Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

merge to development #336

Merged
merged 8 commits into from
Jan 18, 2025
Merged

merge to development #336

merged 8 commits into from
Jan 18, 2025

Conversation

nam20485
Copy link
Owner

No description provided.

@nam20485 nam20485 enabled auto-merge January 18, 2025 22:48
@github-actions GitHub Actions
Copy link

github-actions bot commented Jan 18, 2025 •
edited
Loading

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
unknown/vcpkg/abseil:x64-windows 20230125.3 UnknownUnknown
unknown/vcpkg/boost-algorithm:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-align:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-array:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-asio:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-assert:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-bind:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-build:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-chrono:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-concept-check:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-config:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-container-hash:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-container:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-context:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-conversion:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-core:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-coroutine:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-date-time:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-describe:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-detail:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-exception:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-function-types:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-function:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-functional:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-fusion:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-integer:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-intrusive:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-io:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-iterator:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-lexical-cast:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-modular-build-helper:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-move:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-mp11:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-mpl:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-numeric-conversion:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-optional:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-pool:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-predef:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-preprocessor:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-range:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-ratio:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-rational:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-regex:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-smart-ptr:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-static-assert:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-system:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-throw-exception:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-tokenizer:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-tuple:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-type-traits:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-typeof:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-uninstall:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-unordered:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-utility:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-variant2:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-vcpkg-helpers:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/boost-winapi:x64-windows 1.82.0 UnknownUnknown
unknown/vcpkg/bzip2:x64-windows 1.0.8 UnknownUnknown
unknown/vcpkg/c-ares:x64-windows 1.19.0 UnknownUnknown
unknown/vcpkg/crow:x64-windows 1.0-5 UnknownUnknown
unknown/vcpkg/grpc:x64-windows 1.51.1 UnknownUnknown
unknown/vcpkg/libarchive:x64-windows 3.6.2 UnknownUnknown
unknown/vcpkg/libiconv:x64-windows 1.17 UnknownUnknown
unknown/vcpkg/liblzma:x64-windows 5.4.1 UnknownUnknown
unknown/vcpkg/libxml2:x64-windows 2.10.3 UnknownUnknown
unknown/vcpkg/lz4:x64-windows 1.9.4 UnknownUnknown
unknown/vcpkg/openssl:x64-windows 3.1.1 UnknownUnknown
unknown/vcpkg/protobuf:x64-windows 3.21.12 UnknownUnknown
unknown/vcpkg/re2:x64-windows 2023-02-01 UnknownUnknown
unknown/vcpkg/upb:x64-windows 2022-06-21 UnknownUnknown
unknown/vcpkg/vcpkg-cmake-config:x64-windows 2022-02-06 UnknownUnknown
unknown/vcpkg/vcpkg-cmake-get-vars:x64-windows 2023-03-02 UnknownUnknown
unknown/vcpkg/vcpkg-cmake:x64-windows 2023-05-04 UnknownUnknown
unknown/vcpkg/zlib:x64-windows 1.2.13 UnknownUnknown
unknown/vcpkg/zstd:x64-windows 1.5.5 UnknownUnknown

