Skip to content

chore(master): release 2.8.13 #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Feb 18, 2025
Merged

chore(master): release 2.8.13 #95

merged 1 commit into from
Feb 18, 2025

Conversation

lotyp
Copy link
Member

@lotyp lotyp commented Feb 18, 2025

🤖 I have created a release beep boop

2.8.13 (2025-02-18)

Dependencies

  • deps: update ansible/ansible-lint action to v25.1.3 (#94) (0620610)

This PR was generated with Release Please. See documentation.

@lotyp lotyp enabled auto-merge February 18, 2025 19:54
@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:efcd3f10c98990caee52a95e87b072665daef551442651baca54b6c8610bfb60
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size104 MB
packages232
📦 Base Image php:8.1-fpm-alpine
also known as
  • 8.1-fpm-alpine3.21
  • 8.1.31-fpm-alpine
  • 8.1.31-fpm-alpine3.21
digestsha256:e30b3aefd3606bbc8c7d4f3cc9e81f1e1537c69fad067319b35f7df9faf4f3a2
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:945cd58bb58c0b7761272ca1fcdc9d163c55ccd9d1be8496de5177d1d63e8fe4
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size110 MB
packages231
📦 Base Image php:8.3-alpine
also known as
  • 8.3-alpine3.21
  • 8.3-cli-alpine
  • 8.3-cli-alpine3.21
  • 8.3.17-alpine
  • 8.3.17-alpine3.21
  • 8.3.17-cli-alpine
  • 8.3.17-cli-alpine3.21
digestsha256:ea127e2a689d87fad1696e200a02a4e4cd0e63dc07a847ef8d16f523c7110b52
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:839e34aa94fe20ee405a4400e754d87b58152a47e1fb0bd1c4a4f8da9db6fbc8
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size109 MB
packages231
📦 Base Image php:8.2-alpine
also known as
  • 8.2-alpine3.21
  • 8.2-cli-alpine
  • 8.2-cli-alpine3.21
  • 8.2.27-alpine
  • 8.2.27-alpine3.21
  • 8.2.27-cli-alpine
  • 8.2.27-cli-alpine3.21
digestsha256:6588adc21dcdfed5d5c1d294f1dc41e69cea600fa40541ff7bfe4ac9e2ef3666
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-fpm-alpine

Name8.1.31-fpm-alpine3.21
Digestsha256:e30b3aefd3606bbc8c7d4f3cc9e81f1e1537c69fad067319b35f7df9faf4f3a2
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed2 months ago
Size32 MB
Packages53
Flavoralpine
OS3.21
Runtime8.1.31
The base image is also available under the supported tag(s): 8.1-fpm-alpine3.21, 8.1.31-fpm-alpine, 8.1.31-fpm-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.3-fpm-alpine
Minor runtime version update
Also known as:
  • 8.3.17-fpm-alpine
  • 8.3.17-fpm-alpine3.21
  • 8.3-fpm-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 33 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.3.17
 5 days ago



8.2-fpm-alpine
Minor runtime version update
Also known as:
  • 8.2.27-fpm-alpine
  • 8.2.27-fpm-alpine3.21
  • 8.2-fpm-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
  • 8.2-fpm-alpine was pulled 4.1K times last month
Image details:
  • Size: 32 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.2.27
 2 months ago



8.4-fpm-alpine
Image has same number of vulnerabilities
Also known as:
  • 8.4.4-fpm-alpine
  • 8.4.4-fpm-alpine3.21
  • 8.4-fpm-alpine3.21
  • 8-fpm-alpine
  • 8-fpm-alpine3.21
  • fpm-alpine
  • fpm-alpine3.21
 Benefits:
  • Same OS detected
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 36 MB
  • Flavor: alpine
  • OS: 3.21
 4 days ago



@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-alpine

Name8.3.17-alpine3.21
Digestsha256:ea127e2a689d87fad1696e200a02a4e4cd0e63dc07a847ef8d16f523c7110b52
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed5 days ago
Size37 MB
Packages52
Flavoralpine
OS3.21
Runtime8.3.17
The base image is also available under the supported tag(s): 8.3-alpine3.21, 8.3-cli-alpine, 8.3-cli-alpine3.21, 8.3.17-alpine, 8.3.17-alpine3.21, 8.3.17-cli-alpine, 8.3.17-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.4-alpine
Minor runtime version update
Also known as:
  • 8.4.4-cli-alpine
  • 8.4.4-cli-alpine3.21
  • 8.4-cli-alpine
  • 8.4-cli-alpine3.21
  • 8-cli-alpine
  • 8-cli-alpine3.21
  • cli-alpine
  • cli-alpine3.21
  • alpine
  • alpine3.21
  • 8.4.4-alpine
  • 8.4.4-alpine3.21
  • 8.4-alpine3.21
  • 8-alpine
  • 8-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 42 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.4.4
 4 days ago



@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-alpine

Name8.2.27-alpine3.21
Digestsha256:6588adc21dcdfed5d5c1d294f1dc41e69cea600fa40541ff7bfe4ac9e2ef3666
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed2 months ago
Size36 MB
Packages52
Flavoralpine
OS3.21
Runtime8.2.27
The base image is also available under the supported tag(s): 8.2-alpine3.21, 8.2-cli-alpine, 8.2-cli-alpine3.21, 8.2.27-alpine, 8.2.27-alpine3.21, 8.2.27-cli-alpine, 8.2.27-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.4-alpine
Minor runtime version update
Also known as:
  • 8.4.4-cli-alpine
  • 8.4.4-cli-alpine3.21
  • 8.4-cli-alpine
  • 8.4-cli-alpine3.21
  • 8-cli-alpine
  • 8-cli-alpine3.21
  • cli-alpine
  • cli-alpine3.21
  • alpine
  • alpine3.21
  • 8.4.4-alpine
  • 8.4.4-alpine3.21
  • 8.4-alpine3.21
  • 8-alpine
  • 8-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 42 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.4.4
 4 days ago



8.3-alpine
Minor runtime version update
Also known as:
  • 8.3.17-cli-alpine
  • 8.3.17-cli-alpine3.21
  • 8.3-cli-alpine
  • 8.3-cli-alpine3.21
  • 8.3.17-alpine
  • 8.3.17-alpine3.21
  • 8.3-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 37 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.3.17
 5 days ago



@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:c93b2d520a40ed18227d5345dbff81ee6540b56a29302f219d11f1aec9d7d199
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size127 MB
packages249
📦 Base Image php:8.2-alpine
also known as
  • 8.2-alpine3.21
  • 8.2-cli-alpine
  • 8.2-cli-alpine3.21
  • 8.2.27-alpine
  • 8.2.27-alpine3.21
  • 8.2.27-cli-alpine
  • 8.2.27-cli-alpine3.21
digestsha256:6588adc21dcdfed5d5c1d294f1dc41e69cea600fa40541ff7bfe4ac9e2ef3666
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:55c2a7eb1c4114bf705066a670d281c5e473ece8d94f8120f512a3ebb4d00404
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size104 MB
packages232
📦 Base Image php:8.2-fpm-alpine
also known as
  • 8.2-fpm-alpine3.21
  • 8.2.27-fpm-alpine
  • 8.2.27-fpm-alpine3.21
digestsha256:57b77726f7447951a161f280689afd0212c739fb790cce8c05b536cd9c312df0
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-alpine

Name8.2.27-alpine3.21
Digestsha256:6588adc21dcdfed5d5c1d294f1dc41e69cea600fa40541ff7bfe4ac9e2ef3666
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed2 months ago
Size36 MB
Packages52
Flavoralpine
OS3.21
Runtime8.2.27
The base image is also available under the supported tag(s): 8.2-alpine3.21, 8.2-cli-alpine, 8.2-cli-alpine3.21, 8.2.27-alpine, 8.2.27-alpine3.21, 8.2.27-cli-alpine, 8.2.27-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.4-alpine
Minor runtime version update
Also known as:
  • 8.4.4-cli-alpine
  • 8.4.4-cli-alpine3.21
  • 8.4-cli-alpine
  • 8.4-cli-alpine3.21
  • 8-cli-alpine
  • 8-cli-alpine3.21
  • cli-alpine
  • cli-alpine3.21
  • alpine
  • alpine3.21
  • 8.4.4-alpine
  • 8.4.4-alpine3.21
  • 8.4-alpine3.21
  • 8-alpine
  • 8-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 42 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.4.4
 4 days ago



