cryptsetup-2.8.0-1.fc39
List of Defects
Error: SNYK_CODE_WARNING (CWE-170): [#def1]
cryptsetup-2.8.0-git/lib/fvault2/fvault2.c:384:68: note[cpp/ImproperNullTermination]: Potential improperly null terminated input from a pointer to an input buffer flows into strlen, where it is used as a string. This may result in an information disclosure or buffer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-170): [#def2]
cryptsetup-2.8.0-git/lib/fvault2/fvault2.c:395:70: note[cpp/ImproperNullTermination]: Potential improperly null terminated input from a pointer to an input buffer flows into strlen, where it is used as a string. This may result in an information disclosure or buffer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-416): [#def3]
cryptsetup-2.8.0-git/lib/luks2/luks2_digest_pbkdf2.c:159:71: warning[cpp/UseAfterFree]: Use after free. base64_str is used in json_object_new_string after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def4]
cryptsetup-2.8.0-git/lib/luks2/luks2_digest_pbkdf2.c:160:7: warning[cpp/DoubleFree]: Potential double call to free. base64_str may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def5]
cryptsetup-2.8.0-git/lib/luks2/luks2_luks1_convert.c:363:37: warning[cpp/UseAfterFree]: Use after free. base64_str is used in json_object_new_string_len after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def6]
cryptsetup-2.8.0-git/lib/luks2/luks2_luks1_convert.c:364:7: warning[cpp/DoubleFree]: Potential double call to free. base64_str may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def7]
cryptsetup-2.8.0-git/lib/luks2/luks2_luks1_convert.c:872:9: warning[cpp/DoubleFree]: Potential double call to free. buf may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def8]
cryptsetup-2.8.0-git/lib/luks2/luks2_luks1_convert.c:875:42: warning[cpp/UseAfterFree]: Use after free. buf is used in memcpy after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def9]
cryptsetup-2.8.0-git/lib/luks2/luks2_luks1_convert.c:876:8: warning[cpp/DoubleFree]: Potential double call to free. buf may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-190): [#def10]
cryptsetup-2.8.0-git/lib/utils.c:282:16: warning[cpp/IntegerOverflow]: Unsanitized input from a file flows into a subtraction operator (-), where it is used in integer arithmetic. This may result in an integer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-190): [#def11]
cryptsetup-2.8.0-git/lib/utils.c:282:29: warning[cpp/IntegerOverflow]: Unsanitized input from a file flows into a subtraction operator (-), where it is used in integer arithmetic. This may result in an integer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-122): [#def12]
cryptsetup-2.8.0-git/lib/utils_crypt.c:29:6: warning[cpp/UnsafeFunctionStringHandling]: Using sscanf can lead to buffer overflow vulnerabilities, if arbitrary user input is able to flow into this function without the length of the input being checked. Use the safer alternative sscanf_s instead.
Error: SNYK_CODE_WARNING (CWE-122): [#def13]
cryptsetup-2.8.0-git/lib/utils_crypt.c:60:6: warning[cpp/UnsafeFunctionStringHandling]: Using sscanf can lead to buffer overflow vulnerabilities, if arbitrary user input is able to flow into this function without the length of the input being checked. Use the safer alternative sscanf_s instead.
