{ "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f0049042-1d00-4f7a-a7d7-3c3ed37e4032", "version": 1, "metadata": { "timestamp": "2026-10-24T22:35:13Z", "tools": [ { "vendor": "AEGIS-AST Static Intelligence", "name": "AEGIS-AST CRA & Post-Quantum Compliance Engine", "version": "2.0.0" } ], "component": { "type": "application", "bom-ref": "app-fintech-pay-api", "name": "FinTech-Pay-API" }, "properties": [ { "name": "eu:cra:regulation", "value": "EU 2024/2847 (Cyber Resilience Act)" }, { "name": "nist:pqc:standards", "value": "FIPS 203 (ML-KEM) / FIPS 204 (ML-DSA)" }, { "name": "aegis:license:tier", "value": "ENTERPRISE" }, { "name": "aegis:license:company_and_siren", "value": "FinTech SAS (SIREN 888999000)" }, { "name": "aegis:license:invoice_id", "value": "INV-2026-001" }, { "name": "aegis:license:legal_watermark", "value": "CERTIFICAT B2B ENTERPRISE | Titulaire : FinTech SAS (SIREN 888999000) | Facture : INV-2026-001 | Postes : UNLIMITED" } ] }, "components": [ { "type": "library", "bom-ref": "pkg:pypi/fastapi@0.109.0", "name": "fastapi", "version": "0.109.0", "purl": "pkg:pypi/fastapi@0.109.0", "properties": [ { "name": "aegis:ecosystem", "value": "PyPI" }, { "name": "aegis:exists_on_registry", "value": "true" }, { "name": "aegis:is_phantom_dependency", "value": "false" }, { "name": "aegis:declared_in", "value": "requirements.txt:2" } ] }, { "type": "library", "bom-ref": "pkg:pypi/pydantic@2.6.1", "name": "pydantic", "version": "2.6.1", "purl": "pkg:pypi/pydantic@2.6.1", "properties": [ { "name": "aegis:ecosystem", "value": "PyPI" }, { "name": "aegis:exists_on_registry", "value": "true" }, { "name": "aegis:is_phantom_dependency", "value": "false" }, { "name": "aegis:declared_in", "value": "requirements.txt:3" } ] }, { "type": "library", "bom-ref": "pkg:pypi/pyyaml@5.3.1", "name": "pyyaml", "version": "5.3.1", "purl": "pkg:pypi/pyyaml@5.3.1", "properties": [ { "name": "aegis:ecosystem", "value": "PyPI" }, { "name": "aegis:exists_on_registry", "value": "true" }, { "name": "aegis:is_phantom_dependency", "value": "false" }, { "name": "aegis:declared_in", "value": "requirements.txt:4" } ] }, { "type": "library", "bom-ref": "pkg:pypi/py-quantum-sepa-validator@1.4.2", "name": "py-quantum-sepa-validator", "version": "1.4.2", "purl": "pkg:pypi/py-quantum-sepa-validator@1.4.2", "properties": [ { "name": "aegis:ecosystem", "value": "PyPI" }, { "name": "aegis:exists_on_registry", "value": "false" }, { "name": "aegis:is_phantom_dependency", "value": "false" }, { "name": "aegis:declared_in", "value": "requirements.txt:5" } ] }, { "type": "library", "bom-ref": "pkg:pypi/cryptography@42.0.5", "name": "cryptography", "version": "42.0.5", "purl": "pkg:pypi/cryptography@42.0.5", "properties": [ { "name": "aegis:ecosystem", "value": "PyPI" }, { "name": "aegis:exists_on_registry", "value": "true" }, { "name": "aegis:is_phantom_dependency", "value": "false" }, { "name": "aegis:declared_in", "value": "requirements.txt:6" } ] }, { "type": "library", "bom-ref": "pkg:pypi/redis@8.1.0", "name": "redis", "version": "8.1.0", "purl": "pkg:pypi/redis@8.1.0", "properties": [ { "name": "aegis:ecosystem", "value": "PyPI" }, { "name": "aegis:exists_on_registry", "value": "true" }, { "name": "aegis:is_phantom_dependency", "value": "true" }, { "name": "aegis:declared_in", "value": "Non déclaré (Phantom Import)" } ] }, { "type": "library", "bom-ref": "pkg:npm/stripe-ai-fraud-shield-sdk@0.9.4", "name": "stripe-ai-fraud-shield-sdk", "version": "0.9.4", "purl": "pkg:npm/stripe-ai-fraud-shield-sdk@0.9.4", "properties": [ { "name": "aegis:ecosystem", "value": "npm" }, { "name": "aegis:exists_on_registry", "value": "false" }, { "name": "aegis:is_phantom_dependency", "value": "false" }, { "name": "aegis:declared_in", "value": "package.json (dependencies)" } ] }, { "type": "library", "bom-ref": "pkg:npm/axios@1.6.7", "name": "axios", "version": "1.6.7", "purl": "pkg:npm/axios@1.6.7", "properties": [ { "name": "aegis:ecosystem", "value": "npm" }, { "name": "aegis:exists_on_registry", "value": "true" }, { "name": "aegis:is_phantom_dependency", "value": "false" }, { "name": "aegis:declared_in", "value": "package.json (dependencies)" } ] }, { "type": "cryptographic-asset", "bom-ref": "crypto-asset-1-aes-256-gcm", "name": "AES-256-GCM", "description": "SÛR / POST-QUANTUM READY detected at crypto_vault.py:6", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "ae", "parameterSetIdentifier": "256", "executionEnvironment": "software-plain-ram", "mode": "gcm" }, "nistQuantumSecurityLevel": 5 }, "properties": [ { "name": "aegis:pqc_classification", "value": "SÛR / POST-QUANTUM READY" }, { "name": "aegis:location", "value": "crypto_vault.py:6" }, { "name": "aegis:recommendation", "value": "Conforme ANSSI & NIST Post-Quantique (résistant à l'algorithme de Grover avec clé 256 bits)." } ] }, { "type": "cryptographic-asset", "bom-ref": "crypto-asset-2-rsa-1024-2048", "name": "RSA-1024/2048", "description": "VULNÉRABLE AU QUANTIQUE detected at crypto_vault.py:15", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "pke", "parameterSetIdentifier": "2048", "executionEnvironment": "software-plain-ram" }, "nistQuantumSecurityLevel": 0 }, "properties": [ { "name": "aegis:pqc_classification", "value": "VULNÉRABLE AU QUANTIQUE" }, { "name": "aegis:location", "value": "crypto_vault.py:15" }, { "name": "aegis:recommendation", "value": "Vulnérable à l'algorithme de Shor sur calculateur quantique (Store Now, Decrypt Later). Planifier la migration vers ML-KEM (FIPS 203 Kyber) ou ML-DSA (FIPS 204 Dilithium)." } ] }, { "type": "cryptographic-asset", "bom-ref": "crypto-asset-3-ecdsa-secp256k1-p-256", "name": "ECDSA / Secp256k1 / P-256", "description": "VULNÉRABLE AU QUANTIQUE detected at crypto_vault.py:21", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "256", "executionEnvironment": "software-plain-ram" }, "nistQuantumSecurityLevel": 0 }, "properties": [ { "name": "aegis:pqc_classification", "value": "VULNÉRABLE AU QUANTIQUE" }, { "name": "aegis:location", "value": "crypto_vault.py:21" }, { "name": "aegis:recommendation", "value": "Courbes elliptiques classiques vulnérables à l'algorithme de Shor d'ici 2030-2035. Préparer l'agilité cryptographique vers ML-DSA (FIPS 204)." } ] }, { "type": "cryptographic-asset", "bom-ref": "crypto-asset-4-sha-256-512", "name": "SHA-256/512", "description": "SÛR / POST-QUANTUM READY detected at crypto_vault.py:30", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "256", "executionEnvironment": "software-plain-ram" }, "nistQuantumSecurityLevel": 5 }, "properties": [ { "name": "aegis:pqc_classification", "value": "SÛR / POST-QUANTUM READY" }, { "name": "aegis:location", "value": "crypto_vault.py:30" }, { "name": "aegis:recommendation", "value": "Hachage cryptographique robuste résistant aux attaques quantiques de Grover." } ] }, { "type": "cryptographic-asset", "bom-ref": "crypto-asset-5-aes-256-gcm", "name": "AES-256-GCM", "description": "SÛR / POST-QUANTUM READY detected at crypto_vault.py:31", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "ae", "parameterSetIdentifier": "256", "executionEnvironment": "software-plain-ram", "mode": "gcm" }, "nistQuantumSecurityLevel": 5 }, "properties": [ { "name": "aegis:pqc_classification", "value": "SÛR / POST-QUANTUM READY" }, { "name": "aegis:location", "value": "crypto_vault.py:31" }, { "name": "aegis:recommendation", "value": "Conforme ANSSI & NIST Post-Quantique (résistant à l'algorithme de Grover avec clé 256 bits)." } ] }, { "type": "cryptographic-asset", "bom-ref": "crypto-asset-6-aes-256-gcm", "name": "AES-256-GCM", "description": "SÛR / POST-QUANTUM READY detected at crypto_vault.py:32", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "ae", "parameterSetIdentifier": "256", "executionEnvironment": "software-plain-ram", "mode": "gcm" }, "nistQuantumSecurityLevel": 5 }, "properties": [ { "name": "aegis:pqc_classification", "value": "SÛR / POST-QUANTUM READY" }, { "name": "aegis:location", "value": "crypto_vault.py:32" }, { "name": "aegis:recommendation", "value": "Conforme ANSSI & NIST Post-Quantique (résistant à l'algorithme de Grover avec clé 256 bits)." } ] }, { "type": "cryptographic-asset", "bom-ref": "crypto-asset-7-md5", "name": "MD5", "description": "INTERDIT / CASSÉ detected at payment_gateway.py:55", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "128", "executionEnvironment": "software-plain-ram" }, "nistQuantumSecurityLevel": 0 }, "properties": [ { "name": "aegis:pqc_classification", "value": "INTERDIT / CASSÉ" }, { "name": "aegis:location", "value": "payment_gateway.py:55" }, { "name": "aegis:recommendation", "value": "Collisions triviales (CWE-328). Remplacer immédiatement par SHA-256 ou