8.3-alpine
Minor runtime version update
Also known as:
  • 8.3.17-cli-alpine
  • 8.3.17-cli-alpine3.21
  • 8.3-cli-alpine
  • 8.3-cli-alpine3.21
  • 8.3.17-alpine
  • 8.3.17-alpine3.21
  • 8.3-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 37 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.3.17
 5 days ago



@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-fpm-alpine

Name8.2.27-fpm-alpine3.21
Digestsha256:57b77726f7447951a161f280689afd0212c739fb790cce8c05b536cd9c312df0
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed2 months ago
Size32 MB
Packages53
Flavoralpine
OS3.21
Runtime8.2.27
The base image is also available under the supported tag(s): 8.2-fpm-alpine3.21, 8.2.27-fpm-alpine, 8.2.27-fpm-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.3-fpm-alpine
Minor runtime version update
Also known as:
  • 8.3.17-fpm-alpine
  • 8.3.17-fpm-alpine3.21
  • 8.3-fpm-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 33 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.3.17
 5 days ago



8.4-fpm-alpine
Image has same number of vulnerabilities
Also known as:
  • 8.4.4-fpm-alpine
  • 8.4.4-fpm-alpine3.21
  • 8.4-fpm-alpine3.21
  • 8-fpm-alpine
  • 8-fpm-alpine3.21
  • fpm-alpine
  • fpm-alpine3.21
 Benefits:
  • Same OS detected
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 36 MB
  • Flavor: alpine
  • OS: 3.21
 4 days ago



@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:ad5a222d1e7814dcdacddcc35bc0b2d9390785a4e57b89dd84178a1bf9f6807f
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size128 MB
packages249
📦 Base Image php:8.3-alpine
also known as
  • 8.3-alpine3.21
  • 8.3-cli-alpine
  • 8.3-cli-alpine3.21
  • 8.3.17-alpine
  • 8.3.17-alpine3.21
  • 8.3.17-cli-alpine
  • 8.3.17-cli-alpine3.21
digestsha256:ea127e2a689d87fad1696e200a02a4e4cd0e63dc07a847ef8d16f523c7110b52
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:d4ceb26305a2430b2fe9c18b0c4e3060e95185477695e942a114bd99b3a56bb3
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size115 MB
packages231
📦 Base Image php:8-alpine
also known as
  • 8-alpine3.21
  • 8-cli-alpine
  • 8-cli-alpine3.21
  • 8.4-alpine
  • 8.4-alpine3.21
  • 8.4-cli-alpine
  • 8.4-cli-alpine3.21
  • 8.4.4-alpine
  • 8.4.4-alpine3.21
  • 8.4.4-cli-alpine
  • 8.4.4-cli-alpine3.21
  • alpine
  • alpine3.21
  • cli-alpine
  • cli-alpine3.21
digestsha256:07d0aaaf29fbda211038930b50fc0eadd64c5f1afbe941474771639b19df4897
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-alpine

Name8.4.4-alpine3.21
Digestsha256:07d0aaaf29fbda211038930b50fc0eadd64c5f1afbe941474771639b19df4897
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed4 days ago
Size42 MB
Packages52
Flavoralpine
OS3.21
Runtime8.4.4
The base image is also available under the supported tag(s): 8-alpine3.21, 8-cli-alpine, 8-cli-alpine3.21, 8.4-alpine, 8.4-alpine3.21, 8.4-cli-alpine, 8.4-cli-alpine3.21, 8.4.4-alpine, 8.4.4-alpine3.21, 8.4.4-cli-alpine, 8.4.4-cli-alpine3.21, alpine, alpine3.21, cli-alpine, cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-alpine

