@cdxgen/cdxgen 13.5.0 → 13.7.0

package/data/rules/brotli-decoder.yaml

@@ -0,0 +1,107 @@
+# Embedded Brotli decoder rules
+# Category: brotli-security
+# Evaluates the cdx:brotli:* properties recorded for native files (container,
+# rootfs and OS scans) and vendored source trees (C/C++ source scans).
+# CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder
+# (CWE-252, CWE-787) reachable from any Brotli stream an attacker controls:
+# an HTTP response a client decodes, a request body a server inflates, a
+# compressed file. Fixed in google/brotli 1.0.10, 1.1.1 and 1.2.1 (commit
+# 0ed4268). The Go port, andybalholm/brotli, had the same logic error but
+# only crashes; it is fixed in v1.2.7.
+# https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b
+#
+# The fix is read from the decoder itself (its BLOCK_SWITCH error name), not
+# from a version number, so a distro backport that keeps the old version is
+# recognised as fixed and a Node.js that still reports brotli 1.2.0 after the
+# fix is not flagged.
+
+- id: BROTLI-RCE-001
+  name: "Native file embeds a Brotli decoder affected by CVE-2026-111497"
+  description: "A binary, shared library or extension module carries its own copy of Google's C Brotli decoder without the fix for CVE-2026-111497. Updating the system libbrotli does not fix a private copy: the file itself has to be replaced by a release built from a fixed decoder."
+  severity: high
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:brotli:c:blockSwitchFix', 'false')
+      and $not($hasProp($, 'cdx:vendored', 'true'))
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "'{{ name }}' embeds a Brotli decoder without the CVE-2026-111497 fix; a crafted Brotli stream can write past a decoder buffer (possible code execution). {{ $hasProp($, 'cdx:node:buildVersion') ? 'Upgrade Node.js ' & $prop($, 'cdx:node:buildVersion') & ' to 22.23.4, 24.22.1, 26.12.1 or later.' : 'Replace it with a build that bundles brotli 1.0.10, 1.1.1 or 1.2.1 (or google/brotli commit 0ed4268).' }}"
+  mitigation: "Node.js: 22.23.4, 24.22.1, 26.12.1. Python: Brotli 1.2.1, brotlicffi 1.2.1.0. Ruby: brotli gem 0.9.2. Java: Brotli4j 1.24.0. Other software: a release that bundles brotli 1.0.10, 1.1.1 or 1.2.1, or a rebuild with google/brotli commit 0ed4268. Until then, reject Content-Encoding: br request bodies at the proxy and keep untrusted Brotli data away from the affected process."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "evidence": $prop($, 'cdx:brotli:c:evidence'),
+      "nodeVersion": $prop($, 'cdx:node:buildVersion')
+    }
+
+- id: BROTLI-RCE-002
+  name: "Vendored Brotli source affected by CVE-2026-111497"
+  description: "The project carries a copy of Google's Brotli sources whose decoder lacks the fix for CVE-2026-111497. Everything built from this tree inherits the bug, and no package manager or distro update will reach it."
+  severity: high
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:vendored', 'true')
+      and $hasProp($, 'cdx:brotli:c:blockSwitchFix', 'false')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Vendored Brotli {{ version }} at '{{ $prop($, 'cdx:vendored:path') }}' lacks the CVE-2026-111497 fix; update it to 1.0.10, 1.1.1 or 1.2.1, or cherry-pick google/brotli commit 0ed4268."
+  mitigation: "Update the vendored copy to brotli 1.0.10, 1.1.1 or 1.2.1, or cherry-pick google/brotli commit 0ed4268 (with 50a9b70, b418fa8 and da98063), then rebuild everything that links it."
+  evidence: |
+    {
+      "path": $prop($, 'cdx:vendored:path'),
+      "version": version,
+      "versionSource": $prop($, 'cdx:vendored:versionSource')
+    }
+
+- id: BROTLI-DOS-001
+  name: "Go binary embeds a Brotli port affected by the CVE-2026-111497 logic error"
+  description: "The Go port of the Brotli decoder (github.com/andybalholm/brotli) before v1.2.7 has the same unchecked block-switch error as the C decoder. Go's bounds checks turn it into a panic rather than a memory write, so a crafted stream crashes the process."
+  severity: medium
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:brotli:go:blockSwitchFix', 'false')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "'{{ name }}' embeds github.com/andybalholm/brotli older than v1.2.7; a crafted Brotli stream makes it panic. Rebuild with v1.2.7 or later."
+  mitigation: "Update github.com/andybalholm/brotli to v1.2.7 or later and rebuild the binary."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: BROTLI-RCE-003
+  name: "Native file embeds a Brotli decoder whose CVE-2026-111497 fix state cannot be read"
+  description: "A binary, shared library or extension module carries Google's C Brotli decoder, recognised by its decoding tables, but the linker dropped the error-name table that shows whether the fix is in (--gc-sections, LTO and -dead_strip do this when nothing calls BrotliDecoderErrorString). Whether the copy is vulnerable has to be settled from the release that built the file."
+  severity: low
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:brotli:c:blockSwitchFix', 'unknown')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "'{{ name }}' embeds a Brotli decoder whose CVE-2026-111497 fix state cannot be read from the file; check that it was built from brotli 1.0.10, 1.1.1, 1.2.1 or later, or with google/brotli commit 0ed4268."
+  mitigation: "Find the release the file belongs to and confirm it bundles a fixed decoder (brotli 1.0.10, 1.1.1, 1.2.1, or commit 0ed4268); replace it otherwise."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "evidence": $prop($, 'cdx:brotli:c:evidence')
+    }

