Merge branch 'master' into AST-45283-pulumi

liorj-orca · Sep 18, 2024 · 958cdec · 958cdec
2 parents 0229143 + 4b3cee7
commit 958cdec
Show file tree

Hide file tree

Showing 1,158 changed files with 2,566 additions and 1,298 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -31,7 +31,7 @@ USER nonroot
 # Runtime image
 # Ignore no User Cmd since KICS container is stopped afer scan
 # kics-scan ignore-line
-FROM cgr.dev/chainguard/git@sha256:02660563e96b553d6aeb4093e3fcc3e91b2ad3a86e05c65b233f37f035e5044e
+FROM cgr.dev/chainguard/git@sha256:d007b76406e3e77d8f35b26620ffd1f82d71c61d0c900530c2ac4666a96822b8
 
 ENV TERM xterm-256color
 

diff --git a/assets/cwe_csv/Hardware-Design-CWE.csv b/assets/cwe_csv/Hardware-Design-CWE.csv
diff --git a/assets/cwe_csv/Research-Concepts-CWE.csv b/assets/cwe_csv/Research-Concepts-CWE.csv
diff --git a/assets/queries/ansible/aws/alb_listening_on_http/metadata.json b/assets/queries/ansible/aws/alb_listening_on_http/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "3a7576e5",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "319",
   "oldSeverity": "HIGH"
 }
diff --git a/assets/queries/ansible/aws/ami_not_encrypted/metadata.json b/assets/queries/ansible/aws/ami_not_encrypted/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "a4342f08",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "311",
   "oldSeverity": "HIGH"
 }
diff --git a/assets/queries/ansible/aws/ami_shared_with_multiple_accounts/metadata.json b/assets/queries/ansible/aws/ami_shared_with_multiple_accounts/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "2117f1c7",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "284"
 }
diff --git a/assets/queries/ansible/aws/api_gateway_endpoint_config_is_not_private/metadata.json b/assets/queries/ansible/aws/api_gateway_endpoint_config_is_not_private/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "42fabc16",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "285"
 }
diff --git a/assets/queries/ansible/aws/api_gateway_with_cloudwatch_logging_disabled/metadata.json b/assets/queries/ansible/aws/api_gateway_with_cloudwatch_logging_disabled/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "313709e8",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "778"
 }
diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/metadata.json b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "e7b28671",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "284"
 }
diff --git a/assets/queries/ansible/aws/api_gateway_without_ssl_certificate/metadata.json b/assets/queries/ansible/aws/api_gateway_without_ssl_certificate/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "82608f36",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "295"
 }
diff --git a/assets/queries/ansible/aws/api_gateway_without_waf/metadata.json b/assets/queries/ansible/aws/api_gateway_without_waf/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "8e789062",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "778"
 }
diff --git a/assets/queries/ansible/aws/api_gateway_xray_disabled/metadata.json b/assets/queries/ansible/aws/api_gateway_xray_disabled/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "57da10ee",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "778",
   "oldSeverity": "MEDIUM"
 }
diff --git a/assets/queries/ansible/aws/authentication_without_mfa/metadata.json b/assets/queries/ansible/aws/authentication_without_mfa/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "36040ce0",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "287",
   "oldSeverity": "HIGH"
 }
diff --git a/assets/queries/ansible/aws/auto_scaling_group_with_no_associated_elb/metadata.json b/assets/queries/ansible/aws/auto_scaling_group_with_no_associated_elb/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "57b5fbca",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "400"
 }
diff --git a/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/metadata.json b/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "7734a8b1",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "665"
 }
diff --git a/assets/queries/ansible/aws/aws_password_policy_with_unchangeable_passwords/metadata.json b/assets/queries/ansible/aws/aws_password_policy_with_unchangeable_passwords/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "5a7cf92f",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "620",
   "oldSeverity": "MEDIUM"
 }
diff --git a/...eries/ansible/aws/batch_job_definition_with_privileged_container_properties/metadata.json b/...eries/ansible/aws/batch_job_definition_with_privileged_container_properties/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "9683e81a",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "250"
