Scheduled CVE vulnerability scan of published images. #33

Annotations

10 errors, 12 warnings, and 4 notices

CVE-2024-32002 - CRITICAL severity - git: Recursive clones RCE vulnerability in git

CVE-2024-32004 - HIGH severity - git: RCE while cloning local repos vulnerability in git

CVE-2024-32465 - HIGH severity - git: additional local RCE vulnerability in git

CVE-2024-2398 - HIGH severity - curl: HTTP/2 push headers memory-leak vulnerability in libcurl

CVE-2024-6197 - HIGH severity - curl: freeing stack buffer in utf8asn1str vulnerability in libcurl

CVE-2024-24790 - CRITICAL severity - golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses vulnerability in stdlib

CVE-2023-45283 - HIGH severity - The filepath package does not recognize paths with a \??\ prefix as sp ... vulnerability in stdlib

CVE-2023-45288 - HIGH severity - golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS vulnerability in stdlib

CVE-2024-24790 - CRITICAL severity - golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses vulnerability in stdlib

CVE-2023-45283 - HIGH severity - The filepath package does not recognize paths with a \??\ prefix as sp ... vulnerability in stdlib

The following actions use a deprecated Node.js version and will be forced to run on node20: github/codeql-action/upload-sarif@v2. For more info: https://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/

CVE-2023-42363 - MEDIUM severity - busybox: use-after-free in awk vulnerability in busybox

CVE-2023-42364 - MEDIUM severity - busybox: use-after-free vulnerability in busybox

CVE-2023-42365 - MEDIUM severity - busybox: use-after-free vulnerability in busybox

CVE-2023-42366 - MEDIUM severity - busybox: A heap-buffer-overflow vulnerability in busybox

CVE-2023-42363 - MEDIUM severity - busybox: use-after-free in awk vulnerability in busybox-binsh

CVE-2023-42364 - MEDIUM severity - busybox: use-after-free vulnerability in busybox-binsh

CVE-2023-42365 - MEDIUM severity - busybox: use-after-free vulnerability in busybox-binsh

CVE-2023-42366 - MEDIUM severity - busybox: A heap-buffer-overflow vulnerability in busybox-binsh

CVE-2024-4603 - MEDIUM severity - openssl: Excessive time spent checking DSA keys and parameters vulnerability in libcrypto3

CVE-2024-4741 - MEDIUM severity - openssl: Use After Free with SSL_free_buffers vulnerability in libcrypto3

CodeQL Action v2 will be deprecated on December 5th, 2024. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2024-01-12-code-scanning-deprecation-of-codeql-action-v2/

CVE-2024-32020 - LOW severity - git: insecure hardlinks vulnerability in git

CVE-2024-32021 - LOW severity - git: symlink bypass vulnerability in git

CVE-2024-2511 - LOW severity - openssl: Unbounded memory growth with session handling in TLSv1.3 vulnerability in libcrypto3

CVE-2024-2511 - LOW severity - openssl: Unbounded memory growth with session handling in TLSv1.3 vulnerability in libssl3