actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-11-05 11:35:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Updated G401 corresponding CWE

Browse source 
The corresponding CWE from G401 rule was changed from CWE-326 -> CWE-328.
In my opinion, this CWE suits better the rule.
This commit is contained in:
Dimitar Banchev 2024-06-17 15:58:37 +02:00 committed by Cosmin Cojocar
parent 3edc633c24
commit 2e71f37efd
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
cwe/data.go
View file

@ -93,6 +93,11 @@ var idWeaknesses = map[string]*Weakness{
Description: "The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.",
Name: "Use of a Broken or Risky Cryptographic Algorithm",
},
"328": {
ID: "328",
Description: "The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). ",
Name: "Use of Weak Hash",
},
"338": {
ID: "338",
Description: "The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.",

2
issue/issue.go
View file

@ -78,7 +78,7 @@ var ruleToCWE = map[string]string{
"G304": "22",
"G305": "22",
"G306": "276",
"G401": "326",
"G401": "328",
"G402": "295",
"G403": "310",
"G404": "338",