VNX-1104: Use of Unmaintained Third Party Components

A dependency manifest declares a third-party component whose maintainers have deprecated, archived or end-of-lifed it, so security fixes no longer arrive: npm request/request-promise(-native), node-uuid, jade, node-sass, tslint, gulp-util, coffee-script, istanbul, babel-eslint, nomnom, bower, phantomjs(-prebuilt), protractor, swig and the npm 'crypto' stub in package.json dependency blocks; pycrypto, nose, PyPDF2, MySQL-python, pep8, sklearn and distribute in requirements*.txt (and requirements/*.txt), pyproject.toml (PEP 621 arrays and Poetry dependency tables) and Pipfile package sections; paperclip, therubyracer and Ruby Sass (gem 'sass') in a Gemfile; and log4j 1.x (log4j:log4j), commons-httpclient 3.x and Jackson 1.x (org.codehaus.jackson) in pom.xml and Gradle builds. Reported: the declaring line, with the maintained successor in the message. Not reported: the successors themselves (uuid, pug, sass, eslint, nyc, pycryptodome, pypdf, nose2, scikit-learn, mysqlclient, kt-paperclip, log4j 2, httpclient 4), lookalike names (request-ip, sass-rails, log4j-api, log4j-1.2-api), the names used as npm script keys or descriptions, Poetry and Pipfile [scripts] entries, and commented-out entries (including entries inside XML comments in pom.xml). A component that is merely old, or unmaintained without an upstream announcement, is not inferred.

Field	Value
Rule ID	`VNX-1104`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, Python, Ruby, Java, Kotlin
CWE	CWE-1104
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`dependencies` `unmaintained` `supply-chain` `cwe-1104`
Source	`internal/sast/rules/vnx-1104.rego`

Overview

VNX-1104 maps to CWE-1104: Use of Unmaintained Third Party Components. A dependency manifest declares a third-party component whose maintainers have deprecated, archived or end-of-lifed it, so security fixes no longer arrive: npm request/request-promise(-native), node-uuid, jade, node-sass, tslint, gulp-util, coffee-script, istanbul, babel-eslint, nomnom, bower, phantomjs(-prebuilt), protractor, swig and the npm ‘crypto’ stub in package.json dependency blocks; pycrypto, nose, PyPDF2, MySQL-python, pep8, sklearn and distribute in requirements*.txt (and requirements/*.txt), pyproject.toml (PEP 621 arrays and Poetry dependency tables) and Pipfile package sections; paperclip, therubyracer and Ruby Sass (gem ‘sass’) in a Gemfile; and log4j 1.x (log4j:log4j), commons-httpclient 3.x and Jackson 1.x (org.codehaus.jackson) in pom.xml and Gradle builds. Reported: the declaring line, with the maintained successor in the message. Not reported: the successors themselves (uuid, pug, sass, eslint, nyc, pycryptodome, pypdf, nose2, scikit-learn, mysqlclient, kt-paperclip, log4j 2, httpclient 4), lookalike names (request-ip, sass-rails, log4j-api, log4j-1.2-api), the names used as npm script keys or descriptions, Poetry and Pipfile [scripts] entries, and commented-out entries (including entries inside XML comments in pom.xml). A component that is merely old, or unmaintained without an upstream announcement, is not inferred.

Why This Matters

When a project is deprecated or archived, vulnerabilities found in it are not fixed. request and pycrypto have open, unfixed advisories; log4j 1.x carries CVE-2019-17571 and the JMSAppender family with no release to upgrade to. The only remediation is to move to the successor.

What Gets Flagged

"dependencies": {
  "request": "^2.88.2",        // FLAGGED (use fetch, undici or axios)
  "node-sass": "^7.0.3"        // FLAGGED (use sass)
}

pycrypto==2.6.1                 # FLAGGED in requirements.txt (use pycryptodome)
gem "paperclip", "~> 6.1"       # FLAGGED in Gemfile (use Active Storage)
<artifactId>log4j</artifactId>  # FLAGGED in pom.xml when groupId is log4j

Not flagged: uuid, pug, sass, pycryptodome, nose2, kt-paperclip, log4j-api, request-ip, npm script keys named request, and commented-out lines.

Remediation

Migrate to the successor named in the finding message and remove the deprecated package from the manifest and lockfile.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1104
// nosec vnx-1104

Or record an ignore rule: vulnetix ignore add --rule vnx-1104 --reason "...". See Suppressing findings.