Documentation
¶
Overview ¶
Package knowledge holds everything the scanner knows about CVE-2026-109618 and CVE-2026-109619: the upstream releases that fix them and, per distribution, the package versions that fix them or are known to be vulnerable. Every distribution entry carries the evidence it was taken from. Load checks the data for internal consistency and refuses to run on data that contradicts itself.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var CVEs = []CVE{
{
ID: "CVE-2026-109618",
GHSA: "GHSA-w8hw-w9fx-j79w",
Title: "Remote code execution through memory corruption after an out-of-memory error",
URL: "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
},
{
ID: "CVE-2026-109619",
GHSA: "GHSA-6wmf-4rv5-p3rp",
Title: "Remote code execution through request state left behind in a persistent worker",
URL: "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
},
}
CVEs are the two vulnerabilities fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, 2026.
var Comparators = map[string]Comparator{ "dpkg": version.CompareDpkg, "apk": version.CompareAPK, "rpm": func(a, b string) (int, error) { return version.CompareRPM(a, b), nil }, }
Comparators maps a package format to its version comparison.
Functions ¶
Types ¶
type CVE ¶
type CVE struct {
ID string `json:"id"`
GHSA string `json:"ghsa"`
Title string `json:"title"`
URL string `json:"url"`
}
CVE describes one of the vulnerabilities.
type CVEState ¶
type CVEState struct {
// Fixed is the first package version with the fix, if one has been released.
Fixed string `json:"fixed,omitempty"`
// VulnerableThrough is the newest package version known not to have the fix
// (listed vulnerable by the vendor, or the version the vendor's archive served
// on the snapshot date while the vendor listed no fix). Any version up to and
// including it is vulnerable.
VulnerableThrough string `json:"vulnerable_through,omitempty"`
// NotAffected is true when the vendor states this stream is not affected.
NotAffected bool `json:"not_affected,omitempty"`
}
CVEState is a distribution's state for one CVE in one package stream.
type Comparator ¶
Comparator compares two package versions of one format.
type Data ¶
type Data struct {
// Snapshot is when the distribution data was collected (RFC 3339).
Snapshot string `json:"snapshot"`
Entries []Entry `json:"entries"`
}
Data is the distribution knowledge base.
func Parse ¶
Parse parses distribution data and checks every entry: known format and CVEs, a compiling version pattern that matches its own versions, a fixed version above the newest vulnerable one, and evidence for every claim.
type Entry ¶
type Entry struct {
// Distro is the os-release ID ("debian", "ubuntu", "alpine", "rhel", "amzn",
// "sles", "opensuse-leap", ...). OSIDs lists every os-release ID the entry
// applies to, which includes Distro.
Distro string `json:"distro"`
OSIDs []string `json:"os_ids"`
// Release matches os-release: VERSION_ID, or VERSION_ID's prefix for Alpine
// ("3.22" matches "3.22.2"), or VERSION_CODENAME for Debian testing/unstable.
Release string `json:"release"`
Codename string `json:"codename,omitempty"`
Format string `json:"format"` // dpkg, apk or rpm
Source string `json:"source_package"` // php8.2, php83, php, php8.3 ...
Branch string `json:"branch"` // the PHP branch the stream carries, "8.2"
// VersionPattern matches the package versions this vendor builds for this
// stream, so a package from another repository (a PPA, Remi, sury.org) that
// reuses the source name is not judged by this vendor's data.
VersionPattern string `json:"version_pattern"`
// Vendor, when set, must match the rpm Vendor tag (case-insensitive substring).
Vendor string `json:"vendor,omitempty"`
CVEs map[string]CVEState `json:"cves"`
Evidence []string `json:"evidence"`
// contains filtered or unexported fields
}
Entry is one distribution package stream: a source package in one release.
type OSRelease ¶
type OSRelease struct {
ID string `json:"id"`
IDLike []string `json:"id_like,omitempty"`
VersionID string `json:"version_id,omitempty"`
Codename string `json:"codename,omitempty"`
Pretty string `json:"pretty_name,omitempty"`
}
OSRelease is the part of /etc/os-release the lookup needs.
type UpstreamStatus ¶
type UpstreamStatus int
UpstreamStatus is what the upstream version alone proves.
const ( // UpstreamUnknown: the version alone settles nothing (a development or // pre-release build of a branch whose fix is not provably in or out). UpstreamUnknown UpstreamStatus = iota // UpstreamFixed: the upstream release includes the fix. UpstreamFixed // UpstreamVulnerable: an upstream release without the fix. A distribution may // still have backported it into a package with this version string. UpstreamVulnerable )
Source Files