Name8.3.17-alpine3.21
Digestsha256:ea127e2a689d87fad1696e200a02a4e4cd0e63dc07a847ef8d16f523c7110b52
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed5 days ago
Size37 MB
Packages52
Flavoralpine
OS3.21
Runtime8.3.17
The base image is also available under the supported tag(s): 8.3-alpine3.21, 8.3-cli-alpine, 8.3-cli-alpine3.21, 8.3.17-alpine, 8.3.17-alpine3.21, 8.3.17-cli-alpine, 8.3.17-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.4-alpine
Minor runtime version update
Also known as:
  • 8.4.4-cli-alpine
  • 8.4.4-cli-alpine3.21
  • 8.4-cli-alpine
  • 8.4-cli-alpine3.21
  • 8-cli-alpine
  • 8-cli-alpine3.21
  • cli-alpine
  • cli-alpine3.21
  • alpine
  • alpine3.21
  • 8.4.4-alpine
  • 8.4.4-alpine3.21
  • 8.4-alpine3.21
  • 8-alpine
  • 8-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 42 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.4.4
 4 days ago



@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:35fd9d1efd0b9c216d80f9f4b9da87fbdfe616f2eed0c2e3c7c64953b084ed65
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size133 MB
packages249
📦 Base Image php:8-alpine
also known as
  • 8-alpine3.21
  • 8-cli-alpine
  • 8-cli-alpine3.21
  • 8.4-alpine
  • 8.4-alpine3.21
  • 8.4-cli-alpine
  • 8.4-cli-alpine3.21
  • 8.4.4-alpine
  • 8.4.4-alpine3.21
  • 8.4.4-cli-alpine
  • 8.4.4-cli-alpine3.21
  • alpine
  • alpine3.21
  • cli-alpine
  • cli-alpine3.21
digestsha256:07d0aaaf29fbda211038930b50fc0eadd64c5f1afbe941474771639b19df4897
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:88a3f646f9ebe41afe5128163261e5df4a8ccadc3690d0dfdfe1f6f46df20fcb
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size108 MB
packages231
📦 Base Image php:8.1-alpine
also known as
  • 8.1-alpine3.21
  • 8.1-cli-alpine
  • 8.1-cli-alpine3.21
  • 8.1.31-alpine
  • 8.1.31-alpine3.21
  • 8.1.31-cli-alpine
  • 8.1.31-cli-alpine3.21
digestsha256:69eb92899e6b7ec02f25c8ea578f1e194db34900174c4bb7e6db8ab4d287e5a1
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:ecab6ecde10db591afcba627f266890b214f57b221c116a61a9cbcbbd4bb5d7b
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size109 MB
packages232
📦 Base Image php:8-fpm-alpine
also known as
  • 8-fpm-alpine3.21
  • 8.4-fpm-alpine
  • 8.4-fpm-alpine3.21
  • 8.4.4-fpm-alpine
  • 8.4.4-fpm-alpine3.21
  • fpm-alpine
  • fpm-alpine3.21
digestsha256:24c81fd62cb348569b831d95bfc90d1fd35511d166f4537fb1cb668eff104318
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-alpine

Name8.1.31-alpine3.21
Digestsha256:69eb92899e6b7ec02f25c8ea578f1e194db34900174c4bb7e6db8ab4d287e5a1
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed2 months ago
Size36 MB
Packages52
Flavoralpine
OS3.21
Runtime8.1.31
The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.31-alpine, 8.1.31-alpine3.21, 8.1.31-cli-alpine, 8.1.31-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.4-alpine
Minor runtime version update
Also known as:
  • 8.4.4-cli-alpine
  • 8.4.4-cli-alpine3.21
  • 8.4-cli-alpine
  • 8.4-cli-alpine3.21
  • 8-cli-alpine
  • 8-cli-alpine3.21
  • cli-alpine
  • cli-alpine3.21
  • alpine
  • alpine3.21
  • 8.4.4-alpine
  • 8.4.4-alpine3.21
  • 8.4-alpine3.21
  • 8-alpine
  • 8-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 42 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.4.4
 4 days ago



8.3-alpine
Minor runtime version update
Also known as:
  • 8.3.17-cli-alpine
  • 8.3.17-cli-alpine3.21
  • 8.3-cli-alpine
  • 8.3-cli-alpine3.21
  • 8.3.17-alpine
  • 8.3.17-alpine3.21
  • 8.3-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 37 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.3.17
 5 days ago



8.2-alpine
Minor runtime version update
Also known as:
  • 8.2.27-cli-alpine
  • 8.2.27-cli-alpine3.21
  • 8.2-cli-alpine
  • 8.2-cli-alpine3.21
  • 8.2.27-alpine
  • 8.2.27-alpine3.21
  • 8.2-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
  • 8.2-alpine was pulled 1.8K times last month
Image details:
  • Size: 36 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.2.27
 2 months ago



@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-alpine

Name8.4.4-alpine3.21
Digestsha256:07d0aaaf29fbda211038930b50fc0eadd64c5f1afbe941474771639b19df4897
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed4 days ago
Size42 MB
Packages52
Flavoralpine
OS3.21
Runtime8.4.4
The base image is also available under the supported tag(s): 8-alpine3.21, 8-cli-alpine, 8-cli-alpine3.21, 8.4-alpine, 8.4-alpine3.21, 8.4-cli-alpine, 8.4-cli-alpine3.21, 8.4.4-alpine, 8.4.4-alpine3.21, 8.4.4-cli-alpine, 8.4.4-cli-alpine3.21, alpine, alpine3.21, cli-alpine, cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

@github-actions GitHub Actions
Copy link

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:386ea1022fde5b30c0f6208353586c124dc0d9f0e309c88401140541484907c4
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size127 MB
packages249
📦 Base Image php:8.1-alpine
also known as
  • 8.1-alpine3.21
  • 8.1-cli-alpine
  • 8.1-cli-alpine3.21
  • 8.1.31-alpine
  • 8.1.31-alpine3.21
  • 8.1.31-cli-alpine
  • 8.1.31-cli-alpine3.21
digestsha256:69eb92899e6b7ec02f25c8ea578f1e194db34900174c4bb7e6db8ab4d287e5a1
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 18, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-fpm-alpine

Namefpm-alpine3.21
Digestsha256:24c81fd62cb348569b831d95bfc90d1fd35511d166f4537fb1cb668eff104318
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed4 days ago
Size36 MB
Packages53
Flavoralpine
OS3.21
The base image is also available under the supported tag(s): 8-fpm-alpine3.21, 8.4-fpm-alpine, 8.4-fpm-alpine3.21, 8.4.4-fpm-alpine, 8.4.4-fpm-alpine3.21, fpm-alpine, fpm-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.3-fpm-alpine
Minor runtime version update
Also known as:
  • 8.3.17-fpm-alpine
  • 8.3.17-fpm-alpine3.21
  • 8.3-fpm-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Image is smaller by 3.3 MB
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 33 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.3.17
 5 days ago



8.2-fpm-alpine
Minor runtime version update
Also known as:
  • 8.2.27-fpm-alpine
  • 8.2.27-fpm-alpine3.21
  • 8.2-fpm-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Image is smaller by 3.9 MB
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
  • 8.2-fpm-alpine was pulled 4.1K times last month
Image details:
  • Size: 32 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.2.27
 2 months ago



8.1-fpm-alpine
Minor runtime version update
Also known as:
  • 8.1.31-fpm-alpine
  • 8.1.31-fpm-alpine3.21
  • 8.1-fpm-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Image is smaller by 4.4 MB
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
  • 8.1-fpm-alpine is the fourth most popular tag with 18K pulls per month
Image details:
  • Size: 32 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.1.31
 2 months ago