Scanned Manifest Files

vcpkg.json
  • vcpkg/abseil:x64-windows@20230125.3
  • vcpkg/boost-algorithm:x64-windows@1.82.0
  • vcpkg/boost-align:x64-windows@1.82.0
  • vcpkg/boost-array:x64-windows@1.82.0
  • vcpkg/boost-asio:x64-windows@1.82.0
  • vcpkg/boost-assert:x64-windows@1.82.0
  • vcpkg/boost-bind:x64-windows@1.82.0
  • vcpkg/boost-build:x64-windows@1.82.0
  • vcpkg/boost-chrono:x64-windows@1.82.0
  • vcpkg/boost-concept-check:x64-windows@1.82.0
  • vcpkg/boost-config:x64-windows@1.82.0
  • vcpkg/boost-container-hash:x64-windows@1.82.0
  • vcpkg/boost-container:x64-windows@1.82.0
  • vcpkg/boost-context:x64-windows@1.82.0
  • vcpkg/boost-conversion:x64-windows@1.82.0
  • vcpkg/boost-core:x64-windows@1.82.0
  • vcpkg/boost-coroutine:x64-windows@1.82.0
  • vcpkg/boost-date-time:x64-windows@1.82.0
  • vcpkg/boost-describe:x64-windows@1.82.0
  • vcpkg/boost-detail:x64-windows@1.82.0
  • vcpkg/boost-exception:x64-windows@1.82.0
  • vcpkg/boost-function-types:x64-windows@1.82.0
  • vcpkg/boost-function:x64-windows@1.82.0
  • vcpkg/boost-functional:x64-windows@1.82.0
  • vcpkg/boost-fusion:x64-windows@1.82.0
  • vcpkg/boost-integer:x64-windows@1.82.0
  • vcpkg/boost-intrusive:x64-windows@1.82.0
  • vcpkg/boost-io:x64-windows@1.82.0
  • vcpkg/boost-iterator:x64-windows@1.82.0
  • vcpkg/boost-lexical-cast:x64-windows@1.82.0
  • vcpkg/boost-modular-build-helper:x64-windows@1.82.0
  • vcpkg/boost-move:x64-windows@1.82.0
  • vcpkg/boost-mp11:x64-windows@1.82.0
  • vcpkg/boost-mpl:x64-windows@1.82.0
  • vcpkg/boost-numeric-conversion:x64-windows@1.82.0
  • vcpkg/boost-optional:x64-windows@1.82.0
  • vcpkg/boost-pool:x64-windows@1.82.0
  • vcpkg/boost-predef:x64-windows@1.82.0
  • vcpkg/boost-preprocessor:x64-windows@1.82.0
  • vcpkg/boost-range:x64-windows@1.82.0
  • vcpkg/boost-ratio:x64-windows@1.82.0
  • vcpkg/boost-rational:x64-windows@1.82.0
  • vcpkg/boost-regex:x64-windows@1.82.0
  • vcpkg/boost-smart-ptr:x64-windows@1.82.0
  • vcpkg/boost-static-assert:x64-windows@1.82.0
  • vcpkg/boost-system:x64-windows@1.82.0
  • vcpkg/boost-throw-exception:x64-windows@1.82.0
  • vcpkg/boost-tokenizer:x64-windows@1.82.0
  • vcpkg/boost-tuple:x64-windows@1.82.0
  • vcpkg/boost-type-traits:x64-windows@1.82.0
  • vcpkg/boost-typeof:x64-windows@1.82.0
  • vcpkg/boost-uninstall:x64-windows@1.82.0
  • vcpkg/boost-unordered:x64-windows@1.82.0
  • vcpkg/boost-utility:x64-windows@1.82.0
  • vcpkg/boost-variant2:x64-windows@1.82.0
  • vcpkg/boost-vcpkg-helpers:x64-windows@1.82.0
  • vcpkg/boost-winapi:x64-windows@1.82.0
  • vcpkg/bzip2:x64-windows@1.0.8
  • vcpkg/c-ares:x64-windows@1.19.0
  • vcpkg/crow:x64-windows@1.0-5
  • vcpkg/grpc:x64-windows@1.51.1
  • vcpkg/libarchive:x64-windows@3.6.2
  • vcpkg/libiconv:x64-windows@1.17
  • vcpkg/liblzma:x64-windows@5.4.1
  • vcpkg/libxml2:x64-windows@2.10.3
  • vcpkg/lz4:x64-windows@1.9.4
  • vcpkg/openssl:x64-windows@3.1.1
  • vcpkg/protobuf:x64-windows@3.21.12
  • vcpkg/re2:x64-windows@2023-02-01
  • vcpkg/upb:x64-windows@2022-06-21
  • vcpkg/vcpkg-cmake-config:x64-windows@2022-02-06
  • vcpkg/vcpkg-cmake-get-vars:x64-windows@2023-03-02
  • vcpkg/vcpkg-cmake:x64-windows@2023-05-04
  • vcpkg/zlib:x64-windows@1.2.13
  • vcpkg/zstd:x64-windows@1.5.5