package/data/rules/cbom-security.yaml

@@ -287,11 +287,12 @@
     }
 
 # Post-quantum OIDs (ML-DSA RFC 9881, SLH-DSA RFC 9909, ML-KEM RFC 9935) and
-# the classical-only cutoff. NIST IR 8547 (initial public draft) proposes
-# classical algorithms be disallowed after 2035.
+# the classical-only cutoff. NIST IR 8547 (final, October 2026) Tables 2 and 4
+# disallow quantum-vulnerable signature and key-establishment algorithms after
+# 2035.
 - id: CBC-005
   name: "Classical-only CA certificate valid past the post-quantum transition"
-  description: "A CA certificate whose key and signature algorithms are both classical stays valid beyond 2035-01-01, past the date NIST IR 8547 (initial public draft) proposes to disallow classical algorithms."
+  description: "A CA certificate whose key and signature algorithms are both classical stays valid beyond 2035-01-01, past the date after which NIST IR 8547 (final, October 2026, Tables 2 and 4) disallows quantum-vulnerable algorithms."
   severity: low
   category: cbom-security
   dry-run-support: full

package/data/rules/package-integrity.yaml

@@ -362,3 +362,31 @@
       "platform": $contains(purl, 'platform=') ? $substringAfter(purl, 'platform=') : 'ruby',
       "requiredRubyVersion": $prop($, 'cdx:gem:rubyVersionSpecifiers')
     }
+
+- id: INT-016
+  name: "Gradle verification metadata disagrees with the artifact digest"
+  description: >-
+    A component carries cdx:gradle:verificationMismatch=true: the digest
+    gradle/verification-metadata.xml records for this component's artifact
+    differs from the digest cdxgen computed from the artifact in the local
+    cache. A released Maven version does not change after publishing, so a
+    stale file cannot explain this. The likely causes are an artifact
+    republished on a mirror or internal repository, or a corrupted or
+    tampered cache. The recorded digest is never applied over the
+    artifact's own, and SNAPSHOT versions are not compared.
+  severity: high
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:gradle:verificationMismatch') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "The digest gradle/verification-metadata.xml records for '{{ name }}@{{ version }}' differs from the digest of the artifact on disk"
+  mitigation: "Compare the jar in the local cache with the copy the repository serves, and find out which repository or mirror served the differing one. Regenerate gradle/verification-metadata.xml only after that check: regenerating it first records the suspect digest and removes the evidence"
+  evidence: |
+    {
+      "verificationMethods": $prop($, 'cdx:gradle:verificationMethods'),
+      "pgpKeyIds": $prop($, 'cdx:gradle:pgpKeyIds')
+    }

