Repository navigation
[Java]: Add XXE sinks #426
Description
Query
Link to pull request with your CodeQL query:
Relevant PR: github/codeql#6564
CVE ID(s)
List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the GitHub Advisory Database.
- CVE-2020-2144
jenkinsci/rundeck-plugin@9222a21
https://www.jenkins.io/security/advisory/2020-03-09/#SECURITY-1702
Report
Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
- Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing
Yes, I am planning to write a blog post about the query.
Result(s)
Provide at least one useful result found by your query, on some revision of a real project.
Activity
haby0 commentedon Aug 31, 2021
@kevinbackhouse here.
haby0 commentedon Aug 31, 2021
@kevinbackhouse https://github.com/haby0/rundeck-plugin-db This is the database created for rundeck-plugin.
kevinbackhouse commentedon Aug 31, 2021
Resubmit of #420 (with new CVE).
ghsecuritylab commentedon Aug 31, 2021
Your submission is now in status Generate Query Results.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
smowton commentedon Aug 31, 2021
@haby0 has the query changed at all or will the results be identical to the previous submission?
haby0 commentedon Sep 1, 2021
Added two sinks.
ghsecuritylab commentedon Sep 2, 2021
Your submission is now in status FP Check.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commentedon Sep 6, 2021
Your submission is now in status CodeQL review.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commentedon Sep 10, 2021
Your submission is now in status SecLab finalize.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commentedon Sep 14, 2021
Your submission is now in status Pay.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
xcorail commentedon Sep 14, 2021
Created Hackerone report 1339787 for bounty 334659 : [426] [Java]: Add XXE sinks
ghsecuritylab commentedon Sep 14, 2021
Your submission is now in status Closed.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed