Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

test #343

Closed
wants to merge 2 commits into from
Closed

test #343

wants to merge 2 commits into from

Conversation

nam20485
Copy link
Owner

No description provided.

@github-actions GitHub Actions
Copy link

github-actions bot commented Jan 20, 2025 •
edited
Loading

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
unknown/vcpkg/abseil:x64-windows 20240722.0 UnknownUnknown
unknown/vcpkg/asio:x64-windows 1.32.0 UnknownUnknown
unknown/vcpkg/bzip2:x64-windows 1.0.8 UnknownUnknown
unknown/vcpkg/crow:x64-windows 1.2.0 UnknownUnknown
unknown/vcpkg/libarchive:x64-windows 3.7.7 UnknownUnknown
unknown/vcpkg/libiconv:x64-windows 1.17 UnknownUnknown
unknown/vcpkg/liblzma:x64-windows 5.6.3 UnknownUnknown
unknown/vcpkg/libxml2:x64-windows 2.13.5 UnknownUnknown
unknown/vcpkg/lz4:x64-windows 1.10.0 UnknownUnknown
unknown/vcpkg/openssl:x64-windows 3.4.0 UnknownUnknown
unknown/vcpkg/protobuf:x64-windows 5.29.2 UnknownUnknown
unknown/vcpkg/utf8-range:x64-windows 5.29.1 UnknownUnknown
unknown/vcpkg/vcpkg-cmake-config:x64-windows 2024-05-23 UnknownUnknown
unknown/vcpkg/vcpkg-cmake-get-vars:x64-windows 2024-09-22 UnknownUnknown
unknown/vcpkg/vcpkg-cmake:x64-windows 2024-04-23 UnknownUnknown
unknown/vcpkg/zlib:x64-windows 1.3.1 UnknownUnknown
unknown/vcpkg/zstd:x64-windows 1.5.6 UnknownUnknown

Scanned Manifest Files

vcpkg.json
  • vcpkg/abseil:x64-windows@20240722.0
  • vcpkg/asio:x64-windows@1.32.0
  • vcpkg/bzip2:x64-windows@1.0.8
  • vcpkg/crow:x64-windows@1.2.0
  • vcpkg/libarchive:x64-windows@3.7.7
  • vcpkg/libiconv:x64-windows@1.17
  • vcpkg/liblzma:x64-windows@5.6.3
  • vcpkg/libxml2:x64-windows@2.13.5
  • vcpkg/lz4:x64-windows@1.10.0
  • vcpkg/openssl:x64-windows@3.4.0
  • vcpkg/protobuf:x64-windows@5.29.2
  • vcpkg/utf8-range:x64-windows@5.29.1
  • vcpkg/vcpkg-cmake-config:x64-windows@2024-05-23
  • vcpkg/vcpkg-cmake-get-vars:x64-windows@2024-09-22
  • vcpkg/vcpkg-cmake:x64-windows@2024-04-23
  • vcpkg/zlib:x64-windows@1.3.1
  • vcpkg/zstd:x64-windows@1.5.6

@nam20485 nam20485 closed this Jan 20, 2025
@github-actions GitHub Actions
Copy link

github-actions bot commented Jan 20, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of nam20485/odbdesign:pr-343

📦 Image Reference nam20485/odbdesign:pr-343
digestsha256:43b37b16ccd65f9eb6750e76eca5edb054487da53137a99729d2b2c553b45fd2
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 23
platformlinux/amd64
size52 MB
packages155
📦 Base Image debian:12-slim
also known as
  • 12.6-slim
  • bookworm-20240722-slim
  • bookworm-slim
digestsha256:16112ae93b810eb1ec6d1db6e01835d2444c8ca99aa678e03dd104ea3ec68408
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 11
critical: 0 high: 0 medium: 0 low: 4 openldap 2.5.13+dfsg-5 (deb)

pkg:deb/debian/openldap@2.5.13+dfsg-5?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2020--15719

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

low : CVE--2017--17740

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

low : CVE--2017--14159

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

low : CVE--2015--3276

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

  • openldap (unimportant)
    Debian builds with GNUTLS, not NSS
critical: 0 high: 0 medium: 0 low: 3 p7zip 16.02+dfsg-8 (deb)

pkg:deb/debian/p7zip@16.02+dfsg-8?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--11612

Affected range>=16.02+dfsg-8
Fixed versionNot Fixed
Description

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.

low : CVE--2023--52169

Affected range>=16.02+dfsg-8
Fixed versionNot Fixed
Description

The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.

low : CVE--2022--47069

Affected range>=16.02+dfsg-8
Fixed versionNot Fixed
Description

p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp.

critical: 0 high: 0 medium: 0 low: 3 krb5 1.20.1-2+deb12u2 (deb)

pkg:deb/debian/krb5@1.20.1-2+deb12u2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--26461

Affected range>=1.20.1-2+deb12u2
Fixed versionNot Fixed
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

low : CVE--2024--26458

Affected range>=1.20.1-2+deb12u2
Fixed versionNot Fixed
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

low : CVE--2018--5709

Affected range>=1.20.1-2+deb12u2
Fixed versionNot Fixed
Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

critical: 0 high: 0 medium: 0 low: 2 gcc-12 12.2.0-14 (deb)

pkg:deb/debian/gcc-12@12.2.0-14?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2023--4039

Affected range>=12.2.0-14
Fixed versionNot Fixed
Description

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

low : CVE--2022--27943

Affected range>=12.2.0-14
Fixed versionNot Fixed
Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

critical: 0 high: 0 medium: 0 low: 2 perl 5.36.0-7+deb12u1 (deb)

pkg:deb/debian/perl@5.36.0-7+deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2023--31486

Affected range>=5.36.0-7+deb12u1
Fixed versionNot Fixed
Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

low : CVE--2011--4116

Affected range>=5.36.0-7+deb12u1
Fixed versionNot Fixed
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

critical: 0 high: 0 medium: 0 low: 1 coreutils 9.1-1 (deb)

pkg:deb/debian/coreutils@9.1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2017--18018

Affected range>=9.1-1
Fixed versionNot Fixed
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

critical: 0 high: 0 medium: 0 low: 1 gnutls28 3.7.9-2+deb12u3 (deb)

pkg:deb/debian/gnutls28@3.7.9-2+deb12u3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3389

Affected range>=3.7.9-2+deb12u3
Fixed versionNot Fixed
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

critical: 0 high: 0 medium: 0 low: 1 curl 7.88.1-10+deb12u8 (deb)

pkg:deb/debian/curl@7.88.1-10+deb12u8?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--2379

Affected range>=7.88.1-10+deb12u8
Fixed versionNot Fixed
Description

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.2.40-1.1 (deb)

pkg:deb/debian/gnupg2@2.2.40-1.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--3219

Affected range>=2.2.40-1.1
Fixed versionNot Fixed
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

critical: 0 high: 0 medium: 0 low: 1 libgcrypt20 1.10.1-3 (deb)

pkg:deb/debian/libgcrypt20@1.10.1-3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2018--6829

Affected range>=1.10.1-3
Fixed versionNot Fixed
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 1 tar 1.34+dfsg-1.2+deb12u1 (deb)

pkg:deb/debian/tar@1.34+dfsg-1.2+deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2005--2541

Affected range>=1.34+dfsg-1.2+deb12u1
Fixed versionNot Fixed
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

critical: 0 high: 0 medium: 0 low: 1 openssl 3.0.15-1~deb12u1 (deb)

pkg:deb/debian/openssl@3.0.15-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2010--0928

Affected range>=3.0.11-1~deb12u2
Fixed versionNot Fixed
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
openssl/openssl#24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

critical: 0 high: 0 medium: 0 low: 1 shadow 1:4.13+dfsg1-1 (deb)

pkg:deb/debian/shadow@1:4.13+dfsg1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2007--5686

Affected range>=1:4.13+dfsg1-1
Fixed versionNot Fixed
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

  • shadow (unimportant)
    See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so
    unknown usernames are not recorded on login failures
critical: 0 high: 0 medium: 0 low: 1 apt 2.6.1 (deb)

pkg:deb/debian/apt@2.6.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3374

Affected range>=2.6.1
Fixed versionNot Fixed
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

@github-actions GitHub Actions
Copy link

github-actions bot commented Jan 20, 2025 •
edited
Loading

Outdated

Recommended fixes for image nam20485/odbdesign:pr-343

Base image is debian:12-slim

Namebookworm-20240722-slim
Digestsha256:16112ae93b810eb1ec6d1db6e01835d2444c8ca99aa678e03dd104ea3ec68408
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 11
Pushed6 months ago
Size29 MB
Packages125
Flavordebian
OS12
Slim✅
The base image is also available under the supported tag(s): bookworm-slim

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.
TagDetailsPushedVulnerabilities
12-slim
Newer image for same tag
Also known as:
  • 12.9-slim
  • bookworm-slim
  • bookworm-20250113-slim
 Benefits:
  • Same OS detected
  • Newer image for same tag
  • Image is smaller by 892 KB
  • Tag was pushed more recently
  • Image contains equal number of packages
  • Tag is using slim variant
Image details:
  • Size: 28 MB
  • Flavor: debian
  • OS: 12
  • Slim: ✅
 1 week ago



Change base image

TagDetailsPushedVulnerabilities
stable-slim
Tag is preferred tag
Also known as:
  • stable-20250113-slim
 Benefits:
  • Same OS detected
  • Image is smaller by 892 KB
  • Tag is preferred tag
  • Tag was pushed more recently
  • Image contains equal number of packages
  • Tag is using slim variant
  • stable-slim was pulled 46K times last month
Image details:
  • Size: 28 MB
  • Flavor: debian
  • OS: 12
  • Slim: ✅
 1 week ago



