Update dependency snyk to v1.996.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
snyk	1.963.0 → 1.996.0

---

Snyk CLI affected by Command Injection vulnerability

CVE-2022-40764 / GHSA-hpqj-7cj6-hfj8

More information

Details

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957.

Severity

• CVSS Score: 7.8 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-40764
• https://github.com/snyk/cli/releases/tag/v1.996.0
• https://github.com/snyk/snyk-go-plugin/releases/tag/v1.19.1
• https://support.snyk.io/hc/en-us/articles/7015908293789-CVE-2022-40764-Command-Injection-vulnerability-affecting-Snyk-CLI-versions-prior-to-1-996-0
• https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/
• https://github.com/advisories/GHSA-hpqj-7cj6-hfj8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

snyk/snyk (snyk)

v1.996.0

Compare Source

Bug Fixes

• bump golang plugin version (8893f81)

Features

• add --var-file support (537372d)

v1.995.0

Compare Source

Bug Fixes

• matching configurations error on gradle version catalog (20dcdae)

v1.994.0

Compare Source

Bug Fixes

• more IaC error codes (e0227c3)

Features

• add custom severities to iac test config (9d86574)
• add ignore count in the experimental version of iac test (d390ca2)
• Added support for depth-detection (8cf1815)

v1.993.0

Compare Source

Features

• add scan flag support (53951fc)

v1.992.0

Compare Source

Bug Fixes

• --target-name bug (3431f79)
• Spacing for issue descriptions with custom rules (29b2fdb)

v1.991.0

Compare Source

Features

• add report summary (d8e4ea8)
• pass policy (.snyk) to iac-test via the config file. (6d3ad76)

v1.990.0

Compare Source

Bug Fixes

• none custom policies severity issues should be filtered out before sending them to registry (4acacd2)

v1.989.0

Compare Source

Bug Fixes

• downgrade snyk-go-plugin to 1.19.0 (4643026)
• increase buffer size (8079fe3)
• update golang plugin (a0e30d9)
• upgrade-docker-registry-v2-client (275afb1)

Features

• pass remote-repo-url arg to snyk-iac-test (18e8c87)

v1.988.0

Compare Source

Bug Fixes

• return exit code 3 when no resources can be found (9d2e41f)
• upgrade docker-registry-v2-client lib (374ba55)

Features

• pass target-name arg to snyk-iac-test (4352122)
• stop caching rules (71c866e)

v1.987.0

Compare Source

Bug Fixes

• correct broken URLs for license issues (8a46931)
• Ensured the test spinner stops (5d9d15f)

Features

• remove reachability (5500e25)
• scan maven aggregate projects (019bc45)
• share cache path with IaC plugin (e254c0c)
• update snyk-iac-test to 0.18.1 (379fe0c)

v1.986.0

Compare Source

Bug Fixes

• wrong 2x count of iac issues with --report -multi-doc yaml (06da34e)

v1.985.0

Compare Source

Bug Fixes

• Fixed incomplete CC path when missing resource attributes (6a4480c)
• missing release in package version string (dcb40ab)
• upgarde docker-registry-v2-client lib (5de3cb1)

Features

• introduce —about flag to print attribution information (60eaec8)
• pass projectTags arg to snyk-iac-test (ae70c1e)

v1.984.0

Compare Source

v1.983.0

Compare Source

Bug Fixes

• use FormattedPath (2ebfb71)

Features

• add project attributes support in --experimental (08791f8)
• Implement AnyAuth Proxy Authentication support (467b621)

v1.982.0

Compare Source

Bug Fixes

• upgrade docker plugin to improve stream parsing (a59d8e4)

Features

• pass configuration to snyk-iac-test (6fb5992)
• upgrade snyk iac test to 0.13.1 (ce7103e)

v1.981.0

Compare Source

Bug Fixes

• Add missing IaC issue props in JSON output (da3a671)

v1.980.0

Compare Source

Features

• improve maven debug logging (a0cdcfc)

v1.979.0

Compare Source

Bug Fixes

• handle gradle strict lock mode (8905252)

v1.978.0

Compare Source

Features

• add SARIF support (CFG-1993) (622c8f4)

v1.977.0

Compare Source

Bug Fixes

• container app vulns json with experimental flag (332d87b)

Features

• add deprecation message to test command (7f191b5)

v1.976.0

Compare Source

Features

• improve comment handling for SBT scans (cf862b9)

v1.975.0

Compare Source

Features

• add test summary section to the experimental output (b708086)

v1.974.0

Compare Source

Features

• add 'target-name' flag support (6305c3d)

v1.973.0

Compare Source

Bug Fixes

• vuln links using demunge (01154c9)

Features

• add --remote-repo-url to "iac test" (2a12048)
• update general vuln descriptions to point to pvdb (ad80d74)
• update spotlight vuln descriptions (f536c9d)

v1.972.0

Compare Source

Bug Fixes

• handle errors from /share-results (5871079)

Features

• Add support for severity threshold (6833389)

v1.971.0

Compare Source

Features

• snyk-iac-test error handling (3b3fa89)

v1.970.0

Compare Source

v1.969.0

Compare Source

Features

• officially support Gradle 7 scanning (314dc96)

v1.968.0

Compare Source

Features

• remove support for paths outside the current working directory (5ca35c1)

v1.967.0

Compare Source

Bug Fixes

• bump snyk docker plugin version golang fixes (8d55bcd), closes #​3433

v1.966.0

Compare Source

Bug Fixes

• bump cloud-config-parser (38502ed)

v1.965.0

Compare Source

Bug Fixes

• return paths for files that errrored (IaC) (d53afde)

v1.964.0

Compare Source

Features

• add JSON support (4c636da)
• bump snyk-iac-test version (0599c71)
• improve Snyk API URL configuration (5a0bcbe)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.