@github-actions GitHub Actions
Copy link

🔍 Vulnerabilities of nam20485/odbdesign:pr-336

📦 Image Reference nam20485/odbdesign:pr-336
digestsha256:69b634e5b107ebe9bb9a8c3b06e86754b490b7c465b63faf38ec07405012fd51
vulnerabilitiescritical: 0 high: 3 medium: 2 low: 22 unspecified: 3
platformlinux/amd64
size52 MB
packages155
📦 Base Image debian:12-slim
also known as
  • 12.5-slim
  • bookworm-20240423-slim
  • bookworm-slim
digestsha256:18838d7b60723ec1548a85ae57195bd84a887b65d249f4a74698f1ab7cae4ca3
vulnerabilitiescritical: 0 high: 3 medium: 2 low: 10 unspecified: 3
critical: 0 high: 2 medium: 0 low: 0 unspecified: 2glibc 2.36-9+deb12u6 (deb)

pkg:deb/debian/glibc@2.36-9+deb12u6?os_distro=bookworm&os_name=debian&os_version=12

high : CVE--2024--33601

Affected range<2.36-9+deb12u7
Fixed version2.36-9+deb12u7
Description

nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

high : CVE--2024--33602

Affected range<2.36-9+deb12u7
Fixed version2.36-9+deb12u7
Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

unspecified : CVE--2024--33600

Affected range<2.36-9+deb12u7
Fixed version2.36-9+deb12u7
Description

nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

unspecified : CVE--2024--33599

Affected range<2.36-9+deb12u7
Fixed version2.36-9+deb12u7
Description

nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

critical: 0 high: 1 medium: 0 low: 0 unspecified: 1systemd 252.22-1~deb12u1 (deb)

pkg:deb/debian/systemd@252.22-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

high : CVE--2023--50387

Affected range<252.23-1~deb12u1
Fixed version252.23-1~deb12u1
Description

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

unspecified : CVE--2023--50868

Affected range<252.23-1~deb12u1
Fixed version252.23-1~deb12u1
Description

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

critical: 0 high: 0 medium: 2 low: 0 gnutls28 3.7.9-2+deb12u2 (deb)

pkg:deb/debian/gnutls28@3.7.9-2+deb12u2?os_distro=bookworm&os_name=debian&os_version=12

medium : CVE--2024--28834

Affected range<3.7.9-2+deb12u3
Fixed version3.7.9-2+deb12u3
Description

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

[experimental] - gnutls28 3.8.4-1

medium : CVE--2024--28835

Affected range<3.7.9-2+deb12u3
Fixed version3.7.9-2+deb12u3
Description

A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.

[experimental] - gnutls28 3.8.4-1

critical: 0 high: 0 medium: 0 low: 4 openldap 2.5.13+dfsg-5 (deb)

pkg:deb/debian/openldap@2.5.13+dfsg-5?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2020--15719

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

low : CVE--2017--17740

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

low : CVE--2017--14159

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

low : CVE--2015--3276

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

  • openldap (unimportant)
    Debian builds with GNUTLS, not NSS
critical: 0 high: 0 medium: 0 low: 3 p7zip 16.02+dfsg-8 (deb)

pkg:deb/debian/p7zip@16.02+dfsg-8?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--11612

Affected range>=16.02+dfsg-8
Fixed versionNot Fixed
Description

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.

low : CVE--2023--52169

Affected range>=16.02+dfsg-8
Fixed versionNot Fixed
Description

The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.

