:healthStatus'))) = 'warning'
+          or $lowercase($safeStr($prop($, 'cdx:hbom:healthStatus'))) = 'unhealthy'
+        )
         or (
           $hasProp($, 'cdx:hbom:wearPercentageUsed')
           and $number($prop($, 'cdx:hbom:wearPercentageUsed')) >= 80
@@ -65,6 +69,8 @@
   evidence: |
     {
       "smartStatus": $prop($, 'cdx:hbom:smartStatus'),
+      "healthStatus": $prop($, 'cdx:hbom:healthStatus'),
+      "operationalStatus": $prop($, 'cdx:hbom:operationalStatus'),
       "wearPercentageUsed": $prop($, 'cdx:hbom:wearPercentageUsed'),
       "revision": $prop($, 'cdx:hbom:revision'),
       "deviceSerial": $prop($, 'cdx:hbom:deviceSerial')

package/data/rules/host-topology.yaml

@@ -90,7 +90,7 @@
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
   message: "Merged host inventory for '{{ name }}' contains no strict HBOM-to-OBOM topology links"
-  mitigation: "Review collector coverage, ensure runtime categories such as interface_addresses or kernel_modules are available, and prefer exact identifier-bearing probes over heuristic joins."
+  mitigation: "Review collector coverage, ensure runtime categories such as interface_addresses or kernel_modules (logical_drives on Windows) are available, and prefer exact identifier-bearing probes over heuristic joins."
   evidence: |
     {
       "hostViewMode": $prop($, 'cdx:hostview:mode'),

package/data/rules/obom-runtime.yaml

@@ -111,8 +111,9 @@
       "deviceId": name,
       "driveLetter": version,
       "protectionStatus": $prop($, 'protection_status'),
-      "encryptionMethod": $prop($, 'encryption_method'),
-      "percentageEncrypted": $prop($, 'percentage_encrypted')
+      "encryptionMethod": description,
+      "percentageEncrypted": $prop($, 'percentage_encrypted'),
+      "protectorTypes": $prop($, 'protector_types')
     }
 
 - id: OBOM-WIN-002
@@ -1774,3 +1775,31 @@
       "comment": description,
       "uid": $prop($, 'uid')
     }
+
+- id: OBOM-LNX-023
+  name: "Linux snap installed in devmode confinement"
+  description: "A snap installed with --devmode runs without its sandbox being enforced: policy violations are only logged. Devmode is meant for snap development, not for software a host relies on."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'snap_packages'
+      and $lowercase($safeStr($prop($, 'cdx:snap:confinement'))) = 'devmode'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Snap '{{ name }}' {{ version }} (revision {{ $prop($, 'cdx:snap:revision') }}) is installed in devmode confinement, so its sandbox is not enforced"
+  mitigation: "Reinstall the snap from a stable channel with strict confinement, or remove it. If devmode is required for development, keep it off production and shared hosts."
+  evidence: |
+    {
+      "snap": name,
+      "version": version,
+      "revision": $prop($, 'cdx:snap:revision'),
+      "channel": $prop($, 'cdx:snap:channel'),
+      "confinement": $prop($, 'cdx:snap:confinement'),
+      "grade": $prop($, 'grade')
+    }

