Feature Proposal: Make it possible to communicate vulnerable user accounts, insecure passwords and hashing algorithms

[cookiengineer]

In the age of Docker, Kubernetes and other solutions that allow virtualizations, these solutions often come with preinstalled software, libraries and more importantly - preconfigured user accounts with default passwords.

In think what's missing from the Bill of Vulnerabilities use case are the following things:

• which running service has a separate user account (postgres? mysql user? service running as root?)
• which user accounts can be abused for potential logins (does root have a password? does the account have a shell instead of /usr/bin/nologin?)
• which user password hash algorithm is used for /etc/shadow (DES? MD5? MD6? SHA1?)
• which user accounts have known default passwords (mysql:mysql, postgres:postgres, remember the MongoDB hack? )
• which user accounts have compromised passwords (haveibeenpwned, Breach Compilation, Collection #1 etc)

[cookiengineer]

@stevespringett Is there a formal procedure on how to request a feature proposal other than here?

[stevespringett]

Related to #119

[stevespringett]

Is there a formal procedure on how to request a feature proposal other than here?

You're in the right place. Proposed changes go through the formalized standardization process. https://cyclonedx.org/about/standardization-process/

[jkowalleck]

with release of CDX schema 1.5 new elements and properties were added to vulnerabilities. such as proofOfConcept which can hold information what and how to exploit a system.