Skip to content

Conversation

@Harishvow
Copy link

This pull request introduces a new CVE checker for XGBoost, an open-source machine learning library maintained under the dmlc/xgboost
project.

Details

Added a new file xgboost.py under cve_bin_tool/checkers/

Implemented detection logic for XGBoost binaries using:

Shared library names: libxgboost.so, libxgboost.dylib, xgboost.dll

Internal identifiers such as xgboost7DMatrix, xgboost10collective, etc.

Defined a version extraction pattern: ([0-9]+.[0-9]+.[0-9]+)

Created unit tests in test_xgboost.py to validate both detection and version extraction.

Checklist

1.Code follows the project’s style guide and includes SPDX license headers

2.Checker correctly detects XGBoost binaries

3.Tests pass successfully (pytest test/test_xgboost.py)

4.Verified functionality with a real XGBoost library binary

5.Added "xgboost" entry in init.py

Maintainer Note

This checker adds support for detecting XGBoost libraries commonly used in data science and machine learning environments.
It enables accurate CVE correlation and improves the tool’s coverage for ML related dependencies.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant