Add new checker for XGBoost (dmlc/xgboost) #5417
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces a new CVE checker for XGBoost, an open-source machine learning library maintained under the dmlc/xgboost
project.
Details
Added a new file xgboost.py under cve_bin_tool/checkers/
Implemented detection logic for XGBoost binaries using:
Shared library names: libxgboost.so, libxgboost.dylib, xgboost.dll
Internal identifiers such as xgboost7DMatrix, xgboost10collective, etc.
Defined a version extraction pattern: ([0-9]+.[0-9]+.[0-9]+)
Created unit tests in test_xgboost.py to validate both detection and version extraction.
Checklist
1.Code follows the project’s style guide and includes SPDX license headers
2.Checker correctly detects XGBoost binaries
3.Tests pass successfully (pytest test/test_xgboost.py)
4.Verified functionality with a real XGBoost library binary
5.Added "xgboost" entry in init.py
Maintainer Note
This checker adds support for detecting XGBoost libraries commonly used in data science and machine learning environments.
It enables accurate CVE correlation and improves the tool’s coverage for ML related dependencies.