warningRisk: Hardening

Scanned:

GitVersion.Tool

latest

Derives SemVer information from a repository following GitFlow or GitHubFlow. This is the .NET Core Global Tool allowing usage of GitVersion from command line.

License: Permissive (MIT)

Published:

See on NuGet

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

51 debugging symbols found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

6 reduced effectiveness mitigations

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues14 vulnerabilities0 malware0 behaviors118 dependencies0 contributors5 versions481

FAQ for GitVersion.Tool

What is GitVersion.Tool?

Derives SemVer information from a repository following GitFlow or GitHubFlow. This is the .NET Core Global Tool allowing usage of GitVersion from command line. For more information about this package, visit its homepage.

Is GitVersion.Tool malicious or is it safe to use?

The .NET package GitVersion.Tool was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. The package contains risks, and the analysis results should be reviewed before it is downloaded and used. Visit the Issues and Behaviors sections of the analysis for more details.

Is GitVersion.Tool popular?

The .NET package GitVersion.Tool ranks among the top 1000 projects in this community. It has 117M recorded downloads. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

How do I secure GitVersion.Tool once it is in my app?

Since we can't know when or where malicious attacks will happen, we recommend tracking how GitVersion.Tool behaviors change over multiple software releases. By adopting differential analysis in your release process, you can detect unexpected changes to a GitVersion.Tool version, which can prevent advanced software supply chain attacks. Read how our technology can help prevent future attacks similar to SolarWinds and 3CX.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

Popularity

117.14M

Total Downloads

Contributors

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.

Prevalence in NuGet community

22 packages

found in

Top 100

461 packages

found in

Top 1k

3748 packages

found in

Top 10k

62.8k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Program database (PDB) files are typically only used during software development. They contain private debug symbols that make it significantly easier to reverse engineer a closed-source application. In some cases, having a program database file is equivalent to having access to the source code. Presence of program databases could indicate that one or more software components have been built using a debug profile, instead of the release.

Prevalence in NuGet community

0 packages

found in

Top 100

92 packages

found in

Top 1k

1151 packages

found in

Top 10k

21.32k packages

in community

Next steps

Private debug database files should not be embedded within executables, and you should remove them from the software package before releasing it.

The integrity verification of the embedded database files should not be done with insecure hashing algorithms. SHA1 and MD5 hashes should be deprecated throughout the application, and a more secure SHA256 algorithm should be used instead.

Problem

Buffer overrun protection on Linux is achieved in two ways. The most common solution is to use the stack canary (also called cookie). The stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. In most cases, compilers will apply the stack canary conservatively in order to avoid a negative performance impact. Therefore, stack canaries are often used together with another stack overrun mitigation - fortified functions. Fortified functions are usually wrappers around standard glibc functions (such as memcpy) which perform boundary checks either at compile time or run time to determine if a memory violation has occurred. The compiler needs additional context to generate such calls (for example, array size that needs to be known at compile time). Because of this, the compiler will virtually never substitute all viable functions with their fortified counterparts in complex programs. However, when combined with the stack canary, fortified functions provide a good measure of buffer overrun protection.

Prevalence in NuGet community

0 packages

found in

Top 100

10 packages

found in

Top 1k

130 packages

found in

Top 10k

2.35k packages

in community

Next steps

Presence of unfortified string functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in NuGet community

0 packages

found in

Top 100

10 packages

found in

Top 1k

150 packages

found in

Top 10k

2.88k packages

in community

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in NuGet community

0 packages

found in

Top 100

10 packages

found in

Top 1k

127 packages

found in

Top 10k

2.42k packages

in community

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Top behaviors

See all behaviors

Prevalence in NuGet community

Behavior uncommon for this community (Uncommon)

0 packages

found in

Top 100

0 packages

found in

Top 1k

2 packages

found in

Top 10k

4 packages

in community

Prevalence in NuGet community

No behavior prevalence information at this time

Prevalence in NuGet community

No behavior prevalence information at this time

Prevalence in NuGet community

Behavior often found in this community (Common)

0 packages

found in

Top 100

40 packages

found in

Top 1k

566 packages

found in

Top 10k

11.02k packages

in community

Prevalence in NuGet community

Behavior often found in this community (Common)

0 packages

found in

Top 100

11 packages

found in

Top 1k

250 packages

found in

Top 10k

3.51k packages

in community

Top vulnerabilities

No vulnerabilities found.

GitVersion.Tool

SAFE Assessment

Compliance

Security

Threats

FAQ for GitVersion.Tool

What is GitVersion.Tool?

Is GitVersion.Tool malicious or is it safe to use?

Is GitVersion.Tool popular?

How do I secure GitVersion.Tool once it is in my app?

Did you know...

Popularity

Top issues

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in NuGet community

Next steps

SQ14160Detected Windows executable files that embed PDB files whose integrity is verified with an insecure hashing algorithm.Causes risk: outdated toolchains detectedhardening

Problem

Prevalence in NuGet community

Next steps

SQ18105Detected Linux executable files compiled without any kind of buffer overrun protection while using banned string functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in NuGet community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in NuGet community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in NuGet community

Next steps

Top behaviors

Clears event logs from local or remote computer.stealth

Prevalence in NuGet community

Reads from version control configuration files.steal

Prevalence in NuGet community

Writes to version control configuration files.file

Prevalence in NuGet community

Deletes files in Windows system directories.file

Prevalence in NuGet community

Queries the passwd database entry for a given user ID.steal

Prevalence in NuGet community

Top vulnerabilities