package/data/rules/php-runtime.yaml

@@ -0,0 +1,143 @@
+# PHP source-build runtime rules
+# Category: php-security
+# Evaluates the cdx:php:* properties recorded for unpackaged PHP binaries and
+# shared libraries during container, rootfs and OS (obom) scans. CVE-2026-109618 and
+# CVE-2026-109619 are unauthenticated remote code execution bugs in request
+# handling; fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
+# https://www.php.net/archive/2026.php#2026-10-21-5
+#
+# Builds from the php-src PHP-<M.m>-CVE-2026-109618-109619 backport branches
+# keep their old version number, so a version check cannot tell them from a
+# vulnerable build. That caveat is in the finding text.
+
+- id: PHP-RCE-001
+  name: "Network-reachable PHP build affected by CVE-2026-109618 and CVE-2026-109619"
+  description: "A source-built PHP web SAPI older than its fixed release is vulnerable to two unauthenticated RCE bugs in request handling. PHP-FPM, php-cgi, libphp (Apache or embed) and FrankenPHP serve requests, so the worker is reachable from the network. The rule never reads PHP configuration: a mitigation never suppresses a finding."
+  severity: critical
+  category: php-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and $hasProp($, 'cdx:php:buildVersion')
+      and $hasProp($, 'cdx:php:sapi')
+      and (
+        $m := $match($prop($, 'cdx:php:buildVersion'), /^(\d+)\.(\d+)\.(\d+)(?:-(dev)|(alpha|beta|RC)(\d+))?$/);
+        $m != null
+        and (
+          $number($m.groups[0]) < 8
+          or ($number($m.groups[0]) = 8 and $number($m.groups[1]) < 2)
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 2
+            and $number($m.groups[2]) < 35
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 3
+            and $number($m.groups[2]) < 36
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 4
+            and $number($m.groups[2]) < 27
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 5
+            and $number($m.groups[2]) < 12
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 6
+            and $number($m.groups[2]) = 0
+            and $m.groups[4] != null
+            and (
+              $m.groups[4] = 'alpha'
+              or $m.groups[4] = 'beta'
+              or ($m.groups[4] = 'RC' and $number($m.groups[5]) <= 3)
+            )
+          )
+        )
+      )
+      and $prop($, 'cdx:php:sapi') in ['fpm', 'cgi', 'libphp', 'frankenphp']
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "PHP {{ $prop($, 'cdx:php:sapi') }} '{{ name }}' is {{ $prop($, 'cdx:php:buildVersion') }}, which is affected by CVE-2026-109618 and CVE-2026-109619 (unauthenticated RCE); fixed in {{ $startsWith($prop($, 'cdx:php:buildVersion'), '8.2.') ? '8.2.35' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.3.') ? '8.3.36' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.4.') ? '8.4.27' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.5.') ? '8.5.12' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.6.') ? '8.6.0RC4 or later' : 'a supported PHP branch or a vendor backport (builds from the php-src CVE backport branches keep their version number and are false positives)' }}"
+  mitigation: "Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 8.1 and older, move to a supported branch or a vendor backport. https://www.php.net/archive/2026.php#2026-10-21-5 Interim measures named by the advisory (an admin-level memory_limit=-1, a low post_max_size, session.upload_progress.enabled=0, and fatal_error_backtraces=0 on 8.5) reduce but do not remove the risk. Builds from the php-src PHP-<M.m>-CVE-2026-109618-109619 backport branches keep their old version number and are false positives."
+  evidence: |
+    {
+      "buildVersion": $prop($, 'cdx:php:buildVersion'),
+      "sapi": $prop($, 'cdx:php:sapi'),
+      "source": $prop($, 'cdx:php:buildVersionSource'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: PHP-RCE-002
+  name: "PHP CLI build affected by CVE-2026-109618 and CVE-2026-109619"
+  description: "A source-built PHP CLI or phpdbg older than its fixed release contains the same vulnerable request-handling code. The CLI is not network-reachable, but any web SAPI built from the same tree is, so the build should be upgraded."
+  severity: medium
+  category: php-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and $hasProp($, 'cdx:php:buildVersion')
+      and $hasProp($, 'cdx:php:sapi')
+      and (
+        $m := $match($prop($, 'cdx:php:buildVersion'), /^(\d+)\.(\d+)\.(\d+)(?:-(dev)|(alpha|beta|RC)(\d+))?$/);
+        $m != null
+        and (
+          $number($m.groups[0]) < 8
+          or ($number($m.groups[0]) = 8 and $number($m.groups[1]) < 2)
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 2
+            and $number($m.groups[2]) < 35
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 3
+            and $number($m.groups[2]) < 36
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 4
+            and $number($m.groups[2]) < 27
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 5
+            and $number($m.groups[2]) < 12
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 6
+            and $number($m.groups[2]) = 0
+            and $m.groups[4] != null
+            and (
+              $m.groups[4] = 'alpha'
+              or $m.groups[4] = 'beta'
+              or ($m.groups[4] = 'RC' and $number($m.groups[5]) <= 3)
+            )
+          )
+        )
+      )
+      and $prop($, 'cdx:php:sapi') in ['cli', 'phpdbg']
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "PHP {{ $prop($, 'cdx:php:sapi') }} '{{ name }}' is {{ $prop($, 'cdx:php:buildVersion') }}, which is affected by CVE-2026-109618 and CVE-2026-109619 (unauthenticated RCE); fixed in {{ $startsWith($prop($, 'cdx:php:buildVersion'), '8.2.') ? '8.2.35' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.3.') ? '8.3.36' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.4.') ? '8.4.27' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.5.') ? '8.5.12' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.6.') ? '8.6.0RC4 or later' : 'a supported PHP branch or a vendor backport (builds from the php-src CVE backport branches keep their version number and are false positives)' }}. The CLI is not network-reachable, but the same build's web SAPIs are."
+  mitigation: "Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 8.1 and older, move to a supported branch or a vendor backport. https://www.php.net/archive/2026.php#2026-10-21-5 Builds from the php-src PHP-<M.m>-CVE-2026-109618-109619 backport branches keep their old version number and are false positives."
+  evidence: |
+    {
+      "buildVersion": $prop($, 'cdx:php:buildVersion'),
+      "sapi": $prop($, 'cdx:php:sapi'),
+      "source": $prop($, 'cdx:php:buildVersionSource'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }

