Issues - MongoDB.Driver.Core - NuGet | ReversingLabs Spectra Assure Community

List of software quality issues with the number of affected components.

Policies

Info

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in NuGet community

8 packages

found in

Top 100

161 packages

found in

Top 1k

1378 packages

found in

Top 10k

37.45k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Digital signatures are applied to applications, packages and documents as a cryptographically secured authenticity record. Signatures verify the origin and the integrity of the object they apply to. The integrity validation relies on the cryptographic strength of the encryption and the hash verification algorithm. If either of the two is considered weak by current standards, there is a chance the signed object could be maliciously modified, without triggering the integrity failure check.

Prevalence in NuGet community

100 packages

found in

Top 100

899 packages

found in

Top 1k

8997 packages

found in

Top 10k

755.66k packages

in community

Next steps

Create signatures with strong ECC key-length of at least 224 bits, or RSA key-length of at least 2048 bits, and use SHA256 as the hashing algorithm. While encryption key-length upgrade does require you to obtain a new certificate, the hashing algorithm can freely be selected during signing.

With Microsoft SignTool, you can specify the hashing algorithm using the /fd SHA256 parameter.

Problem

Digital signatures are applied to applications, packages and documents as a cryptographically secured authenticity record. Signatures are made using digital certificates, which can either be purchased from certificate authorities or be self-issued. When a certificate is purchased from a certificate authority, the subject that requests it goes through an identity validation process. Depending on the certificate type, those checks can be basic or extended. Confirming the subject identity is a multi-step process, and the requesting subject can be mapped to its legal entity name only through extended validation of submitted documents. Extended identity validation typically costs more, and it takes longer for a certificate to be issued when this process is correctly followed.

Prevalence in NuGet community

100 packages

found in

Top 100

898 packages

found in

Top 1k

8984 packages

found in

Top 10k

754.38k packages

in community

Next steps

Consider the benefits of acquiring extended validation certificates. Operating systems tend to be more trusting of software packages signed in this way. Certain security warnings and prompts might also be automatically suppressed. This reduces the number of support tickets for organizations that opt to use extended validation certificates.

MongoDB.Driver.Core

SAFE Assessment

Compliance

Security

Threats

Problem

Prevalence in NuGet community

Next steps

Problem

Prevalence in NuGet community

Next steps

Problem

Prevalence in NuGet community

Next steps

Did you know...

Problem

Prevalence in NuGet community

Next steps

Problem

Prevalence in NuGet community

Next steps

Problem

Prevalence in NuGet community

Next steps

MongoDB.Driver.Core

SAFE Assessment

Compliance

Security

Threats

SQ31106Detected presence of medium severity vulnerabilities.Causes risk: medium severity vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ20119Detected digital signatures that rely on a weak digest algorithm for integrity validation.signatures

Problem

Prevalence in NuGet community

Next steps

SQ20121Detected digital signatures that have not been performed with an extended validation certificate.signatures

Problem

Prevalence in NuGet community

Next steps

Did you know...

SQ31106Detected presence of medium severity vulnerabilities.Causes risk: medium severity vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ20119Detected digital signatures that rely on a weak digest algorithm for integrity validation.signatures

Problem

Prevalence in NuGet community

Next steps

SQ20121Detected digital signatures that have not been performed with an extended validation certificate.signatures

Problem

Prevalence in NuGet community

Next steps