@github-actions GitHub Actions
Copy link

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:c6eea8bb6258f5248184ebd82ac6c1607a9b64ea0f9b353ef24bafbbcb54b173
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size105 MB
packages232
📦 Base Image php:8.3-fpm-alpine
also known as
  • 8.3-fpm-alpine3.21
  • 8.3.17-fpm-alpine
  • 8.3.17-fpm-alpine3.21
digestsha256:387d7e0e373648701f87b9e23c933f5a96683add325adcb7f106017e7dabc69f
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 0 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

critical: 0 high: 1 medium: 0 low: 0 golang.org/x/net 0.18.0 (golang)

pkg:golang/golang.org/x/net@0.18.0

high 8.7: CVE--2024--45338 Allocation of Resources Without Limits or Throttling

Affected range<0.33.0
Fixed version0.33.0
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.045%
EPSS Percentile18th percentile
Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

@github-actions GitHub Actions
Copy link

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-fpm-alpine

Name8.3.17-fpm-alpine3.21
Digestsha256:387d7e0e373648701f87b9e23c933f5a96683add325adcb7f106017e7dabc69f
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed5 days ago
Size33 MB
Packages53
Flavoralpine
OS3.21
Runtime8.3.17
The base image is also available under the supported tag(s): 8.3-fpm-alpine3.21, 8.3.17-fpm-alpine, 8.3.17-fpm-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.4-fpm-alpine
Image has same number of vulnerabilities
Also known as:
  • 8.4.4-fpm-alpine
  • 8.4.4-fpm-alpine3.21
  • 8.4-fpm-alpine3.21
  • 8-fpm-alpine
  • 8-fpm-alpine3.21
  • fpm-alpine
  • fpm-alpine3.21
 Benefits:
  • Same OS detected
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 36 MB
  • Flavor: alpine
  • OS: 3.21
 4 days ago



@github-actions GitHub Actions
Copy link

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-alpine

Name8.1.31-alpine3.21
Digestsha256:69eb92899e6b7ec02f25c8ea578f1e194db34900174c4bb7e6db8ab4d287e5a1
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed2 months ago
Size36 MB
Packages52
Flavoralpine
OS3.21
Runtime8.1.31
The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.31-alpine, 8.1.31-alpine3.21, 8.1.31-cli-alpine, 8.1.31-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.4-alpine
Minor runtime version update
Also known as:
  • 8.4.4-cli-alpine
  • 8.4.4-cli-alpine3.21
  • 8.4-cli-alpine
  • 8.4-cli-alpine3.21
  • 8-cli-alpine
  • 8-cli-alpine3.21
  • cli-alpine
  • cli-alpine3.21
  • alpine
  • alpine3.21
  • 8.4.4-alpine
  • 8.4.4-alpine3.21
  • 8.4-alpine3.21
  • 8-alpine
  • 8-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 42 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.4.4
 4 days ago



8.3-alpine
Minor runtime version update
Also known as:
  • 8.3.17-cli-alpine
  • 8.3.17-cli-alpine3.21
  • 8.3-cli-alpine
  • 8.3-cli-alpine3.21
  • 8.3.17-alpine
  • 8.3.17-alpine3.21
  • 8.3-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 37 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.3.17
 5 days ago



8.2-alpine
Minor runtime version update
Also known as:
  • 8.2.27-cli-alpine
  • 8.2.27-cli-alpine3.21
  • 8.2-cli-alpine
  • 8.2-cli-alpine3.21
  • 8.2.27-alpine
  • 8.2.27-alpine3.21
  • 8.2-alpine3.21
 Benefits:
  • Same OS detected
  • Minor runtime version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
  • 8.2-alpine was pulled 1.8K times last month
Image details:
  • Size: 36 MB
  • Flavor: alpine
  • OS: 3.21
  • Runtime: 8.2.27
 2 months ago



@way-finder-bot way-finder-bot self-requested a review February 18, 2025 19:56
@way-finder-bot way-finder-bot self-assigned this Feb 18, 2025
@lotyp lotyp merged commit fa135bb into master Feb 18, 2025
20 checks passed
@lotyp lotyp deleted the release-please--branches--master--components--docker-php-dev branch February 18, 2025 19:56
@lotyp
Copy link
Member Author

lotyp commented Feb 18, 2025

🤖 Created releases:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@way-finder-bot way-finder-bot way-finder-bot approved these changes

Assignees

@way-finder-bot way-finder-bot

Labels
autorelease: tagged
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@lotyp @way-finder-bot