SHA3-256." } ] }, { "type": "cryptographic-asset", "bom-ref": "crypto-asset-8-sha1", "name": "SHA1", "description": "INTERDIT / CASSÉ detected at sepa_settlement.py:48", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "160", "executionEnvironment": "software-plain-ram" }, "nistQuantumSecurityLevel": 0 }, "properties": [ { "name": "aegis:pqc_classification", "value": "INTERDIT / CASSÉ" }, { "name": "aegis:location", "value": "sepa_settlement.py:48" }, { "name": "aegis:recommendation", "value": "Cassé par attaque SHAttered (CWE-328). Interdit par l'ANSSI et le NIST. Migrer vers SHA-256/SHA-512." } ] } ], "vulnerabilities": [ { "id": "CVE-2024-24762", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/PYSEC-2024-38" }, "ratings": [ { "severity": "high" } ], "description": "FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. When using form data, `python-multipart` uses a Regular Expression to parse the H", "affects": [ { "ref": "pkg:pypi/fastapi@0.109.0" } ] }, { "id": "CVE-2020-14343", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-8q59-q68h-6hv4" }, "ratings": [ { "severity": "critical" } ], "description": "Improper Input Validation in PyYAML", "affects": [ { "ref": "pkg:pypi/pyyaml@5.3.1" } ] }, { "id": "GHSA-537c-gmf6-5ccf", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-537c-gmf6-5ccf" }, "ratings": [ { "severity": "high" } ], "description": "Vulnerable OpenSSL included in cryptography wheels", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.5" } ] }, { "id": "CVE-2024-12797", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-79v4-65xg-pq4g" }, "ratings": [ { "severity": "low" } ], "description": "Vulnerable OpenSSL included in cryptography wheels", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.5" } ] }, { "id": "GHSA-h4gh-qq45-vh27", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-h4gh-qq45-vh27" }, "ratings": [ { "severity": "moderate" } ], "description": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.5" } ] }, { "id": "CVE-2026-69249", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-jwv3-5hgf-82ww" }, "ratings": [ { "severity": "high" } ], "description": "python-cryptography: Duplicate self-signed intermediates can cause exponential path-building", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.5" } ] }, { "id": "CVE-2026-34073", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-m959-cc7f-wv43" }, "ratings": [ { "severity": "low" } ], "description": "cryptography has incomplete DNS name constraint enforcement on peer names", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.5" } ] }, { "id": "CVE-2026-26007", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-r6ph-v2qm-q3c2" }, "ratings": [ { "severity": "high" } ], "description": "cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.5" } ] }, { "id": "CVE-2026-44494", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-35jp-ww65-95wh" }, "ratings": [ { "severity": "high" } ], "description": "axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`", "affects": [ { "ref": "pkg:npm/axios@1.6.7" } ] }, { "id": "CVE-2026-44495", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-3g43-6gmg-66jw" }, "ratings": [ { "severity": "high" } ], "description": "axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge", "affects": [ { "ref": "pkg:npm/axios@1.6.7" } ] }, { "id": "CVE-2025-62718", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-3p68-rc4w-qgx5" }, "ratings": [ { "severity": "moderate" } ], "description": "Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF", "affects": [ { "ref": "pkg:npm/axios@1.6.7" } ] }, { "id": "CVE-2026-42044", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-3w6x-2g7m-8v23" }, "ratings": [ { "severity": "moderate" } ], "description": "Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`", "affects": [ { "ref": "pkg:npm/axios@1.6.7" } ] }, { "id": "CVE-2026-67313", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-42h9-826w-cgv3" }, "ratings": [ { "severity": "moderate" } ], "description": "Axios: Excessive recursion in formDataToJSON can cause denial of service", "affects": [ { "ref": "pkg:npm/axios@1.6.7" } ] }, { "id": "CVE-2026-25639", "source": { "name": "OSV.dev", "url": "https://osv.dev/vulnerability/GHSA-43fc-jf86-j433" }, "ratings": [ { "severity": "high" } ], "description": "Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig", "affects": [ { "ref": "pkg:npm/axios@1.6.7" } ] } ] }