@cdxgen/cdxgen 13.4.0 → 13.6.0

package/data/rules/php-runtime.yaml

@@ -0,0 +1,143 @@
+# PHP source-build runtime rules
+# Category: php-security
+# Evaluates the cdx:php:* properties recorded for unpackaged PHP binaries and
+# shared libraries during container, rootfs and OS (obom) scans. CVE-2026-109618 and
+# CVE-2026-109619 are unauthenticated remote code execution bugs in request
+# handling; fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
+# https://www.php.net/archive/2026.php#2026-10-21-5
+#
+# Builds from the php-src PHP-<M.m>-CVE-2026-109618-109619 backport branches
+# keep their old version number, so a version check cannot tell them from a
+# vulnerable build. That caveat is in the finding text.
+
+- id: PHP-RCE-001
+  name: "Network-reachable PHP build affected by CVE-2026-109618 and CVE-2026-109619"
+  description: "A source-built PHP web SAPI older than its fixed release is vulnerable to two unauthenticated RCE bugs in request handling. PHP-FPM, php-cgi, libphp (Apache or embed) and FrankenPHP serve requests, so the worker is reachable from the network. The rule never reads PHP configuration: a mitigation never suppresses a finding."
+  severity: critical
+  category: php-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and $hasProp($, 'cdx:php:buildVersion')
+      and $hasProp($, 'cdx:php:sapi')
+      and (
+        $m := $match($prop($, 'cdx:php:buildVersion'), /^(\d+)\.(\d+)\.(\d+)(?:-(dev)|(alpha|beta|RC)(\d+))?$/);
+        $m != null
+        and (
+          $number($m.groups[0]) < 8
+          or ($number($m.groups[0]) = 8 and $number($m.groups[1]) < 2)
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 2
+            and $number($m.groups[2]) < 35
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 3
+            and $number($m.groups[2]) < 36
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 4
+            and $number($m.groups[2]) < 27
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 5
+            and $number($m.groups[2]) < 12
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 6
+            and $number($m.groups[2]) = 0
+            and $m.groups[4] != null
+            and (
+              $m.groups[4] = 'alpha'
+              or $m.groups[4] = 'beta'
+              or ($m.groups[4] = 'RC' and $number($m.groups[5]) <= 3)
+            )
+          )
+        )
+      )
+      and $prop($, 'cdx:php:sapi') in ['fpm', 'cgi', 'libphp', 'frankenphp']
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "PHP {{ $prop($, 'cdx:php:sapi') }} '{{ name }}' is {{ $prop($, 'cdx:php:buildVersion') }}, which is affected by CVE-2026-109618 and CVE-2026-109619 (unauthenticated RCE); fixed in {{ $startsWith($prop($, 'cdx:php:buildVersion'), '8.2.') ? '8.2.35' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.3.') ? '8.3.36' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.4.') ? '8.4.27' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.5.') ? '8.5.12' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.6.') ? '8.6.0RC4 or later' : 'a supported PHP branch or a vendor backport (builds from the php-src CVE backport branches keep their version number and are false positives)' }}"
+  mitigation: "Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 8.1 and older, move to a supported branch or a vendor backport. https://www.php.net/archive/2026.php#2026-10-21-5 Interim measures named by the advisory (an admin-level memory_limit=-1, a low post_max_size, session.upload_progress.enabled=0, and fatal_error_backtraces=0 on 8.5) reduce but do not remove the risk. Builds from the php-src PHP-<M.m>-CVE-2026-109618-109619 backport branches keep their old version number and are false positives."
+  evidence: |
+    {
+      "buildVersion": $prop($, 'cdx:php:buildVersion'),
+      "sapi": $prop($, 'cdx:php:sapi'),
+      "source": $prop($, 'cdx:php:buildVersionSource'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: PHP-RCE-002
+  name: "PHP CLI build affected by CVE-2026-109618 and CVE-2026-109619"
+  description: "A source-built PHP CLI or phpdbg older than its fixed release contains the same vulnerable request-handling code. The CLI is not network-reachable, but any web SAPI built from the same tree is, so the build should be upgraded."
