Spectra Assure

failRisk: Vulnerabilities

Scanned:

compareit

Artifact:

latest

Top 1k

Compare files

License: Permissive (MIT)

Published:

Publisher: in4margaret

Visit GitHub

See on Visual Studio Code

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

2 debugging symbols found

Security

Vulnerabilities

1 severe vulnerabilities exploited

Hardening

3 baseline mitigations missing

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

List of software quality issues with the number of affected components.

Policies

Info

Problem

Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.

Prevalence in Visual Studio Code community

67 packages

found in

Top 100

548 packages

found in

Top 1k

3078 packages

found in

Top 10k

17.39k packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Sensitive executable memory regions should be kept as read-only to protect the integrity of trusted execution code flow paths. Imported function addresses are pointers to the symbols that implement the application-required functionality. If those pointers are changed by malicious code, execution paths can be redirected to unintended locations. Most modern programming language toolchains protect those memory regions appropriately. These issues are commonly reported for outdated linkers and non-compliant executable packing solutions.

Prevalence in Visual Studio Code community

20 packages

found in

Top 100

161 packages

found in

Top 1k

472 packages

found in

Top 10k

1.89k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Sensitive executable memory regions should be kept as read-only to protect the integrity of trusted execution code flow paths. Thread local storage (TLS) callbacks are pointers to code initialization and resource release functions. If those pointers are changed by malicious code, execution paths can be redirected to unintended locations. Most modern programming language toolchains protect those memory regions appropriately. These issues are commonly reported for outdated linkers and non-compliant executable packing solutions.

Prevalence in Visual Studio Code community

12 packages

found in

Top 100

102 packages

found in

Top 1k

348 packages

found in

Top 10k

1.32k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in Visual Studio Code community

68 packages

found in

Top 100

555 packages

found in

Top 1k

3086 packages

found in

Top 10k

17.47k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Address Space Layout Randomization (ASLR) is a vulnerability mitigation option that forces software components to load on a different memory base address each time they are used. This makes the memory layout unpredictable, and it is therefore harder for malicious code to be reliably injected during application runtime.

Prevalence in Visual Studio Code community

12 packages

found in

Top 100

80 packages

found in

Top 1k

327 packages

found in

Top 10k

1.27k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs. For best results, use ASLR together with Data Execution Prevention (DEP/NX).

To enable this mitigation, refer to your programming language linker documentation.

In Microsoft VisualStudio, you can enable ASLR mitigation by setting the linker option /DYNAMICBASE to ON.

Problem

ASLR (address-space layout randomization) is a mitigation technique that increases the difficulty of performing buffer-overflow attacks that require the attacker to know the address of the program in memory. This is done by loading the program at a randomly selected address in the process' address space. ASLR-enabled kernels can choose a random load address only for position-independent executables and code.

Prevalence in Visual Studio Code community

26 packages

found in

Top 100

151 packages

found in

Top 1k

409 packages

found in

Top 10k

1.45k packages

in community

Next steps

To support ASLR, the program must be compiled as position-independent code. In most compilers, this is done by passing the corresponding position-independent flag, such as -fPIC for shared libraries or -fPIE for executables.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that indirect calls are made only to vetted functions. This mitigation protects dynamically resolved function targets by instrumenting the code responsible for transferring execution control. Because the code flow integrity is verified during runtime, malicious code is less likely to be able to hijack trusted execution paths.

Prevalence in Visual Studio Code community

29 packages

found in

Top 100

208 packages

found in

Top 1k

716 packages

found in

Top 10k

2.89k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

On Linux, external symbols are resolved via the procedure linkage table (PLT) and the global offset table (GOT). Without any protection, both are writable at runtime and thus leave the executable vulnerable to pointer hijacking - an attack where the function address is overwritten with an address of a malicious function. Pointer hijacking can be mitigated by using full read-only relocations, which instruct the compiler to unify global offset tables into a single read-only table. This requires that all external function symbols are resolved at load-time instead of during execution, and may increase loading time for large programs.

Prevalence in Visual Studio Code community

33 packages

found in

Top 100

214 packages

found in

Top 1k

655 packages

found in

Top 10k

2.68k packages

in community

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

Problem

Debug databases are typically only used during software development. On Windows, they are usually files embedded into the executable (PDB), while on Linux, they're contained inside special executable sections. The databases contain private debug symbols that make it significantly easier to reverse-engineer a closed-source application. In some cases, having a debug database is equivalent to having access to the source code. Presence of debug databases could indicate that one or more software components have been built using a debug profile, instead of the release. Private debug databases can be embedded into software components by programming language tools.