Error: SNYK_CODE_WARNING (CWE-122): [#def14]
cryptsetup-2.8.0-git/lib/utils_io.c:169:3: warning[cpp/BufferOverflow]: Unsanitized input from a file flows into memcpy, where it is used to manipulate application memory. This may result in a buffer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-122): [#def15]
cryptsetup-2.8.0-git/lib/utils_io.c:176:4: warning[cpp/BufferOverflow]: Unsanitized input from a file flows into memcpy, where it is used to manipulate application memory. This may result in a buffer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-122): [#def16]
cryptsetup-2.8.0-git/lib/utils_io.c:275:3: warning[cpp/BufferOverflow]: Unsanitized input from a file flows into memcpy, where it is used to manipulate application memory. This may result in a buffer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-190): [#def17]
cryptsetup-2.8.0-git/lib/utils_keyring.c:93:7: warning[cpp/IntegerOverflow]: Unsanitized input from a file flows into an addition operator (+), where it is used in integer arithmetic. This may result in an integer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-190): [#def18]
cryptsetup-2.8.0-git/lib/utils_keyring.c:98:38: warning[cpp/IntegerOverflow]: Unsanitized input from a file flows into a subtraction operator (-), where it is used in integer arithmetic. This may result in an integer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-190): [#def19]
cryptsetup-2.8.0-git/lib/utils_keyring.c:160:22: warning[cpp/IntegerOverflow]: Unsanitized input from a file flows into an addition operator (+), where it is used in integer arithmetic. This may result in an integer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-190): [#def20]
cryptsetup-2.8.0-git/lib/utils_keyring.c:160:28: warning[cpp/IntegerOverflow]: Unsanitized input from a file flows into an addition operator (+), where it is used in integer arithmetic. This may result in an integer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-190): [#def21]
cryptsetup-2.8.0-git/lib/utils_keyring.c:160:54: warning[cpp/IntegerOverflow]: Unsanitized input from a file flows into a subtraction operator (-), where it is used in integer arithmetic. This may result in an integer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-23): [#def22]
cryptsetup-2.8.0-git/lib/utils_loop.c:282:7: warning[cpp/PT]: Unsanitized input from a file flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def23]
cryptsetup-2.8.0-git/misc/dict_search/crypt_dict.c:37:6: warning[cpp/PT]: Unsanitized input from a command line argument flows into fopen, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def24]
cryptsetup-2.8.0-git/misc/dict_search/crypt_dict.c:133:3: warning[cpp/PT]: Unsanitized input from a command line argument flows into fopen, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitary files.
Error: SNYK_CODE_WARNING (CWE-190): [#def25]
cryptsetup-2.8.0-git/misc/keyslot_checker/chk_luks_keyslots.c:150:37: warning[cpp/IntegerOverflow]: Unsanitized input from a file flows into an addition operator (+), where it is used in integer arithmetic. This may result in an integer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-190): [#def26]
cryptsetup-2.8.0-git/misc/keyslot_checker/chk_luks_keyslots.c:212:6: warning[cpp/IntegerOverflow]: Unsanitized input from a file flows into an addition operator (+), where it is used in integer arithmetic. This may result in an integer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-23): [#def27]
cryptsetup-2.8.0-git/misc/keyslot_checker/chk_luks_keyslots.c:314:11: warning[cpp/PT]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-170): [#def28]
cryptsetup-2.8.0-git/src/utils_password.c:251:14: note[cpp/ImproperNullTermination]: Potential improperly null terminated input from a pointer to an input buffer flows into strlen, where it is used as a string. This may result in an information disclosure or buffer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-78): [#def29]
cryptsetup-2.8.0-git/tests/all-symbols-test.c:152:6: note[cpp/CommandInjection/test]: Unsanitized input from a command line argument flows into dlopen, where it is used as a shell command. This may result in a Command Injection vulnerability.
Error: SNYK_CODE_WARNING (CWE-416): [#def30]
cryptsetup-2.8.0-git/tests/api-test-2.c:549:18: note[cpp/UseAfterFree/test]: Use after free. DEVICE_1 is used in global::loop_device after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def31]
cryptsetup-2.8.0-git/tests/api-test-2.c:550:15: note[cpp/UseAfterFree/test]: Use after free. DEVICE_1 is used in global::loop_detach after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def32]
cryptsetup-2.8.0-git/tests/api-test-2.c:552:18: note[cpp/UseAfterFree/test]: Use after free. DEVICE_2 is used in global::loop_device after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def33]
cryptsetup-2.8.0-git/tests/api-test-2.c:553:15: note[cpp/UseAfterFree/test]: Use after free. DEVICE_2 is used in global::loop_detach after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def34]
cryptsetup-2.8.0-git/tests/api-test-2.c:555:18: note[cpp/UseAfterFree/test]: Use after free. DEVICE_3 is used in global::loop_device after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def35]