+  severity: medium
+  category: php-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and $hasProp($, 'cdx:php:buildVersion')
+      and $hasProp($, 'cdx:php:sapi')
+      and (
+        $m := $match($prop($, 'cdx:php:buildVersion'), /^(\d+)\.(\d+)\.(\d+)(?:-(dev)|(alpha|beta|RC)(\d+))?$/);
+        $m != null
+        and (
+          $number($m.groups[0]) < 8
+          or ($number($m.groups[0]) = 8 and $number($m.groups[1]) < 2)
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 2
+            and $number($m.groups[2]) < 35
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 3
+            and $number($m.groups[2]) < 36
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 4
+            and $number($m.groups[2]) < 27
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 5
+            and $number($m.groups[2]) < 12
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 6
+            and $number($m.groups[2]) = 0
+            and $m.groups[4] != null
+            and (
+              $m.groups[4] = 'alpha'
+              or $m.groups[4] = 'beta'
+              or ($m.groups[4] = 'RC' and $number($m.groups[5]) <= 3)
+            )
+          )
+        )
+      )
+      and $prop($, 'cdx:php:sapi') in ['cli', 'phpdbg']
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "PHP {{ $prop($, 'cdx:php:sapi') }} '{{ name }}' is {{ $prop($, 'cdx:php:buildVersion') }}, which is affected by CVE-2026-109618 and CVE-2026-109619 (unauthenticated RCE); fixed in {{ $startsWith($prop($, 'cdx:php:buildVersion'), '8.2.') ? '8.2.35' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.3.') ? '8.3.36' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.4.') ? '8.4.27' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.5.') ? '8.5.12' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.6.') ? '8.6.0RC4 or later' : 'a supported PHP branch or a vendor backport (builds from the php-src CVE backport branches keep their version number and are false positives)' }}. The CLI is not network-reachable, but the same build's web SAPIs are."
+  mitigation: "Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 8.1 and older, move to a supported branch or a vendor backport. https://www.php.net/archive/2026.php#2026-10-21-5 Builds from the php-src PHP-<M.m>-CVE-2026-109618-109619 backport branches keep their old version number and are false positives."
+  evidence: |
+    {
+      "buildVersion": $prop($, 'cdx:php:buildVersion'),
+      "sapi": $prop($, 'cdx:php:sapi'),
+      "source": $prop($, 'cdx:php:buildVersionSource'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }

package/data/rules/vscode-extensions.yaml

@@ -235,3 +235,78 @@
       "main": $prop($, 'cdx:vscode-extension:main'),
       "contributes": $prop($, 'cdx:vscode-extension:contributes')
     }
+
+- id: VSC-010
+  name: "Extension folder the editor never registered"
+  description: "An extension folder that is on disk but missing from the editor's extensions.json was copied in by hand rather than installed by the editor, so no marketplace or signature check applied to it"
+  severity: high
+  category: vscode-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:vscode-extension/')
+      and $prop($, 'cdx:vscode-extension:registered') = 'false'
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "VS Code extension '{{ publisher }}.{{ name }}@{{ version }}' is in the extensions folder of {{ $prop($, 'cdx:vscode-extension:ide') }} but not in its registry"
+  mitigation: "Find out who placed the folder; remove it and reinstall the extension from the marketplace if it is wanted"
+  evidence: |
+    {
+      "ide": $prop($, 'cdx:vscode-extension:ide'),
+      "activationEvents": $prop($, 'cdx:vscode-extension:activationEvents'),
+      "main": $prop($, 'cdx:vscode-extension:main')
+    }
+
+- id: VSC-011
+  name: "Extension installed from a .vsix file"
+  description: "An extension installed from a local .vsix file bypassed the marketplace, so its publisher, signature and version history were not checked at install time"
+  severity: medium
+  category: vscode-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:vscode-extension/')
+      and $listContains($propList($, 'cdx:vscode-extension:installSource'), 'vsix')
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "VS Code extension '{{ publisher }}.{{ name }}@{{ version }}' was installed from a .vsix file in {{ $prop($, 'cdx:vscode-extension:ide') }}"
