CWE-120 on xgboost by dependency track

#1

Hello.

I figured out what xgboost package does not pass Dependency Tracker. There is indicated CWE-120 (Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)).
I can not point the exact code snippet with vulnerability so far.

Is that known issue?

#2

No. A more detailed report will be appreciated. For example, what is Dependency Tracker?

#3

Thank you for replying.

Dependency Track: https://dependencytrack.org/
I am trying to get more specific information. As soon as I get it, I will provide here.

#4

Guess this may be related:

1 Like