12
Tag is latest
Also known as:
  • 12.9
  • bookworm
  • bookworm-20250113
  • latest
 Benefits:
  • Same OS detected
  • Tag was pushed more recently
  • Tag is latest
  • Image contains equal number of packages
Image details:
  • Size: 48 MB
  • Flavor: debian
  • OS: 12
 1 week ago



@github-actions GitHub Actions
Copy link

github-actions bot commented Jan 20, 2025 •
edited
Loading

Overview

Image reference ghcr.io/nam20485/odbdesign:development-latest nam20485/odbdesign:pr-343
- digest bc3f3171e31c 72ec0456b66f
- provenance f019937 24533d5
- vulnerabilities critical: 0 high: 0 medium: 0 low: 23 critical: 0 high: 0 medium: 0 low: 23
- platform linux/amd64 linux/amd64
- size 46 MB 52 MB (+5.6 MB)
- packages 155 155
Base Image debian:bookworm-20240722-slim
also known as:
• 12-slim
• bookworm-slim		 debian:12-slim
also known as:
• bookworm-slim
- vulnerabilities critical: 0 high: 0 medium: 0 low: 11 critical: 0 high: 0 medium: 0 low: 11
Labels (3 changes)
  • ± 3 changed
  • 7 unchanged
 org.opencontainers.image.authors=https://github.com/nam20485
-org.opencontainers.image.created=2025-01-19 19:11:22
+org.opencontainers.image.created=2025-01-20T21:55:09.528Z
 org.opencontainers.image.description=A free open source cross-platform C++ library for parsing ODB++ Design archives, accessing their data, and building net list product models. Exposed via a REST API packaged inside of a Docker image.
 org.opencontainers.image.documentation=https://github.com/nam20485/OdbDesign?tab=readme-ov-file
 org.opencontainers.image.licenses=MIT
-org.opencontainers.image.revision=f01993777e857693d3e5ed837c59f8c45158db38
+org.opencontainers.image.revision=24533d52205a170dc7d2f9196223ef1bd9bd2564
 org.opencontainers.image.source=https://github.com/nam20485/OdbDesign
 org.opencontainers.image.title=OdbDesign
 org.opencontainers.image.url=https://github.com/nam20485/OdbDesign
-org.opencontainers.image.version=development-946
+org.opencontainers.image.version=pr-343

@github-actions GitHub Actions
Copy link

🔍 Vulnerabilities of nam20485/odbdesign:pr-343

📦 Image Reference nam20485/odbdesign:pr-343
digestsha256:72ec0456b66fb0d1b4bef4ef3a5739653ebcd9d2b312a17262f66aaa23d5861e
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 23
platformlinux/amd64
size52 MB
packages155
📦 Base Image debian:12-slim
also known as
  • 12.6-slim
  • bookworm-20240722-slim
  • bookworm-slim
digestsha256:16112ae93b810eb1ec6d1db6e01835d2444c8ca99aa678e03dd104ea3ec68408
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 11
critical: 0 high: 0 medium: 0 low: 4 openldap 2.5.13+dfsg-5 (deb)

pkg:deb/debian/openldap@2.5.13+dfsg-5?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2020--15719

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

low : CVE--2017--17740

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

low : CVE--2017--14159

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

low : CVE--2015--3276

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

  • openldap (unimportant)
    Debian builds with GNUTLS, not NSS
critical: 0 high: 0 medium: 0 low: 3 p7zip 16.02+dfsg-8 (deb)

pkg:deb/debian/p7zip@16.02+dfsg-8?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--11612

Affected range>=16.02+dfsg-8
Fixed versionNot Fixed
Description

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.

low : CVE--2023--52169

Affected range>=16.02+dfsg-8
Fixed versionNot Fixed
Description

The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.

low : CVE--2022--47069

Affected range>=16.02+dfsg-8
Fixed versionNot Fixed
Description

p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp.

critical: 0 high: 0 medium: 0 low: 3 krb5 1.20.1-2+deb12u2 (deb)

pkg:deb/debian/krb5@1.20.1-2+deb12u2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--26461

Affected range>=1.20.1-2+deb12u2
Fixed versionNot Fixed
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

low : CVE--2024--26458

Affected range>=1.20.1-2+deb12u2
Fixed versionNot Fixed
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

low : CVE--2018--5709

Affected range>=1.20.1-2+deb12u2
Fixed versionNot Fixed
Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

critical: 0 high: 0 medium: 0 low: 2 perl 5.36.0-7+deb12u1 (deb)

pkg:deb/debian/perl@5.36.0-7+deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2023--31486