 }
diff --git a/assets/queries/ansible/aws/ca_certificate_identifier_is_outdated/metadata.json b/assets/queries/ansible/aws/ca_certificate_identifier_is_outdated/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "d92aa922",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "295",
   "oldSeverity": "HIGH"
 }
diff --git a/assets/queries/ansible/aws/cdn_configuration_is_missing/metadata.json b/assets/queries/ansible/aws/cdn_configuration_is_missing/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "c8ae0f38",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "710"
 }
diff --git a/assets/queries/ansible/aws/certificate_has_expired/metadata.json b/assets/queries/ansible/aws/certificate_has_expired/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "3f6a85e8",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "298"
 }
diff --git a/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_256/metadata.json b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_256/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "97dc7eba",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "295"
 }
diff --git a/assets/queries/ansible/aws/cloudfront_logging_disabled/metadata.json b/assets/queries/ansible/aws/cloudfront_logging_disabled/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "1bfc2dfd",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "778"
 }
diff --git a/assets/queries/ansible/aws/cloudfront_without_minimum_protocol_tls_1.2/metadata.json b/assets/queries/ansible/aws/cloudfront_without_minimum_protocol_tls_1.2/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "b0a58f2f",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "326",
   "oldSeverity": "HIGH"
 }
diff --git a/assets/queries/ansible/aws/cloudfront_without_waf/metadata.json b/assets/queries/ansible/aws/cloudfront_without_waf/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "7fd7e5c0",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "778",
   "oldSeverity": "LOW"
 }
diff --git a/assets/queries/ansible/aws/cloudtrail_log_file_validation_disabled/metadata.json b/assets/queries/ansible/aws/cloudtrail_log_file_validation_disabled/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "04302074",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "778"
 }
diff --git a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_kms/metadata.json b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_kms/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "d3b81fde",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "311"
 }
diff --git a/assets/queries/ansible/aws/cloudtrail_logging_disabled/metadata.json b/assets/queries/ansible/aws/cloudtrail_logging_disabled/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "c29f6786",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "778",
   "oldSeverity": "HIGH"
 }
diff --git a/assets/queries/ansible/aws/cloudtrail_multi_region_disabled/metadata.json b/assets/queries/ansible/aws/cloudtrail_multi_region_disabled/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "8c4873bf",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "778",
   "oldSeverity": "MEDIUM"
 }
diff --git a/assets/queries/ansible/aws/cloudtrail_not_integrated_with_cloudwatch/metadata.json b/assets/queries/ansible/aws/cloudtrail_not_integrated_with_cloudwatch/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "fbc987a2",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "778",
   "oldSeverity": "MEDIUM"
 }
diff --git a/assets/queries/ansible/aws/cloudtrail_sns_topic_name_undefined/metadata.json b/assets/queries/ansible/aws/cloudtrail_sns_topic_name_undefined/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "de97fa1a",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "703",
   "oldSeverity": "MEDIUM"
 }
diff --git a/assets/queries/ansible/aws/cloudwatch_without_retention_period_specified/metadata.json b/assets/queries/ansible/aws/cloudwatch_without_retention_period_specified/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "c48a227e",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "778",
   "oldSeverity": "MEDIUM"
 }
diff --git a/assets/queries/ansible/aws/cmk_is_unusable/metadata.json b/assets/queries/ansible/aws/cmk_is_unusable/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "cb70e349",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "693"
 }
diff --git a/assets/queries/ansible/aws/cmk_rotation_disabled/metadata.json b/assets/queries/ansible/aws/cmk_rotation_disabled/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "177ee908",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "326",
   "oldSeverity": "HIGH"
 }