package/data/rules/scala-evidence.yaml

@@ -0,0 +1,115 @@
+# Scala Evinse and scalasem Rules
+# Categories: scala-security, scala-compliance
+# Evaluates cdx:scalasem:* properties and the crypto assets emitted by
+# evinse -l scala and cdxgen --evidence for Scala projects.
+
+- id: SCALA-SEC-001
+  name: "Scala source uses a weak cryptographic algorithm in runtime code"
+  description: "scalasem flagged a weak algorithm, mode or key size at a call site in main or generated sources (MD5, SHA-1, DES, ECB, or a key below the modern floor)"
+  severity: medium
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'cryptographic-asset'
+      and $prop($, 'cdx:scalasem:crypto:weak') = 'true'
+      and (
+        'main' in properties[name = 'cdx:scalasem:usageScopes'].value
+        or 'generated' in properties[name = 'cdx:scalasem:usageScopes'].value
+      )
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "name": name }
+  message: "Weak cryptographic algorithm '{{ name }}' used in Scala source"
+  mitigation: "Move to the modern equivalent of this algorithm, mode and key size, and confirm no compatibility constraint forces the weak one. The locations name the exact call sites"
+  evidence: |
+    {
+      "algorithm": name,
+      "oid": cryptoProperties.oid,
+      "api": $prop($, 'cdx:scalasem:crypto:api'),
+      "locations": evidence.occurrences.(location & '#' & line)
+    }
+
+- id: SCALA-SEC-002
+  name: "Scala source calls an outbound service over plaintext transport"
+  description: "scalasem found an outbound HTTP or websocket client whose target URL starts with http:// or ws:// and is not a loopback address, so traffic and credentials cross the network unencrypted"
+  severity: medium
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    services[
+      $exists($filter(endpoints, function($e) {
+        ($contains($e, 'http://') or $contains($e, 'ws://'))
+        and $not($contains($e, /:\/\/(localhost|127\.[0-9.]+|\[::1\])(:|\/|$)/))
+      }))
+      and $prop($, 'cdx:scalasem:service:kind') != null
+    ]
+  location: |
+    { "name": name, "endpoints": endpoints }
+  message: "Outbound service '{{ name }}' is called over plaintext"
+  mitigation: "Switch the target to https:// or wss://, or a local socket if the peer is on the same host. The call sites are named by the service's cdx:scalasem:service:location properties"
+  evidence: |
+    {
+      "kind": $prop($, 'cdx:scalasem:service:kind'),
+      "client": $prop($, 'cdx:scalasem:service:client'),
+      "locations": $filter(properties, function($p) { $p.name = 'cdx:scalasem:service:location' }).value
+    }
+
+- id: SCALA-SEC-003
+  name: "Admin-like Scala endpoint is not marked as authenticated"
+  description: "scalasem found an inbound route with an admin, internal, manage or debug path segment that the report does not mark as authenticated. The source analysis does not see middleware or gateways, so this is a path-based prompt for review"
+  severity: low
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    services[
+      $exists($filter(endpoints, function($e) { $contains($e, /(^|\/)(admin|internal|manage|debug)(\/|$)/) }))
+      and $prop($, 'cdx:scalasem:endpoint:framework') != null
+      and $not(authenticated = true)
+    ]
+  location: |
+    { "name": name, "endpoints": endpoints }
+  message: "Endpoint '{{ name }}' looks administrative and is not marked as authenticated"
+  mitigation: "Confirm the route is protected by middleware or a gateway the source does not show, and otherwise require authentication on it. The declaration site is named by the service's cdx:scalasem:service:location property"
+  evidence: |
+    {
+      "framework": $prop($, 'cdx:scalasem:endpoint:framework'),
+      "handler": $prop($, 'cdx:scalasem:endpoint:handler'),
+      "locations": $filter(properties, function($p) { $p.name = 'cdx:scalasem:service:location' }).value
+    }
+
+- id: SCALA-SEC-004
+  name: "Scala source uses a weak algorithm that has no registry OID"
+  description: "scalasem flagged a weak algorithm that the OID registry cannot name, such as an MD5 or SHA-1 based signature or an RC4 password scheme, so it is recorded as a property instead of a crypto asset"
+  severity: medium
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    $append(components, metadata.component)[
+      $exists(properties[name = 'cdx:scalasem:crypto:weakFinding'])
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "name": name }
+  message: "Weak cryptographic algorithm used in Scala source, recorded on '{{ name }}'"
+  mitigation: "Move to a modern algorithm. Each finding names the algorithm and its call site as name@file#line"
+  evidence: |
+    {
+      "findings": properties[name = 'cdx:scalasem:crypto:weakFinding'].value
+    }
+
+- id: SCALA-COMP-001
+  name: "Scala semantic evidence is incomplete"
+  description: "The scalasem run behind this BOM was degraded, for example by class files no compiler could read, a missing classpath, a timeout or a failed analyzer, so the BOM's Scala evidence may be missing usages, crypto findings or services"
+  severity: low
+  category: scala-compliance
+  dry-run-support: full
+  condition: |
+    metadata.component[$prop($, 'cdx:scalasem:degraded') = 'true']
+  location: |
+    { "bomRef": $."bom-ref", "name": name }
+  message: "The Scala semantic evidence for '{{ name }}' is incomplete"
+  mitigation: "Read the cdx:scalasem:diagnostic:* metadata properties for the cause, and build the project before scanning when the diagnostics name missing class files or a missing classpath"
+  evidence: |
+    {
+      "diagnostics": $filter(properties, function($p) { $contains($p.name, 'cdx:scalasem:diagnostic:') }).(name & '=' & value)
+    }