Affected range>=5.36.0-7+deb12u1
Fixed versionNot Fixed
Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

low : CVE--2011--4116

Affected range>=5.36.0-7+deb12u1
Fixed versionNot Fixed
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

critical: 0 high: 0 medium: 0 low: 2 gcc-12 12.2.0-14 (deb)

pkg:deb/debian/gcc-12@12.2.0-14?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2023--4039

Affected range>=12.2.0-14
Fixed versionNot Fixed
Description

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

low : CVE--2022--27943

Affected range>=12.2.0-14
Fixed versionNot Fixed
Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

critical: 0 high: 0 medium: 0 low: 1 curl 7.88.1-10+deb12u8 (deb)

pkg:deb/debian/curl@7.88.1-10+deb12u8?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--2379

Affected range>=7.88.1-10+deb12u8
Fixed versionNot Fixed
Description

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.2.40-1.1 (deb)

pkg:deb/debian/gnupg2@2.2.40-1.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--3219

Affected range>=2.2.40-1.1
Fixed versionNot Fixed
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

critical: 0 high: 0 medium: 0 low: 1 libgcrypt20 1.10.1-3 (deb)

pkg:deb/debian/libgcrypt20@1.10.1-3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2018--6829

Affected range>=1.10.1-3
Fixed versionNot Fixed
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 1 shadow 1:4.13+dfsg1-1 (deb)

pkg:deb/debian/shadow@1:4.13+dfsg1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2007--5686

Affected range>=1:4.13+dfsg1-1
Fixed versionNot Fixed
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

  • shadow (unimportant)
    See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so
    unknown usernames are not recorded on login failures
critical: 0 high: 0 medium: 0 low: 1 openssl 3.0.15-1~deb12u1 (deb)

pkg:deb/debian/openssl@3.0.15-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2010--0928

Affected range>=3.0.11-1~deb12u2
Fixed versionNot Fixed
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
openssl/openssl#24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

critical: 0 high: 0 medium: 0 low: 1 apt 2.6.1 (deb)

pkg:deb/debian/apt@2.6.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3374

Affected range>=2.6.1
Fixed versionNot Fixed
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

critical: 0 high: 0 medium: 0 low: 1 gnutls28 3.7.9-2+deb12u3 (deb)

pkg:deb/debian/gnutls28@3.7.9-2+deb12u3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3389

Affected range>=3.7.9-2+deb12u3
Fixed versionNot Fixed
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

critical: 0 high: 0 medium: 0 low: 1 tar 1.34+dfsg-1.2+deb12u1 (deb)

pkg:deb/debian/tar@1.34+dfsg-1.2+deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2005--2541

Affected range>=1.34+dfsg-1.2+deb12u1
Fixed versionNot Fixed
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

critical: 0 high: 0 medium: 0 low: 1 coreutils 9.1-1 (deb)

pkg:deb/debian/coreutils@9.1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2017--18018

Affected range>=9.1-1
Fixed versionNot Fixed
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

@github-actions GitHub Actions
Copy link

Recommended fixes for image nam20485/odbdesign:pr-343

Base image is debian:12-slim

Namebookworm-20240722-slim
Digestsha256:16112ae93b810eb1ec6d1db6e01835d2444c8ca99aa678e03dd104ea3ec68408
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 11
Pushed6 months ago
Size29 MB
Packages125
Flavordebian
OS12
Slim✅
The base image is also available under the supported tag(s): bookworm-slim

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.
TagDetailsPushedVulnerabilities
12-slim
Newer image for same tag
Also known as:
  • 12.9-slim
  • bookworm-slim
  • bookworm-20250113-slim
 Benefits:
  • Same OS detected
  • Newer image for same tag
  • Image is smaller by 892 KB
  • Tag was pushed more recently
  • Image contains equal number of packages
  • Tag is using slim variant
Image details:
  • Size: 28 MB
  • Flavor: debian
  • OS: 12
  • Slim: ✅
 1 week ago



Change base image

TagDetailsPushedVulnerabilities
stable-slim
Tag is preferred tag
Also known as:
  • stable-20250113-slim
 Benefits:
  • Same OS detected
  • Image is smaller by 892 KB
  • Tag is preferred tag
  • Tag was pushed more recently
  • Image contains equal number of packages
  • Tag is using slim variant
  • stable-slim was pulled 46K times last month
Image details:
  • Size: 28 MB
  • Flavor: debian
  • OS: 12
  • Slim: ✅
 1 week ago



12
Tag is latest
Also known as:
  • 12.9
  • bookworm
  • bookworm-20250113
  • latest
 Benefits:
  • Same OS detected
  • Tag was pushed more recently
  • Tag is latest
  • Image contains equal number of packages
Image details:
  • Size: 48 MB
  • Flavor: debian
  • OS: 12
 1 week ago



Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@nam20485