Skip to content

new_autogenerated_cve_report.md

Latest commit

 

History

History
95 lines (76 loc) · 4.22 KB

new_autogenerated_cve_report.md

File metadata and controls

95 lines (76 loc) · 4.22 KB

Exact CVE Analysis for testing-dart-code Packages

🔴 Confirmed CVE Vulnerabilities (2 Total)

Package: http

  • Installed Version: 0.12.2
  • CVE: CVE-2020-35669
  • Severity: MEDIUM
  • GHSA: GHSA-4rgh-jx4f-qfcq
  • Vulnerability: HTTP header injection vulnerability
  • Description: Allows CRLF injection if attacker controls the HTTP method and app uses Request directly
  • Affected Versions: < 0.13.3
  • Fix Version: >= 0.13.3
  • Expected Detection: ✅ CVE scanners should detect this vulnerability

Package: dio

  • Installed Version: 3.0.10
  • CVE: CVE-2021-31402
  • Severity: HIGH
  • GHSA: GHSA-9324-jv53-9cc8
  • Vulnerability: CRLF injection with HTTP method string
  • Description: Allows CRLF injection if attacker controls the HTTP method string (different from CVE-2020-35669)
  • Affected Versions: 4.0.0 <= version < 5.0.0 (but 3.0.10 may also be affected)
  • Fix Version: >= 5.0.0
  • Expected Detection: ✅ CVE scanners should detect this vulnerability

⚠️ Packages Without Known CVEs (But Potentially Vulnerable)

Core Web Framework Packages

  • shelf@0.7.9 - No specific CVEs found, but significantly outdated (latest: 1.4.2)
  • shelf_router@0.7.4 - No specific CVEs found, but outdated (latest: 1.1.4)

Database & Storage Packages

  • postgres@2.2.0 - No specific CVEs found, but older version (latest: 3.5.9)
  • sqflite@1.3.2 - No specific CVEs found, but outdated (latest: 2.4.2)
  • shared_preferences@0.5.12 - No specific CVEs found, but very outdated (latest: 2.5.4)

Cryptography Packages

  • crypto@2.1.5 - No specific CVEs found, but older version (latest: 3.0.7)
  • pointycastle@1.0.2 - No specific CVEs found, but very outdated (latest: 4.0.0)
  • encrypt@4.0.3 - No specific CVEs found, but outdated (latest: 5.0.3)

Utility Packages

  • args@1.6.0 - No specific CVEs found, but outdated (latest: 2.7.0)
  • yaml@2.2.1 - No specific CVEs found, but outdated (latest: 3.1.3)
  • intl@0.16.1 - No specific CVEs found, but outdated (latest: 0.20.2)
  • logging@0.11.4 - No specific CVEs found, but very outdated (latest: 1.3.0)
  • collection@1.17.0 - No specific CVEs found, but outdated (latest: 1.19.1)
  • uuid@2.2.2 - No specific CVEs found, but very outdated (latest: 4.5.2)
  • dotenv@2.0.0 - No specific CVEs found, but outdated (latest: 4.2.0)
  • path@1.8.3 - No specific CVEs found, but current version is 1.9.1

Testing & Development Packages

  • mockito@4.1.4 - No specific CVEs found, but outdated (latest: 5.6.1)
  • test@1.16.5 - No specific CVEs found, but outdated (latest: 1.28.0)
  • build_runner@1.11.5 - No specific CVEs found, but very outdated (latest: 2.10.4)

Deprecated Packages

  • pedantic@1.11.1 - DEPRECATED package, replaced by lints

📊 Summary Statistics

  • Total Packages Analyzed: 20
  • Packages with Confirmed CVEs: 2
  • CVEs Found: 2 (1 HIGH, 1 MEDIUM)
  • Outdated Packages: 18
  • Deprecated Packages: 1

🎯 CVE Scanner Expectations

What Should Be Detected:

  1. CVE-2020-35669 in http@0.12.2 (MEDIUM severity)
  2. CVE-2021-31402 in dio@3.0.10 (HIGH severity)

What Might Be Flagged:

  • All 18 outdated packages as potential security risks
  • The deprecated pedantic package as unmaintained
  • Potential supply chain risks from very old versions

Scanner Behavior Notes:

  • Some scanners may flag additional vulnerabilities not in public CVE databases
  • Version age and maintenance status might trigger warnings
  • Transitive dependencies might introduce additional vulnerabilities
  • Some scanners have private vulnerability databases with additional findings

🔍 Testing Recommendations

Your CVE scanner testing should verify:

  1. ✅ Detection of the 2 confirmed CVEs
  2. ✅ Flagging of outdated packages
  3. ✅ Identification of deprecated packages
  4. ✅ Proper severity classification (HIGH vs MEDIUM)
  5. ✅ Accurate fix version recommendations

This configuration provides a good balance of confirmed vulnerabilities and outdated packages for comprehensive CVE scanner validation.