c-FuSa/tara.json at main · SoundMatt/c-FuSa · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
{
  "schemaVersion": "1.15.0",
  "kind": "tara-report",
  "tool": "c-FuSa",
  "toolVersion": "0.5.47",
  "language": "c",
  "generatedAt": "2026-07-28T21:51:15Z",
  "project": "c-FuSa",
  "version": "0.5.1",
  "standard": "iso21434",
  "threats": [
    {
      "id": "TARA-001",
      "asset": "Data handled by import_reqif (cmd_req.c)",
      "threat": "An attacker supplies malformed/untrusted input to import_reqif, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "cmd/cfusa/cmd_req.c", "line": 646}
    },
    {
      "id": "TARA-002",
      "asset": "Data handled by import_polarion_xml (cmd_req.c)",
      "threat": "An attacker supplies malformed/untrusted input to import_polarion_xml, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "cmd/cfusa/cmd_req.c", "line": 652}
    },
    {
      "id": "TARA-003",
      "asset": "Data handled by import_reqif (cmd_req.c)",
      "threat": "An attacker supplies malformed/untrusted input to import_reqif, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "cmd/cfusa/cmd_req.c", "line": 655}
    },
    {
      "id": "TARA-004",
      "asset": "Data handled by import_codebeamer_xml (cmd_req.c)",
      "threat": "An attacker supplies malformed/untrusted input to import_codebeamer_xml, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "cmd/cfusa/cmd_req.c", "line": 660}
    },
    {
      "id": "TARA-005",
      "asset": "Data handled by import_jama_xml (cmd_req.c)",
      "threat": "An attacker supplies malformed/untrusted input to import_jama_xml, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "cmd/cfusa/cmd_req.c", "line": 671}
    },
    {
      "id": "TARA-006",
      "asset": "Data handled by parse_sec_code (cmd_hara.c)",
      "threat": "An attacker supplies malformed/untrusted input to parse_sec_code, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "cmd/cfusa/cmd_hara.c", "line": 622}
    },
    {
      "id": "TARA-007",
      "asset": "Data handled by parse_sec_code (cmd_hara.c)",
      "threat": "An attacker supplies malformed/untrusted input to parse_sec_code, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "cmd/cfusa/cmd_hara.c", "line": 677}
    },
    {
      "id": "TARA-008",
      "asset": "Data handled by cfusa_format_parse (report.c)",
      "threat": "An attacker supplies malformed/untrusted input to cfusa_format_parse, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "src/report.c", "line": 137}
    },
    {
      "id": "TARA-009",
      "asset": "Data handled by cfusa_fopen_write (utils.c)",
      "threat": "An attacker supplies malformed/untrusted input to cfusa_fopen_write, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "src/utils.c", "line": 99}
    },
    {
      "id": "TARA-010",
      "asset": "Data handled by cfusa_config_load (config.c)",
      "threat": "An attacker supplies malformed/untrusted input to cfusa_config_load, potentially causing incorrect behaviour, a crash, or information disclosure",
      "attackVector": "local",
      "attackFeasibility": "medium",
      "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"},
      "risk": "high",
      "treatment": "mitigate",
      "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"],
      "location": {"file": "src/config.c", "line": 92}
    }
  ],
  "summary": {
    "assetsAnalyzed": 10, "assetsInProject": 10, "coveragePct": 100,
    "assetInventoryMethod": "Keyword-based scan of public C function names against a network/file/auth/memory-input vocabulary; not a formal asset inventory."
  }
}