+  mitigation: "Confirm where the .vsix came from and compare the entry-file hash with the marketplace build of the same version"
+  evidence: |
+    {
+      "ide": $prop($, 'cdx:vscode-extension:ide'),
+      "installedAt": $prop($, 'cdx:vscode-extension:installedAt')
+    }
+
+- id: VSC-012
+  name: "Two copies of one extension build run different code"
+  description: "The same publisher, name, version and platform is installed in more than one place, but the entry files differ, so at least one copy was changed after it was installed"
+  severity: high
+  category: vscode-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:vscode-extension/')
+      and $prop($, 'cdx:vscode-extension:entryHashMismatch') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl
+    }
+  message: "VS Code extension '{{ publisher }}.{{ name }}@{{ version }}' has different entry-file bytes in {{ $prop($, 'cdx:vscode-extension:ide') }}"
+  mitigation: "Compare each copy's entry-file SHA-256 with the marketplace build of the same version, remove the copy that differs and reinstall it from the marketplace"
+  evidence: |
+    {
+      "ide": $prop($, 'cdx:vscode-extension:ide'),
+      "entryFiles": components.{ "name": name, "sha256": hashes[0].content }
+    }

package/data/spdx-license-list.json

@@ -494,6 +494,15 @@
         "https://github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.1.txt"
       ]
     },
+    "atc-game": {
+      "name": "atc Game License",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/vattam/BSDGames/blob/master/atc/extern.c#L36"
+      ]
+    },
     "Baekmuk": {
       "name": "Baekmuk License",
       "isDeprecated": false,
@@ -737,6 +746,18 @@
         "https://github.com/audacious-media-player/audacious/blob/master/COPYING"
       ]
     },
+    "BSD-2-Clause-pos-unchanged": {
+      "name": "BSD 2-Clause - position unchanged variant",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://scancode-licensedb.aboutcode.org/bsd-unchanged",
+        "https://cgit.freebsd.org/src/tree/usr.bin/sockstat/sockstat.c",
+        "https://github.com/libarchive/libarchive/blob/master/libarchive_fe/line_reader.c",
+        "https://github.com/freebsd/pkg/blob/main/src/add.c"
+      ]
+    },
     "BSD-2-Clause-Views": {
       "name": "BSD 2-Clause with views sentence",
       "isDeprecated": false,
@@ -868,6 +889,15 @@
         "http://www.netlib.org/lapack/LICENSE.txt"
       ]
     },
+    "BSD-3-Clause-OpenWebUI": {
+      "name": "BSD 3-Clause - OpenWebUI variant",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/open-webui/open-webui/blob/main/LICENSE"
+      ]
+    },
     "BSD-3-Clause-Sun": {
       "name": "BSD 3-Clause Sun Microsystems",
       "isDeprecated": false,
@@ -943,6 +973,15 @@
         "https://github.com/python-excel/xlrd/blob/master/LICENSE#L33"
       ]
     },
+    "BSD-ask-to-endorse": {
+      "name": "BSD - ask to endorse",
+      "isDeprecated": false,
+      "isOsiApproved": true,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/sudo-project/sudo/blob/c1307ea9ff340ce0538779f8e456501461fc44b7/plugins/sudoers/redblack.c#L24-L43"
+      ]
+    },
     "BSD-Attribution-HPND-disclaimer": {
       "name": "BSD with Attribution and HPND disclaimer",
       "isDeprecated": false,
@@ -979,6 +1018,15 @@
         "https://fedoraproject.org/wiki/Licensing/BSD_Protection_License"
       ]
     },
+    "BSD-Source-alt-GPL": {
+      "name": "BSD Source Code Attribution - GPL alternative",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://cgit.freebsd.org/src/plain/sys/dev/aic7xxx/aic7xxx_osm.c"
+      ]
+    },
     "BSD-Source-beginning-file": {
       "name": "BSD Source Code Attribution - beginning of file variant",
       "isDeprecated": false,
@@ -997,6 +1045,15 @@
         "https://github.com/robbiehanson/CocoaHTTPServer/blob/master/LICENSE.txt"
       ]
     },
+    "BSD-Source-Code-no-disclaimer": {
+      "name": "BSD Source Code Attribution - no disclaimer",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/PicoEFI/PicoEFI/blob/2263ac1a2bc98e5534d64a4896d3cfbbae00745a/LICENSES/LicenseRef-scancode-bsd-no-disclaimer-unmodified.txt"
+      ]
+    },
     "BSD-Systemics": {
       "name": "Systemics BSD variant license",
       "isDeprecated": false,
@@ -1034,6 +1091,15 @@
         "https://sourceforge.net/p/buddy/gitcode/ci/master/tree/README"
       ]
     },
+    "Bugroff": {