diff --git a/assets/queries/ansible/aws/codebuild_not_encrypted/metadata.json b/assets/queries/ansible/aws/codebuild_not_encrypted/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "7d51416a",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "311"
 }
diff --git a/...queries/ansible/aws/config_configuration_aggregator_to_all_regions_disabled/metadata.json b/...queries/ansible/aws/config_configuration_aggregator_to_all_regions_disabled/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "c6e4ac23",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "285",
   "oldSeverity": "MEDIUM"
 }
diff --git a/assets/queries/ansible/aws/config_rule_for_encrypted_volumes_is_disabled/metadata.json b/assets/queries/ansible/aws/config_rule_for_encrypted_volumes_is_disabled/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "5b434d3f",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "311",
   "oldSeverity": "MEDIUM"
 }
diff --git a/...ansible/aws/cross_account_iam_assume_role_policy_without_external_id_or_mfa/metadata.json b/...ansible/aws/cross_account_iam_assume_role_policy_without_external_id_or_mfa/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "54f0a7dd",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "285",
   "oldSeverity": "MEDIUM"
 }
diff --git a/assets/queries/ansible/aws/db_instance_storage_not_encrypted/metadata.json b/assets/queries/ansible/aws/db_instance_storage_not_encrypted/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "575cc1f4",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "311"
 }
diff --git a/assets/queries/ansible/aws/db_security_group_open_to_large_scope/metadata.json b/assets/queries/ansible/aws/db_security_group_open_to_large_scope/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "c7f9cb9f",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "200"
 }
diff --git a/assets/queries/ansible/aws/db_security_group_with_public_scope/metadata.json b/assets/queries/ansible/aws/db_security_group_with_public_scope/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "47a14ee4",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "732",
   "oldSeverity": "HIGH"
 }
diff --git a/assets/queries/ansible/aws/default_security_groups_with_unrestricted_traffic/metadata.json b/assets/queries/ansible/aws/default_security_groups_with_unrestricted_traffic/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "6fd8f0e1",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "285"
 }
diff --git a/assets/queries/ansible/aws/ebs_volume_encryption_disabled/metadata.json b/assets/queries/ansible/aws/ebs_volume_encryption_disabled/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "06f72385",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "311",
   "oldSeverity": "MEDIUM"
 }
diff --git a/assets/queries/ansible/aws/ec2_group_has_public_interface/metadata.json b/assets/queries/ansible/aws/ec2_group_has_public_interface/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "506f9dd8",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "732"
 }
diff --git a/assets/queries/ansible/aws/ec2_instance_has_public_ip/metadata.json b/assets/queries/ansible/aws/ec2_instance_has_public_ip/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "f32c5d88",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "200",
   "oldSeverity": "HIGH"
 }
diff --git a/assets/queries/ansible/aws/ec2_instance_using_default_security_group/metadata.json b/assets/queries/ansible/aws/ec2_instance_using_default_security_group/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "cc323109",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "732",
   "oldSeverity": "LOW"
 }
diff --git a/assets/queries/ansible/aws/ec2_instance_using_default_vpc/metadata.json b/assets/queries/ansible/aws/ec2_instance_using_default_vpc/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "701b1c92",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "200"
 }
diff --git a/assets/queries/ansible/aws/ec2_not_ebs_optimized/metadata.json b/assets/queries/ansible/aws/ec2_not_ebs_optimized/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "a99c1fe0",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "710"
 }
diff --git a/assets/queries/ansible/aws/ecr_image_tag_not_immutable/metadata.json b/assets/queries/ansible/aws/ecr_image_tag_not_immutable/metadata.json
@@ -8,5 +8,5 @@
   "platform": "Ansible",
   "descriptionID": "a9bdce24",
   "cloudProvider": "aws",
-  "cwe": ""
+  "cwe": "710"
 }
diff --git a/assets/queries/ansible/aws/ecr_repository_is_publicly_accessible/metadata.json b/assets/queries/ansible/aws/ecr_repository_is_publicly_accessible/metadata.json
@@ -8,6 +8,6 @@
   "platform": "Ansible",
   "descriptionID": "060d624f",
   "cloudProvider": "aws",
-  "cwe": "",
+  "cwe": "668",
   "oldSeverity": "MEDIUM"
-}
+}