Scheduled CVE vulnerability scan of published images. #33

Annotations

1 error, 12 warnings, and 2 notices

CVE-2024-24790 - CRITICAL severity - golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses vulnerability in stdlib

The following actions use a deprecated Node.js version and will be forced to run on node20: github/codeql-action/upload-sarif@v2. For more info: https://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/

CVE-2023-42363 - MEDIUM severity - busybox: use-after-free in awk vulnerability in busybox

CVE-2023-42364 - MEDIUM severity - busybox: use-after-free vulnerability in busybox

CVE-2023-42365 - MEDIUM severity - busybox: use-after-free vulnerability in busybox

CVE-2023-42366 - MEDIUM severity - busybox: A heap-buffer-overflow vulnerability in busybox

CVE-2023-42363 - MEDIUM severity - busybox: use-after-free in awk vulnerability in busybox-binsh

CVE-2023-42364 - MEDIUM severity - busybox: use-after-free vulnerability in busybox-binsh

CVE-2023-42365 - MEDIUM severity - busybox: use-after-free vulnerability in busybox-binsh

CVE-2023-42366 - MEDIUM severity - busybox: A heap-buffer-overflow vulnerability in busybox-binsh

CVE-2024-4603 - MEDIUM severity - openssl: Excessive time spent checking DSA keys and parameters vulnerability in libcrypto3

CVE-2024-4741 - MEDIUM severity - openssl: Use After Free with SSL_free_buffers vulnerability in libcrypto3

CodeQL Action v2 will be deprecated on December 5th, 2024. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2024-01-12-code-scanning-deprecation-of-codeql-action-v2/

CVE-2024-2511 - LOW severity - openssl: Unbounded memory growth with session handling in TLSv1.3 vulnerability in libcrypto3

CVE-2024-2511 - LOW severity - openssl: Unbounded memory growth with session handling in TLSv1.3 vulnerability in libssl3