+      "name": "Bugroff License",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://tunes.org/legalese/bugroff.html"
+      ]
+    },
     "BUSL-1.1": {
       "name": "Business Source License 1.1",
       "isDeprecated": false,
@@ -1292,6 +1358,15 @@
         "https://creativecommons.org/licenses/by-nc/3.0/de/legalcode"
       ]
     },
+    "CC-BY-NC-3.0-IGO": {
+      "name": "Creative Commons Attribution Non Commercial 3.0 IGO",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://creativecommons.org/licenses/by-nc/3.0/igo/legalcode"
+      ]
+    },
     "CC-BY-NC-4.0": {
       "name": "Creative Commons Attribution Non Commercial 4.0 International",
       "isDeprecated": false,
@@ -1878,10 +1953,11 @@
     "CNRI-Python-GPL-Compatible": {
       "name": "CNRI Python Open Source GPL Compatible License Agreement",
       "isDeprecated": false,
-      "isOsiApproved": false,
+      "isOsiApproved": true,
       "isFsfLibre": false,
       "seeAlso": [
-        "http://www.python.org/download/releases/1.6.1/download_win/"
+        "http://www.python.org/download/releases/1.6.1/download_win/",
+        "https://opensource.org/license/CNRI-Python-GPL-Compatible"
       ]
     },
     "COIL-1.0": {
@@ -2028,10 +2104,11 @@
     "curl": {
       "name": "curl License",
       "isDeprecated": false,
-      "isOsiApproved": false,
+      "isOsiApproved": true,
       "isFsfLibre": false,
       "seeAlso": [
-        "https://github.com/bagder/curl/blob/master/COPYING"
+        "https://github.com/bagder/curl/blob/master/COPYING",
+        "https://opensource.org/license/curl"
       ]
     },
     "cve-tou": {
@@ -2391,7 +2468,8 @@
         "https://joinup.ec.europa.eu/sites/default/files/custom-page/attachment/2020-03/EUPL-1.2%20EN.txt",
         "https://joinup.ec.europa.eu/sites/default/files/inline-files/EUPL%20v1_2%20EN(1).txt",
         "http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32017D0863",
-        "https://opensource.org/license/EUPL-1.2"
+        "https://opensource.org/license/EUPL-1.2",
+        "https://interoperable-europe.ec.europa.eu/sites/default/files/inline-files/EUPL%20v1_2%20EN(1).txt"
       ]
     },
     "Eurosym": {
@@ -2432,6 +2510,15 @@
         "https://directory.fsf.org/wiki/License:Fdk"
       ]
     },
+    "FDK-MPEG-H": {
+      "name": "Fraunhofer FDK MPEG-H Software",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/Fraunhofer-IIS/mpeghdec/blob/main/LICENSE.txt"
+      ]
+    },
     "Ferguson-Twofish": {
       "name": "Ferguson Twofish License",
       "isDeprecated": false,
@@ -3113,6 +3200,15 @@
         "https://github.com/EthicalSource/hippocratic-license/blob/58c0e646d64ff6fbee275bfe2b9492f914e3ab2a/LICENSE.txt"
       ]
     },
+    "Hippocratic-3.0-core": {
+      "name": "Hippocratic License 3.0",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://firstdonoharm.dev/version/3/0/core.txt"
+      ]
+    },
     "HP-1986": {
       "name": "Hewlett-Packard 1986 License",
       "isDeprecated": false,
@@ -3477,6 +3573,16 @@
         "http://www.info-zip.org/license.html"
       ]
     },
+    "Informatica": {
+      "name": "Informatica License",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/msend.c",
+        "https://raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/mdump.c"
+      ]
+    },
     "Inner-Net-2.0": {
       "name": "Inner Net License v2.0",
       "isDeprecated": false,
@@ -5526,12 +5632,13 @@
     "Python-2.0.1": {
       "name": "Python License 2.0.1",
       "isDeprecated": false,
-      "isOsiApproved": false,
+      "isOsiApproved": true,
       "isFsfLibre": false,
       "seeAlso": [
         "https://www.python.org/download/releases/2.0.1/license/",
         "https://docs.python.org/3/license.html",
-        "https://github.com/python/cpython/blob/main/LICENSE"
+        "https://github.com/python/cpython/blob/main/LICENSE",
+        "https://opensource.org/license/Python-2.0.1"
       ]
     },
     "python-ldap": {
@@ -7365,6 +7472,13 @@
         "https://sourceforge.net/p/teem/code/HEAD/tree/teem/trunk/LICENSE.txt"
       ]
     },
+    "Spelling-Provider-LGPL-exception": {
+      "name": "Spelling Provider LGPL exception",
+      "isDeprecated": false,
+      "seeAlso": [
+        "https://github.com/rrthomas/enchant/blob/774ff6dc2e441ba2b9b786f8edbe00e014960408/lib/internal.vapi#L18"
+      ]
+    },
     "sqlitestudio-OpenSSL-exception": {
       "name": "sqlitestudio OpenSSL exception",
       "isDeprecated": false,