This version of checkov is flagging nuget-built files
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- azure, typescript
Research direction
Start with the MicrosoftSecurityDevOps@1 task and its gdnconfig, then compare the bundled Checkov versions described in the issue and linked comment. Determine whether the task can use a newer version or accept an override; done means NuGet-built repositories no longer report the affected SHA-512 checksums, or the supported configuration path is documented.
Written by the indexing model from the issue text.
Description
Please see https://github.com/bridgecrewio/checkov/issues/6984#issuecomment-2633056268
Looking at the gdnconfig, it appears that checkov is using 3.2.199, whereas it's currently on 3.2.362.
Can we convince y'all to update to that newer version of checkov? Or can we override it ourselves with our own gdnconfig?
Every repo we have is flagging sha512 checksums as high vulnerabilities.
Further information:
the version that we are getting with the MicrosoftSecurityDevOps@1 task is version 3.2.358, and this version is flagging these checksums. Checkov is currently on version 3.6.362, and the issue appears to have been fixed by 3.6.36. We cannot be the only user whose nuget-build projects are getting flagged by this - any fix or guidance is very much appreciated.
- Dominant language
- TypeScript
- Stars
- 86
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/security-devops-azdevops
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
-
area:task area:tools status:waiting-on-author type:docs type:question
microsoft/security-devops-azdevops#169 · 1 comment · 1 assignee ·
-
Which Defender CLI binary should be used in CI/CD pipelines — `aka.ms` or the DevOps CDN endpoint? Open
Difficulty 5/5 Over a week Newbie friendliness 35/100
microsoft/security-devops-azdevops#166 · 2 comments · 1 reaction ·
-
area:task area:tools status:team-review type:feature
microsoft/security-devops-azdevops#164 · 2 reactions · 2 assignees ·
-
area:task area:tools status:team-review type:docs type:feature
microsoft/security-devops-azdevops#163 · 17 comments · 1 assignee ·
All issues in microsoft/security-devops-azdevops
Similar issues
-
blocklist removal
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
MetaMask/eth-phishing-detect#296544 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
pastelsky/bundlephobia#1122 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
category/development priority/P2 scope/file-operations scope/testing type/enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Enatega Customer and Rider app: Add-ons price is not visible to customer after order is placed. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100