package/data/rules/vscode-extensions.yaml

@@ -235,3 +235,78 @@
       "main": $prop($, 'cdx:vscode-extension:main'),
       "contributes": $prop($, 'cdx:vscode-extension:contributes')
     }
+
+- id: VSC-010
+  name: "Extension folder the editor never registered"
+  description: "An extension folder that is on disk but missing from the editor's extensions.json was copied in by hand rather than installed by the editor, so no marketplace or signature check applied to it"
+  severity: high
+  category: vscode-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:vscode-extension/')
+      and $prop($, 'cdx:vscode-extension:registered') = 'false'
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "VS Code extension '{{ publisher }}.{{ name }}@{{ version }}' is in the extensions folder of {{ $prop($, 'cdx:vscode-extension:ide') }} but not in its registry"
+  mitigation: "Find out who placed the folder; remove it and reinstall the extension from the marketplace if it is wanted"
+  evidence: |
+    {
+      "ide": $prop($, 'cdx:vscode-extension:ide'),
+      "activationEvents": $prop($, 'cdx:vscode-extension:activationEvents'),
+      "main": $prop($, 'cdx:vscode-extension:main')
+    }
+
+- id: VSC-011
+  name: "Extension installed from a .vsix file"
+  description: "An extension installed from a local .vsix file bypassed the marketplace, so its publisher, signature and version history were not checked at install time"
+  severity: medium
+  category: vscode-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:vscode-extension/')
+      and $listContains($propList($, 'cdx:vscode-extension:installSource'), 'vsix')
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl,
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+  message: "VS Code extension '{{ publisher }}.{{ name }}@{{ version }}' was installed from a .vsix file in {{ $prop($, 'cdx:vscode-extension:ide') }}"
+  mitigation: "Confirm where the .vsix came from and compare the entry-file hash with the marketplace build of the same version"
+  evidence: |
+    {
+      "ide": $prop($, 'cdx:vscode-extension:ide'),
+      "installedAt": $prop($, 'cdx:vscode-extension:installedAt')
+    }
+
+- id: VSC-012
+  name: "Two copies of one extension build run different code"
+  description: "The same publisher, name, version and platform is installed in more than one place, but the entry files differ, so at least one copy was changed after it was installed"
+  severity: high
+  category: vscode-extension
+  dry-run-support: full
+  condition: |
+    components[
+      $startsWith(purl, 'pkg:vscode-extension/')
+      and $prop($, 'cdx:vscode-extension:entryHashMismatch') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $. "bom-ref",
+      "purl": purl
+    }
+  message: "VS Code extension '{{ publisher }}.{{ name }}@{{ version }}' has different entry-file bytes in {{ $prop($, 'cdx:vscode-extension:ide') }}"
+  mitigation: "Compare each copy's entry-file SHA-256 with the marketplace build of the same version, remove the copy that differs and reinstall it from the marketplace"
+  evidence: |
+    {
+      "ide": $prop($, 'cdx:vscode-extension:ide'),
+      "entryFiles": components.{ "name": name, "sha256": hashes[0].content }
+    }