cryptsetup-2.8.0-git/tests/api-test-2.c:556:15: note[cpp/UseAfterFree/test]: Use after free. DEVICE_3 is used in global::loop_detach after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def36]
cryptsetup-2.8.0-git/tests/api-test-2.c:558:18: note[cpp/UseAfterFree/test]: Use after free. DEVICE_4 is used in global::loop_device after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def37]
cryptsetup-2.8.0-git/tests/api-test-2.c:559:15: note[cpp/UseAfterFree/test]: Use after free. DEVICE_4 is used in global::loop_detach after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def38]
cryptsetup-2.8.0-git/tests/api-test-2.c:561:18: note[cpp/UseAfterFree/test]: Use after free. DEVICE_5 is used in global::loop_device after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def39]
cryptsetup-2.8.0-git/tests/api-test-2.c:562:15: note[cpp/UseAfterFree/test]: Use after free. DEVICE_5 is used in global::loop_detach after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def40]
cryptsetup-2.8.0-git/tests/api-test-2.c:564:18: note[cpp/UseAfterFree/test]: Use after free. DEVICE_6 is used in global::loop_device after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def41]
cryptsetup-2.8.0-git/tests/api-test-2.c:565:15: note[cpp/UseAfterFree/test]: Use after free. DEVICE_6 is used in global::loop_detach after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def42]
cryptsetup-2.8.0-git/tests/api-test-2.c:575:10: note[cpp/UseAfterFree/test]: Use after free. tmp_file_1 is used in remove after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def43]
cryptsetup-2.8.0-git/tests/api-test-2.c:587:7: note[cpp/DoubleFree/test]: Potential double call to free. tmp_file_1 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def44]
cryptsetup-2.8.0-git/tests/api-test-2.c:590:7: note[cpp/DoubleFree/test]: Potential double call to free. DEVICE_1 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def45]
cryptsetup-2.8.0-git/tests/api-test-2.c:591:7: note[cpp/DoubleFree/test]: Potential double call to free. DEVICE_2 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def46]
cryptsetup-2.8.0-git/tests/api-test-2.c:592:7: note[cpp/DoubleFree/test]: Potential double call to free. DEVICE_3 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def47]
cryptsetup-2.8.0-git/tests/api-test-2.c:593:7: note[cpp/DoubleFree/test]: Potential double call to free. DEVICE_4 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def48]
cryptsetup-2.8.0-git/tests/api-test-2.c:594:7: note[cpp/DoubleFree/test]: Potential double call to free. DEVICE_5 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def49]
cryptsetup-2.8.0-git/tests/api-test-2.c:595:7: note[cpp/DoubleFree/test]: Potential double call to free. DEVICE_6 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def50]
cryptsetup-2.8.0-git/tests/api-test.c:186:18: note[cpp/UseAfterFree/test]: Use after free. DEVICE_1 is used in global::loop_device after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def51]
cryptsetup-2.8.0-git/tests/api-test.c:187:15: note[cpp/UseAfterFree/test]: Use after free. DEVICE_1 is used in global::loop_detach after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def52]
cryptsetup-2.8.0-git/tests/api-test.c:189:18: note[cpp/UseAfterFree/test]: Use after free. DEVICE_2 is used in global::loop_device after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def53]
cryptsetup-2.8.0-git/tests/api-test.c:190:15: note[cpp/UseAfterFree/test]: Use after free. DEVICE_2 is used in global::loop_detach after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def54]
cryptsetup-2.8.0-git/tests/api-test.c:192:18: note[cpp/UseAfterFree/test]: Use after free. DEVICE_3 is used in global::loop_device after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def55]
cryptsetup-2.8.0-git/tests/api-test.c:193:15: note[cpp/UseAfterFree/test]: Use after free. DEVICE_3 is used in global::loop_detach after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def56]
cryptsetup-2.8.0-git/tests/api-test.c:199:10: note[cpp/UseAfterFree/test]: Use after free. test_loop_file is used in remove after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-416): [#def57]
cryptsetup-2.8.0-git/tests/api-test.c:201:10: note[cpp/UseAfterFree/test]: Use after free. tmp_file_1 is used in remove after it may already have been freed with call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def58]
cryptsetup-2.8.0-git/tests/api-test.c:213:7: note[cpp/DoubleFree/test]: Potential double call to free. tmp_file_1 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def59]
cryptsetup-2.8.0-git/tests/api-test.c:214:7: note[cpp/DoubleFree/test]: Potential double call to free. test_loop_file may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def60]
cryptsetup-2.8.0-git/tests/api-test.c:216:7: note[cpp/DoubleFree/test]: Potential double call to free. DEVICE_1 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def61]
cryptsetup-2.8.0-git/tests/api-test.c:217:7: note[cpp/DoubleFree/test]: Potential double call to free. DEVICE_2 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-415): [#def62]
cryptsetup-2.8.0-git/tests/api-test.c:218:7: note[cpp/DoubleFree/test]: Potential double call to free. DEVICE_3 may have already been freed by call to free.