low : CVE--2022--47069

Affected range>=16.02+dfsg-8
Fixed versionNot Fixed
Description

p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp.

critical: 0 high: 0 medium: 0 low: 3 krb5 1.20.1-2+deb12u2 (deb)

pkg:deb/debian/krb5@1.20.1-2+deb12u2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--26461

Affected range>=1.20.1-2+deb12u2
Fixed versionNot Fixed
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

low : CVE--2024--26458

Affected range>=1.20.1-2+deb12u2
Fixed versionNot Fixed
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

low : CVE--2018--5709

Affected range>=1.20.1-2+deb12u2
Fixed versionNot Fixed
Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

critical: 0 high: 0 medium: 0 low: 2 perl 5.36.0-7+deb12u1 (deb)

pkg:deb/debian/perl@5.36.0-7+deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2023--31486

Affected range>=5.36.0-7+deb12u1
Fixed versionNot Fixed
Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

low : CVE--2011--4116

Affected range>=5.36.0-7+deb12u1
Fixed versionNot Fixed
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

critical: 0 high: 0 medium: 0 low: 2 gcc-12 12.2.0-14 (deb)

pkg:deb/debian/gcc-12@12.2.0-14?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2023--4039

Affected range>=12.2.0-14
Fixed versionNot Fixed
Description

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

low : CVE--2022--27943

Affected range>=12.2.0-14
Fixed versionNot Fixed
Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

critical: 0 high: 0 medium: 0 low: 1 shadow 1:4.13+dfsg1-1 (deb)

pkg:deb/debian/shadow@1:4.13+dfsg1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2007--5686

Affected range>=1:4.13+dfsg1-1
Fixed versionNot Fixed
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

  • shadow (unimportant)
    See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so
    unknown usernames are not recorded on login failures
critical: 0 high: 0 medium: 0 low: 1 curl 7.88.1-10+deb12u8 (deb)

pkg:deb/debian/curl@7.88.1-10+deb12u8?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--2379

Affected range>=7.88.1-10+deb12u8
Fixed versionNot Fixed
Description

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

critical: 0 high: 0 medium: 0 low: 1 openssl 3.0.15-1~deb12u1 (deb)

pkg:deb/debian/openssl@3.0.15-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2010--0928

Affected range>=3.0.11-1~deb12u2
Fixed versionNot Fixed
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
openssl/openssl#24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.2.40-1.1 (deb)

pkg:deb/debian/gnupg2@2.2.40-1.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--3219

Affected range>=2.2.40-1.1
Fixed versionNot Fixed
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

critical: 0 high: 0 medium: 0 low: 1 libgcrypt20 1.10.1-3 (deb)

pkg:deb/debian/libgcrypt20@1.10.1-3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2018--6829

Affected range>=1.10.1-3
Fixed versionNot Fixed
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 1 coreutils 9.1-1 (deb)

pkg:deb/debian/coreutils@9.1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2017--18018

Affected range>=9.1-1
Fixed versionNot Fixed
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

critical: 0 high: 0 medium: 0 low: 1 apt 2.6.1 (deb)

pkg:deb/debian/apt@2.6.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3374

Affected range>=2.6.1
Fixed versionNot Fixed
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

critical: 0 high: 0 medium: 0 low: 1 tar 1.34+dfsg-1.2+deb12u1 (deb)

pkg:deb/debian/tar@1.34+dfsg-1.2+deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2005--2541

Affected range>=1.34+dfsg-1.2+deb12u1
Fixed versionNot Fixed
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

@github-actions GitHub Actions
Copy link

Recommended fixes for image nam20485/odbdesign:pr-336

Base image is debian:12-slim

Namebookworm-20240423-slim
Digestsha256:18838d7b60723ec1548a85ae57195bd84a887b65d249f4a74698f1ab7cae4ca3
Vulnerabilitiescritical: 0 high: 3 medium: 2 low: 10 unspecified: 3
Pushed8 months ago
Size29 MB
Packages125
Flavordebian
OS12
Slim✅
The base image is also available under the supported tag(s): bookworm-slim