package/data/spdx-license-list.json

@@ -494,6 +494,15 @@
         "https://github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.1.txt"
       ]
     },
+    "atc-game": {
+      "name": "atc Game License",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/vattam/BSDGames/blob/master/atc/extern.c#L36"
+      ]
+    },
     "Baekmuk": {
       "name": "Baekmuk License",
       "isDeprecated": false,
@@ -737,6 +746,18 @@
         "https://github.com/audacious-media-player/audacious/blob/master/COPYING"
       ]
     },
+    "BSD-2-Clause-pos-unchanged": {
+      "name": "BSD 2-Clause - position unchanged variant",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://scancode-licensedb.aboutcode.org/bsd-unchanged",
+        "https://cgit.freebsd.org/src/tree/usr.bin/sockstat/sockstat.c",
+        "https://github.com/libarchive/libarchive/blob/master/libarchive_fe/line_reader.c",
+        "https://github.com/freebsd/pkg/blob/main/src/add.c"
+      ]
+    },
     "BSD-2-Clause-Views": {
       "name": "BSD 2-Clause with views sentence",
       "isDeprecated": false,
@@ -868,6 +889,15 @@
         "http://www.netlib.org/lapack/LICENSE.txt"
       ]
     },
+    "BSD-3-Clause-OpenWebUI": {
+      "name": "BSD 3-Clause - OpenWebUI variant",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/open-webui/open-webui/blob/main/LICENSE"
+      ]
+    },
     "BSD-3-Clause-Sun": {
       "name": "BSD 3-Clause Sun Microsystems",
       "isDeprecated": false,
@@ -943,6 +973,15 @@
         "https://github.com/python-excel/xlrd/blob/master/LICENSE#L33"
       ]
     },
+    "BSD-ask-to-endorse": {
+      "name": "BSD - ask to endorse",
+      "isDeprecated": false,
+      "isOsiApproved": true,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/sudo-project/sudo/blob/c1307ea9ff340ce0538779f8e456501461fc44b7/plugins/sudoers/redblack.c#L24-L43"
+      ]
+    },
     "BSD-Attribution-HPND-disclaimer": {
       "name": "BSD with Attribution and HPND disclaimer",
       "isDeprecated": false,
@@ -979,6 +1018,15 @@
         "https://fedoraproject.org/wiki/Licensing/BSD_Protection_License"
       ]
     },
+    "BSD-Source-alt-GPL": {
+      "name": "BSD Source Code Attribution - GPL alternative",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://cgit.freebsd.org/src/plain/sys/dev/aic7xxx/aic7xxx_osm.c"
+      ]
+    },
     "BSD-Source-beginning-file": {
       "name": "BSD Source Code Attribution - beginning of file variant",
       "isDeprecated": false,
@@ -997,6 +1045,15 @@
         "https://github.com/robbiehanson/CocoaHTTPServer/blob/master/LICENSE.txt"
       ]
     },
+    "BSD-Source-Code-no-disclaimer": {
+      "name": "BSD Source Code Attribution - no disclaimer",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/PicoEFI/PicoEFI/blob/2263ac1a2bc98e5534d64a4896d3cfbbae00745a/LICENSES/LicenseRef-scancode-bsd-no-disclaimer-unmodified.txt"
+      ]
+    },
     "BSD-Systemics": {
       "name": "Systemics BSD variant license",
       "isDeprecated": false,
@@ -1034,6 +1091,15 @@
         "https://sourceforge.net/p/buddy/gitcode/ci/master/tree/README"
       ]
     },
+    "Bugroff": {
+      "name": "Bugroff License",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://tunes.org/legalese/bugroff.html"
+      ]
+    },
     "BUSL-1.1": {
       "name": "Business Source License 1.1",
       "isDeprecated": false,
@@ -1292,6 +1358,15 @@
         "https://creativecommons.org/licenses/by-nc/3.0/de/legalcode"
       ]
     },
+    "CC-BY-NC-3.0-IGO": {
+      "name": "Creative Commons Attribution Non Commercial 3.0 IGO",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://creativecommons.org/licenses/by-nc/3.0/igo/legalcode"
+      ]
+    },
     "CC-BY-NC-4.0": {
       "name": "Creative Commons Attribution Non Commercial 4.0 International",
       "isDeprecated": false,
@@ -1878,10 +1953,11 @@
     "CNRI-Python-GPL-Compatible": {