Prevalence in Visual Studio Code community

32 packages

found in

Top 100

189 packages

found in

Top 1k

403 packages

found in

Top 10k

1.53k packages

in community

Next steps

To remediate this issue and remove private debugging information, refer to your programming language toolchain documentation.

Problem

Common compilers often embed source code information into executables for debugging purposes, usually by mapping symbols to source filenames or paths. While this is typically desirable in open-source software and standard tools, that information can be used to determine security weaknesses, code repository layout, trade secrets and similar sensitive information. Such symbols make it easier to reverse-engineer a closed source application.

Prevalence in Visual Studio Code community

35 packages

found in

Top 100

248 packages

found in

Top 1k

593 packages

found in

Top 10k

2.32k packages

in community

Next steps

Strip out such information in the linking phase by using compiler options like the -s flag in GCC, or in the post-build phase by using the strip tool.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in Visual Studio Code community

67 packages

found in

Top 100

548 packages

found in

Top 1k

3078 packages

found in

Top 10k

17.39k packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in Visual Studio Code community

20 packages

found in

Top 100

161 packages

found in

Top 1k

472 packages

found in

Top 10k

1.89k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Prevalence in Visual Studio Code community

12 packages

found in

Top 100

102 packages

found in

Top 1k

348 packages

found in

Top 10k

1.32k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in Visual Studio Code community

68 packages

found in

Top 100

555 packages

found in

Top 1k

3086 packages

found in

Top 10k

17.47k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in Visual Studio Code community

12 packages

found in

Top 100

80 packages

found in

Top 1k

327 packages

found in

Top 10k

1.27k packages

in community

Next steps

To enable this mitigation, refer to your programming language linker documentation.

In Microsoft VisualStudio, you can enable ASLR mitigation by setting the linker option /DYNAMICBASE to ON.

Problem

Prevalence in Visual Studio Code community

26 packages

found in

Top 100

151 packages

found in

Top 1k

409 packages

found in

Top 10k

1.45k packages

in community

Next steps

Problem

Prevalence in Visual Studio Code community

29 packages

found in

Top 100

208 packages

found in

Top 1k

716 packages

found in

Top 10k

2.89k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Prevalence in Visual Studio Code community

33 packages

found in

Top 100

214 packages

found in

Top 1k

655 packages

found in

Top 10k

2.68k packages

in community

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

Problem

Prevalence in Visual Studio Code community

32 packages

found in

Top 100

189 packages

found in

Top 1k

403 packages

found in

Top 10k

1.53k packages

in community

Next steps

To remediate this issue and remove private debugging information, refer to your programming language toolchain documentation.

Problem

Prevalence in Visual Studio Code community

35 packages

found in

Top 100

248 packages

found in

Top 1k

593 packages

found in

Top 10k

2.32k packages

in community

Next steps

Strip out such information in the linking phase by using compiler options like the -s flag in GCC, or in the post-build phase by using the strip tool.

compareit

SAFE Assessment

Compliance

Security

Threats

SQ31102Detected presence of severe vulnerabilities with active exploitation.Causes risk: actively exploited vulnerabilitiesvulnerabilities

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14156Detected Windows executable files with imported functions susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14158Detected Windows executable files with TLS callbacks susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14105Detected Windows executable files that do not implement the ASLR vulnerability mitigation protection.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ18111Detected Linux executable files that do not implement the ASLR vulnerability mitigation protection.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ18113Detected Linux executable files that were compiled without the recommended dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ34203Detected presence of hardcoded debug databases.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in Visual Studio Code community

Next steps

SQ34204Detected presence of hardcoded source code filenames or paths.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in Visual Studio Code community

Next steps

Did you know...

SQ31102Detected presence of severe vulnerabilities with active exploitation.Causes risk: actively exploited vulnerabilitiesvulnerabilities

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14156Detected Windows executable files with imported functions susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14158Detected Windows executable files with TLS callbacks susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14105Detected Windows executable files that do not implement the ASLR vulnerability mitigation protection.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ18111Detected Linux executable files that do not implement the ASLR vulnerability mitigation protection.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ18113Detected Linux executable files that were compiled without the recommended dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in Visual Studio Code community

Next steps

SQ34203Detected presence of hardcoded debug databases.Causes risk: debugging symbols foundsecrets

Problem