forked from ChelseaKR/gtfs-scorecard
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathvex.json
More file actions
155 lines (155 loc) · 8.67 KB
/
Copy pathvex.json
File metadata and controls
155 lines (155 loc) · 8.67 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
{
"bomFormat": "CycloneDX",
"specVersion": "1.7",
"serialNumber": "urn:uuid:78832d4f-c352-48f0-b872-671567120801",
"version": 2,
"metadata": {
"timestamp": "2026-08-16T00:00:00Z",
"component": {
"type": "application",
"bom-ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli",
"name": "gtfs-validator-cli",
"version": "8.0.1",
"purl": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli",
"hashes": [
{
"alg": "SHA-256",
"content": "19293ddd9b6f954f216d4f12054bd8a3232921751c4484339e339764a91000e2"
}
]
}
},
"components": [],
"vulnerabilities": [
{
"id": "CVE-2022-25647",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": ["will_not_fix"],
"detail": "The CLI serializes validator results with Gson. It does not deserialize attacker-controlled JSON into application types on the GTFS scoring path. Reassess when MobilityData publishes a release newer than 8.0.1.",
"firstIssued": "2026-07-10T20:30:00Z",
"lastUpdated": "2026-07-10T20:30:00Z"
}
},
{
"id": "CVE-2014-0114",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0114"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": ["will_not_fix"],
"detail": "Commons BeanUtils is shaded transitively through commons-validator, but the validator CLI does not bind request properties or invoke the affected PropertyUtils APIs.",
"firstIssued": "2026-07-10T20:30:00Z",
"lastUpdated": "2026-07-10T20:30:00Z"
}
},
{
"id": "CVE-2019-10086",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10086"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": ["will_not_fix"],
"detail": "Commons BeanUtils is shaded transitively through commons-validator, but the validator CLI does not bind request properties or invoke the affected PropertyUtils APIs.",
"firstIssued": "2026-07-10T20:30:00Z",
"lastUpdated": "2026-07-10T20:30:00Z"
}
},
{
"id": "CVE-2025-48734",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48734"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": ["will_not_fix"],
"detail": "Commons BeanUtils is shaded transitively through commons-validator, but the validator CLI does not bind request properties or invoke the affected enum-property introspection APIs.",
"firstIssued": "2026-07-10T20:30:00Z",
"lastUpdated": "2026-07-10T20:30:00Z"
}
},
{
"id": "CVE-2021-35515",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "protected_by_mitigating_control",
"response": ["workaround_available"],
"detail": "The service accepts ZIP GTFS feeds only. Python preflight rejects unreadable archives, excessive entry counts, oversized entries, excessive expanded size, and extreme compression ratios before Java starts; workers also have bounded memory and execution time.",
"firstIssued": "2026-07-10T20:30:00Z",
"lastUpdated": "2026-07-10T20:30:00Z"
}
},
{
"id": "CVE-2021-35516",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "protected_by_mitigating_control",
"response": ["workaround_available"],
"detail": "The service accepts ZIP GTFS feeds only. Python preflight rejects unreadable archives, excessive entry counts, oversized entries, excessive expanded size, and extreme compression ratios before Java starts; workers also have bounded memory and execution time.",
"firstIssued": "2026-07-10T20:30:00Z",
"lastUpdated": "2026-07-10T20:30:00Z"
}
},
{
"id": "CVE-2021-35517",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "protected_by_mitigating_control",
"response": ["workaround_available"],
"detail": "The service accepts ZIP GTFS feeds only. Python preflight rejects unreadable archives, excessive entry counts, oversized entries, excessive expanded size, and extreme compression ratios before Java starts; workers also have bounded memory and execution time.",
"firstIssued": "2026-07-10T20:30:00Z",
"lastUpdated": "2026-07-10T20:30:00Z"
}
},
{
"id": "CVE-2021-36090",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "protected_by_mitigating_control",
"response": ["workaround_available"],
"detail": "Python archive preflight rejects unreadable ZIPs, excessive entry counts, oversized entries, excessive expanded size, and extreme compression ratios before Java starts; workers also have bounded memory and execution time.",
"firstIssued": "2026-07-10T20:30:00Z",
"lastUpdated": "2026-07-10T20:30:00Z"
}
},
{
"id": "CVE-2026-54399",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": ["will_not_fix"],
"detail": "The advisory is against the Apache HttpComponents Core HTTP/1.1 message parser. That parser is only reached through the validator's own feed download (-u/--url); this pipeline never uses it. run_validator() in pipeline/src/scorecard_pipeline/validate.py is the single place that starts the JVM, and it always passes -i with a local path -- including on the ad-hoc/instant-score path, where cli.run_adhoc downloads the feed with the Python fetcher first and hands the validator the file on disk. Measured rather than asserted, inside the built compute image on 2026-08-16: `java -verbose:class -jar /opt/validator/gtfs-validator.jar -i <local zip> -o <dir> -c us` loads 5953 classes and 0 of them are org.apache.hc.*; the same command with -u loads 140 org.apache.hc.core5.* classes. (The validator's version-update check does make an outbound call on both paths, but over the JDK's own sun.net.www.protocol.https stack, not Apache HttpComponents.) test_validator_is_never_handed_a_url in pipeline/tests/test_security_vex.py fails if run_validator ever grows a URL argument. Reassess when MobilityData publishes a release newer than 8.0.1 built on httpcore5 5.4.3 or later.",
"firstIssued": "2026-08-16T00:00:00Z",
"lastUpdated": "2026-08-16T00:00:00Z"
}
},
{
"id": "CVE-2026-54428",
"source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"},
"affects": [{"ref": "pkg:github/MobilityData/gtfs-validator@8.0.1?type=cli"}],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": ["will_not_fix"],
"detail": "The advisory is against the Apache HttpComponents Core HTTP/2 HPACK decoder, which needs an HTTP/2 connection to a remote peer. Same measured basis as CVE-2026-54399: the validator only opens connections when given -u/--url, and this pipeline only ever gives it -i with a local path, so no org.apache.hc.* class is loaded on the scoring path. Reassess when MobilityData publishes a release newer than 8.0.1 built on httpcore5-h2 5.4.3 or later.",
"firstIssued": "2026-08-16T00:00:00Z",
"lastUpdated": "2026-08-16T00:00:00Z"
}
}
]
}