       "name": "CNRI Python Open Source GPL Compatible License Agreement",
       "isDeprecated": false,
-      "isOsiApproved": false,
+      "isOsiApproved": true,
       "isFsfLibre": false,
       "seeAlso": [
-        "http://www.python.org/download/releases/1.6.1/download_win/"
+        "http://www.python.org/download/releases/1.6.1/download_win/",
+        "https://opensource.org/license/CNRI-Python-GPL-Compatible"
       ]
     },
     "COIL-1.0": {
@@ -2028,10 +2104,11 @@
     "curl": {
       "name": "curl License",
       "isDeprecated": false,
-      "isOsiApproved": false,
+      "isOsiApproved": true,
       "isFsfLibre": false,
       "seeAlso": [
-        "https://github.com/bagder/curl/blob/master/COPYING"
+        "https://github.com/bagder/curl/blob/master/COPYING",
+        "https://opensource.org/license/curl"
       ]
     },
     "cve-tou": {
@@ -2391,7 +2468,8 @@
         "https://joinup.ec.europa.eu/sites/default/files/custom-page/attachment/2020-03/EUPL-1.2%20EN.txt",
         "https://joinup.ec.europa.eu/sites/default/files/inline-files/EUPL%20v1_2%20EN(1).txt",
         "http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32017D0863",
-        "https://opensource.org/license/EUPL-1.2"
+        "https://opensource.org/license/EUPL-1.2",
+        "https://interoperable-europe.ec.europa.eu/sites/default/files/inline-files/EUPL%20v1_2%20EN(1).txt"
       ]
     },
     "Eurosym": {
@@ -2432,6 +2510,15 @@
         "https://directory.fsf.org/wiki/License:Fdk"
       ]
     },
+    "FDK-MPEG-H": {
+      "name": "Fraunhofer FDK MPEG-H Software",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://github.com/Fraunhofer-IIS/mpeghdec/blob/main/LICENSE.txt"
+      ]
+    },
     "Ferguson-Twofish": {
       "name": "Ferguson Twofish License",
       "isDeprecated": false,
@@ -3113,6 +3200,15 @@
         "https://github.com/EthicalSource/hippocratic-license/blob/58c0e646d64ff6fbee275bfe2b9492f914e3ab2a/LICENSE.txt"
       ]
     },
+    "Hippocratic-3.0-core": {
+      "name": "Hippocratic License 3.0",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://firstdonoharm.dev/version/3/0/core.txt"
+      ]
+    },
     "HP-1986": {
       "name": "Hewlett-Packard 1986 License",
       "isDeprecated": false,
@@ -3477,6 +3573,16 @@
         "http://www.info-zip.org/license.html"
       ]
     },
+    "Informatica": {
+      "name": "Informatica License",
+      "isDeprecated": false,
+      "isOsiApproved": false,
+      "isFsfLibre": false,
+      "seeAlso": [
+        "https://raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/msend.c",
+        "https://raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/mdump.c"
+      ]
+    },
     "Inner-Net-2.0": {
       "name": "Inner Net License v2.0",
       "isDeprecated": false,
@@ -5526,12 +5632,13 @@
     "Python-2.0.1": {
       "name": "Python License 2.0.1",
       "isDeprecated": false,
-      "isOsiApproved": false,
+      "isOsiApproved": true,
       "isFsfLibre": false,
       "seeAlso": [
         "https://www.python.org/download/releases/2.0.1/license/",
         "https://docs.python.org/3/license.html",
-        "https://github.com/python/cpython/blob/main/LICENSE"
+        "https://github.com/python/cpython/blob/main/LICENSE",
+        "https://opensource.org/license/Python-2.0.1"
       ]
     },
     "python-ldap": {
@@ -7365,6 +7472,13 @@
         "https://sourceforge.net/p/teem/code/HEAD/tree/teem/trunk/LICENSE.txt"
       ]
     },
+    "Spelling-Provider-LGPL-exception": {
+      "name": "Spelling Provider LGPL exception",
+      "isDeprecated": false,
+      "seeAlso": [
+        "https://github.com/rrthomas/enchant/blob/774ff6dc2e441ba2b9b786f8edbe00e014960408/lib/internal.vapi#L18"
+      ]
+    },
     "sqlitestudio-OpenSSL-exception": {
       "name": "sqlitestudio OpenSSL exception",
       "isDeprecated": false,