Error: SNYK_CODE_WARNING (CWE-23): [#def63]
cryptsetup-2.8.0-git/tests/differ.c:96:10: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-170): [#def64]
cryptsetup-2.8.0-git/tests/differ.c:141:7: note[cpp/ImproperNullTermination/test]: Potential improperly null terminated input from a pointer to an input buffer flows into fopen, where it is used as a string. This may result in an information disclosure or buffer overflow vulnerability.
Error: SNYK_CODE_WARNING (CWE-23): [#def65]
cryptsetup-2.8.0-git/tests/differ.c:141:7: note[cpp/PT/test]: Unsanitized input from a command line argument flows into fopen, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def66]
cryptsetup-2.8.0-git/tests/fuzz/plain_json_proto_to_luks2.cc:34:8: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def67]
cryptsetup-2.8.0-git/tests/fuzz/plain_json_proto_to_luks2.cc:52:8: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def68]
cryptsetup-2.8.0-git/tests/fuzz/proto_to_luks2.cc:34:8: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def69]
cryptsetup-2.8.0-git/tests/fuzz/proto_to_luks2.cc:52:8: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def70]
cryptsetup-2.8.0-git/tests/unit-utils-io.c:48:7: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def71]
cryptsetup-2.8.0-git/tests/unit-utils-io.c:79:7: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def72]
cryptsetup-2.8.0-git/tests/unit-utils-io.c:111:7: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def73]
cryptsetup-2.8.0-git/tests/unit-utils-io.c:143:7: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def74]
cryptsetup-2.8.0-git/tests/unit-utils-io.c:174:7: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Error: SNYK_CODE_WARNING (CWE-23): [#def75]
cryptsetup-2.8.0-git/tests/unit-utils-io.c:205:7: note[cpp/PT/test]: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
Scan Properties
analyzer-version-clang | 18.1.2 |
analyzer-version-clippy | 1.79.0 |
analyzer-version-coverity | 2024.3.0 |
analyzer-version-cppcheck | 2.14.1 |
analyzer-version-gcc | 14.1.1 |
analyzer-version-gcc-analyzer | 14.1.1 |
analyzer-version-shellcheck | 0.9.0 |
analyzer-version-snyk-code | 1.1233.0 |
analyzer-version-unicontrol | 0.0.2 |
enabled-plugins | clang, clippy, coverity, cppcheck, gcc, shellcheck, snyk, unicontrol |
exit-code | 1 |
host | osh-worker-005.osh-001.prod.iad2.dc.redhat.com |
known-false-positives | /usr/share/csmock/known-false-positives.js |
known-false-positives-rpm | known-false-positives-2.2.0.20240703.103728.gbf0dd0b-1.el9.noarch |
mock-config | rhel-10-beta-x86_64 |
project-name | cryptsetup-2.8.0-1.fc39 |
snyk-scanned-files-coverage | 85 |
snyk-scanned-files-success | 139 |
snyk-scanned-files-total | 162 |
store-results-to | /tmp/tmp7gr4uo4o/cryptsetup-2.8.0-1.fc39.tar.xz |
time-created | 2024-07-12 11:38:19 |
time-finished | 2024-07-12 11:41:26 |
tool | csmock |
tool-args | '/usr/bin/csmock' '-r' 'rhel-10-beta-x86_64' '-t' 'coverity,clang,shellcheck,gcc,clippy,unicontrol,snyk,cppcheck' '-o' '/tmp/tmp7gr4uo4o/cryptsetup-2.8.0-1.fc39.tar.xz' '--keep-going' '--use-host-cppcheck' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '/tmp/tmp7gr4uo4o/cryptsetup-2.8.0-1.fc39.src.rpm' |
tool-version | csmock-3.6.0.20240621.181148.g9f7c028.internal-1.el9 |