Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add 11 pov-project.jsons with fixedVersions #28

Merged
merged 6 commits into from
Sep 27, 2023
Merged

Add 11 pov-project.jsons with fixedVersions #28

merged 6 commits into from
Sep 27, 2023

Commits on Sep 27, 2023

  1. Auto-generate pov-project.json where possible, including with testSig… 

    …nalWhenVulnerable inferred from mvn clean test exit code where possible
    @wtwhite
    wtwhite committed Sep 27, 2023
    Configuration menu
    Copy the full SHA
    957ebb7 View commit details
    Browse the repository at this point in the history

  2. Fix auto-determined testSignalWhenVulnerable values

    @wtwhite
    wtwhite committed Sep 27, 2023
    Configuration menu
    Copy the full SHA
    9979972 View commit details
    Browse the repository at this point in the history

  3. Add fixVersion for CVE-2013-2186

    @wtwhite
    wtwhite committed Sep 27, 2023
    Configuration menu
    Copy the full SHA
    fe3ac34 View commit details
    Browse the repository at this point in the history

  4. Update pom.xml to later version (1.30) that is still vulnerable

    @wtwhite
    wtwhite committed Sep 27, 2023
    Configuration menu
    Copy the full SHA
    8e831ab View commit details
    Browse the repository at this point in the history

  5. Temporarily remove this pov-project.json to get past the schema check… 

    …er, since CVE-2019-0225 has no well-defined fixedVersion and the schema does not yet accept null
    @wtwhite
    wtwhite committed Sep 27, 2023
    Configuration menu
    Copy the full SHA
    dbedf28 View commit details
    Browse the repository at this point in the history

  6. Add fixedVersions for 12 CVEs. 

    The version for CVE-2022-38751 was taken from https://bitbucket.org/snakeyaml/snakeyaml/issues/530/stackoverflow-oss-fuzz-47039, and verified with `mvn clean test`.
    @wtwhite
    wtwhite committed Sep 27, 2023
    Configuration menu
    Copy the full SHA
    3f448ae View commit details
    Browse the repository at this point in the history