Lockhound

Sample report

acme/storefront: 2 findings to fix first

A fictional repository with real, public advisories, as they stood when this sample was written. Your own report uses live data from OSV, CISA and FIRST, and needs no more than read-only access to your repositories.

Three findings, three different answers. Log4Shell is exploited in the wild, so it comes first even before the severity. The minimist finding is rated critical, but it is a development tool that never ships, so it can wait. Each finding says why it got its priority, which source says so, and the command to fix it.

  1. Fix nowcriticalmaven

    org.apache.logging.log4j:log4j-core 2.14.1

    CVE-2021-44228 · Remote code execution in Log4j (Log4Shell) · services/api/gradle.lockfile

    • Attackers are exploiting this vulnerability: CISA added it to the Known Exploited Vulnerabilities catalog on Dec 10, 2021.Source: CISA KEV
    • Critical severity (CVSS 10.0).Source: Advisory GHSA-jfh8-c2jp-5v3q, via OSV
    • Ships with your application (production dependency).

    The advisory's fix is 2.15.0.

    2.15.0 is still affected by CVE-2021-45046. Choose a later version.

    Upgrade to 2.17.1 instead, the first version that fixes the follow-up advisories too.

    No known advisory for 2.17.1 in OSV

    cd services/api && ./gradlew dependencies --write-locks
  2. Fix soonhighcomposer

    guzzlehttp/psr7 2.1.0

    CVE-2022-24775 · Improper header validation in guzzlehttp/psr7 · services/billing/composer.lock

    • High severity (CVSS 7.5).Source: Advisory GHSA-q7rv-6hp3-vh96, via OSV
    • Ships with your application (production dependency).
    • guzzlehttp/psr7 is a transitive dependency: something you depend on pulls it in.

    The advisory's fix is 2.1.1.

    No known advisory for 2.1.1 in OSV

    cd services/billing && composer update guzzlehttp/psr7 --with-all-dependencies
  3. Plan a fixcriticalnpm

    minimist 1.2.5

    CVE-2021-44906 · Prototype pollution in minimist · web/package-lock.json

    • Critical severity (CVSS 9.8).Source: Advisory GHSA-xvch-5gv4-984h, via OSV
    • Development dependency only: used to build or test, not shipped to production.

    The advisory's fix is 1.2.6.

    No known advisory for 1.2.6 in OSV

    cd web && npm update minimist

And on a pull request

Lockhound: 1 vulnerability to fix before merging

This pull request adds 2 known vulnerabilities. 1 is high or worse, malicious, or exploited in the wild. Vulnerabilities already on the default branch don't block it.

Posted as a GitHub check. Make it required, and the pull request can't be merged until it's fixed.

Scan your repositories freeWhat Lockhound can access