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.
TagDetailsPushedVulnerabilities
12-slim
Newer image for same tag
Also known as:
  • 12.9-slim
  • bookworm-slim
  • bookworm-20250113-slim
 Benefits:
  • Same OS detected
  • Newer image for same tag
  • Image is smaller by 916 KB
  • Tag was pushed more recently
  • Image contains equal number of packages
  • Tag is using slim variant
Image details:
  • Size: 28 MB
  • Flavor: debian
  • OS: 12
  • Slim: ✅
 5 days ago



Change base image

TagDetailsPushedVulnerabilities
stable-slim
Tag is preferred tag
Also known as:
  • stable-20250113-slim
 Benefits:
  • Same OS detected
  • Image is smaller by 916 KB
  • Tag is preferred tag
  • Tag was pushed more recently
  • Image contains equal number of packages
  • Tag is using slim variant
  • stable-slim was pulled 46K times last month
Image details:
  • Size: 28 MB
  • Flavor: debian
  • OS: 12
  • Slim: ✅
 5 days ago



12
Tag is latest
Also known as:
  • 12.9
  • bookworm
  • bookworm-20250113
  • latest
 Benefits:
  • Same OS detected
  • Tag was pushed more recently
  • Tag is latest
  • Image contains equal number of packages
Image details:
  • Size: 48 MB
  • Flavor: debian
  • OS: 12
 5 days ago



@github-actions GitHub Actions
Copy link

Overview

Image reference ghcr.io/nam20485/odbdesign:development-latest nam20485/odbdesign:pr-336
- digest da5b1ce01daa 69b634e5b107
- provenance e6e2faf 0645550
- vulnerabilities critical: 0 high: 3 medium: 2 low: 22 unspecified: 3 critical: 0 high: 3 medium: 2 low: 22 unspecified: 3
- platform linux/amd64 linux/amd64
- size 44 MB 52 MB (+7.2 MB)
- packages 155 155
Base Image debian:bookworm-20240423-slim
also known as:
• 12-slim
• bookworm-slim		 debian:12-slim
also known as:
• bookworm-slim
- vulnerabilities critical: 0 high: 3 medium: 2 low: 10 unspecified: 3 critical: 0 high: 3 medium: 2 low: 10 unspecified: 3
Labels (3 changes)
  • ± 3 changed
  • 7 unchanged
 org.opencontainers.image.authors=https://github.com/nam20485
-org.opencontainers.image.created=2025-01-16 20:20:34
+org.opencontainers.image.created=2025-01-18T22:52:24.741Z
 org.opencontainers.image.description=A free open source cross-platform C++ library for parsing ODB++ Design archives, accessing their data, and building net list product models. Exposed via a REST API packaged inside of a Docker image.
 org.opencontainers.image.documentation=https://github.com/nam20485/OdbDesign?tab=readme-ov-file
 org.opencontainers.image.licenses=MIT
-org.opencontainers.image.revision=e6e2faf1206ee2b70cbfee70b1dc13b9bd38e4bf
+org.opencontainers.image.revision=0645550950fd49ef8c1cf4b74ebd7240b7a26d05
 org.opencontainers.image.source=https://github.com/nam20485/OdbDesign
 org.opencontainers.image.title=OdbDesign
 org.opencontainers.image.url=https://github.com/nam20485/OdbDesign
-org.opencontainers.image.version=development-939
+org.opencontainers.image.version=pr-336

@nam20485 nam20485 disabled auto-merge January 18, 2025 23:50
@nam20485 nam20485 enabled auto-merge January 18, 2025 23:50
@nam20485 nam20485 disabled auto-merge January 18, 2025 23:51
@nam20485 nam20485 merged commit a87a2f8 into development Jan 18, 2025
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@nam20485