assess

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 7, 2026 License: BSD-3-Clause Imports: 8 Imported by: 0

Documentation

Overview

Package assess decides, for each PHP runtime found, whether it is vulnerable to CVE-2026-109618 and CVE-2026-109619, fixed, or unknown, and why.

The rules, in order:

  1. A PHP release at or above the fixed release of its branch is fixed. A distribution cannot ship an upstream release without the upstream fix.
  2. A file that a package manager installed (the database lists it, and its recorded digest matches the file) is judged only by that vendor's data for that exact package stream: fixed at or above the vendor's fixed version, vulnerable below it or at or below a version the vendor lists as vulnerable. Distributions backport fixes without changing the version PHP reports (Ubuntu 24.04's fixed build still reports 8.3.6), so the version string says nothing here. With no data for that vendor, the result is unknown.
  3. A file no package manager installed (the official Docker image, a source build, a static build) carries the release it reports: below the fixed release it is vulnerable.

Anything that does not fit (a modified packaged file, an unreadable package database, an unrecognised version) is unknown, with the reason. Nothing is called fixed without proof.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type CVEResult 

type CVEResult struct {
	ID     string `json:"id"`
	Status Status `json:"status"`
	Reason string `json:"reason"`
}

CVEResult is the verdict for one CVE.

type Finding 

type Finding struct {
	Path       string `json:"path"`
	PHPVersion string `json:"php_version"`
	SAPI       string `json:"sapi"`
	// WebFacing is true for SAPIs that serve web requests (FPM, CGI, the Apache
	// module, LiteSpeed, FrankenPHP), which the advisories rate most exposed.
	WebFacing bool                 `json:"web_facing"`
	Status    Status               `json:"status"`
	Severity  string               `json:"severity"`
	Reason    string               `json:"reason"`
	CVEs      []CVEResult          `json:"cves"`
	Package   *pkgdb.Package       `json:"package,omitempty"`
	OS        *knowledge.OSRelease `json:"os,omitempty"`
	Fix       string               `json:"fix,omitempty"`
}

Finding is the verdict for one PHP runtime file.

func One 

func One(in Input, b *detect.Binary) Finding

One assesses a single binary.

func Run 

func Run(in Input) []Finding

Run assesses every binary, sorted by path.

type Input 

type Input struct {
	Binaries []*detect.Binary
	Index    *pkgdb.Index
	// Aliases returns every path equivalent to p (symlinked directories, hard
	// links), including p. Nil means p only.
	Aliases func(p string) []string
	OS      *knowledge.OSRelease
	Data    *knowledge.Data
}

Input is what a scan collected.

type Status 

type Status string

Status is a verdict. 

const (
	Vulnerable Status = "vulnerable"
	Fixed      Status = "fixed"
	Unknown    Status = "unknown"
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.