List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.
Prevalence in NuGet community
8 packages
found in
Top 100
167 packages
found in
Top 1k
1804 packages
found in
Top 10k
70.64k packages
in community
Next steps
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.
Prevalence in NuGet community
3 packages
found in
Top 100
74 packages
found in
Top 1k
835 packages
found in
Top 10k
26.2k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.
Prevalence in NuGet community
19 packages
found in
Top 100
339 packages
found in
Top 1k
2901 packages
found in
Top 10k
102.19k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Operating systems execute application code in multiple privilege access levels. Separation of privileges is designed to protect the stability and integrity of the operating system by shielding it from issues that the user run applications may cause. However, some users may need to interact with higher privilege parts of the operating system to accomplish specific tasks. For this purpose, operating systems provide facilities that users may leverage to temporarily elevate their running privileges. Users with higher privileges can run any application with the same privilege level as their own. Attackers often try to trick privileged users into running malicious code, enabling them to infect the operating system. While the presence of code that elevates user privileges does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that can elevate user privileges. One example of acceptable use for such functions is allowing the users to install software packages and updates.
Prevalence in NuGet community
0 packages
found in
Top 100
8 packages
found in
Top 1k
148 packages
found in
Top 10k
3.15k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consult Mitre ATT&CK documentation: T1548 - Abuse Elevation Control Mechanism.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Software components are typically distributed in standardized packaging formats. Software packages are built from instructions written within package manifests that act as blueprints for package assembly. A package manifest declares the most important software properties, such as the package name, its authors and license, external dependencies, and various actions that may occur during the package lifecycle. Package managers are specialized tools used by developers to manage software components. Package managers read these manifests to deploy software components along with their dependencies. The premise of the package management system is that software components are isolated from each other, and that they rely on the package manager to provide their dependencies. However, it was detected that a software component includes code capable of accessing or modifying directories that are maintained exclusively by package managers. This is unusual as it resembles tactics used by threat actors that tamper with installed software components and inject malicious code into trusted execution paths.
Prevalence in NuGet community
0 packages
found in
Top 100
1 packages
found in
Top 1k
56 packages
found in
Top 10k
1.7k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Buffer overrun protection on Linux is achieved in two ways. The most common solution is to use the stack canary (also called cookie). The stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. In most cases, compilers will apply the stack canary conservatively in order to avoid a negative performance impact. Therefore, stack canaries are often used together with another stack overrun mitigation - fortified functions. Fortified functions are usually wrappers around standard glibc functions (such as memcpy) which perform boundary checks either at compile time or run time to determine if a memory violation has occurred. The compiler needs additional context to generate such calls (for example, array size that needs to be known at compile time). Because of this, the compiler will virtually never substitute all viable functions with their fortified counterparts in complex programs. However, when combined with the stack canary, fortified functions provide a good measure of buffer overrun protection.
Prevalence in NuGet community
0 packages
found in
Top 100
11 packages
found in
Top 1k
136 packages
found in
Top 10k
3.04k packages
in community
Next steps
Presence of unfortified string functions may indicate use of unsafe programming practices, and you should avoid it if possible.
In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.
Problem
Buffer overrun protection on Linux is achieved in two ways. The most common solution is to use the stack canary (also called cookie). The stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. In most cases, compilers will apply the stack canary conservatively in order to avoid a negative performance impact. Therefore, stack canaries are often used together with another stack overrun mitigation - fortified functions. Fortified functions are usually wrappers around standard glibc functions (such as memcpy) which perform boundary checks either at compile time or run time to determine if a memory violation has occurred. The compiler needs additional context to generate such calls (for example, array size that needs to be known at compile time). Because of this, the compiler will virtually never substitute all viable functions with their fortified counterparts in complex programs. However, when combined with the stack canary, fortified functions provide a good measure of buffer overrun protection.
Prevalence in NuGet community
0 packages
found in
Top 100
11 packages
found in
Top 1k
156 packages
found in
Top 10k
4.18k packages
in community
Next steps
Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.
In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.
Problem
Buffer overrun protection on Linux is achieved in two ways. The most common solution is to use the stack canary (also called cookie). The stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. In most cases, compilers will apply the stack canary conservatively in order to avoid a negative performance impact. Therefore, stack canaries are often used together with another stack overrun mitigation - fortified functions. Fortified functions are usually wrappers around standard glibc functions (such as memcpy) which perform boundary checks either at compile time or run time to determine if a memory violation has occurred. The compiler needs additional context to generate such calls (for example, array size that needs to be known at compile time). Because of this, the compiler will virtually never substitute all viable functions with their fortified counterparts in complex programs. However, when combined with the stack canary, fortified functions provide a good measure of buffer overrun protection.
Prevalence in NuGet community
0 packages
found in
Top 100
11 packages
found in
Top 1k
138 packages
found in
Top 10k
3.76k packages
in community
Next steps
Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.
In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.
Prevalence in NuGet community
5 packages
found in
Top 100
172 packages
found in
Top 1k
1525 packages
found in
Top 10k
50.22k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. System certificate stores are databases that define the chain of trust for a machine. These databases control the list of websites the machine can securely connect to, and the list of applications that the operating system implicitly trusts. For that reason, attackers often abuse system certificate stores to ensure their malicious code executes without being detected by security solutions. While the presence of code that tampers with system certificate stores does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with system certificate stores. One example of acceptable use for such functions is adding publisher certificates to the system trust store during software installation.
Prevalence in NuGet community
0 packages
found in
Top 100
2 packages
found in
Top 1k
46 packages
found in
Top 10k
1.06k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.