Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deps: Bump codecov/codecov-action from 4 to 5 #4207

Merged
merged 1 commit into from
Nov 28, 2024
Merged

Deps: Bump codecov/codecov-action from 4 to 5 #4207

merged 1 commit into from
Nov 28, 2024

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 18, 2024 •
edited
Loading

Bumps codecov/codecov-action from 4 to 5.

Release notes

Sourced from codecov/codecov-action's releases.

v5.0.0

v5 Release

v5 of the Codecov GitHub Action will use the Codecov Wrapper to encapsulate the CLI. This will help ensure that the Action gets updates quicker.

Migration Guide

The v5 release also coincides with the opt-out feature for tokens for public repositories. In the Global Upload Token section of the settings page of an organization in codecov.io, you can set the ability for Codecov to receive a coverage reports from any source. This will allow contributors or other members of a repository to upload without needing access to the Codecov token. For more details see how to upload without a token.

[!WARNING]
The following arguments have been changed

  • file (this has been deprecated in favor of files)
  • plugin (this has been deprecated in favor of plugins)

The following arguments have been added:

  • binary
  • gcov_args
  • gcov_executable
  • gcov_ignore
  • gcov_include
  • report_type
  • skip_validation
  • swift_project

You can see their usage in the action.yml file.

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

4.0.0-beta.2

Fixes

  • #1085 not adding -n if empty to do-upload command

4.0.0-beta.1

v4 represents a move from the universal uploader to the Codecov CLI. Although this will unlock new features for our users, the CLI is not yet at feature parity with the universal uploader.

Breaking Changes

  • No current support for aarch64 and alpine architectures.
  • Tokenless uploading is unsuported
  • Various arguments to the Action have been removed

3.1.4

Fixes

  • #967 Fix typo in README.md
  • #971 fix: add back in working dir
  • #969 fix: CLI option names for uploader

Dependencies

  • #970 build(deps-dev): bump @​types/node from 18.15.12 to 18.16.3
  • #979 build(deps-dev): bump @​types/node from 20.1.0 to 20.1.2
  • #981 build(deps-dev): bump @​types/node from 20.1.2 to 20.1.4

3.1.3

Fixes

  • #960 fix: allow for aarch64 build

Dependencies

  • #957 build(deps-dev): bump jest-junit from 15.0.0 to 16.0.0
  • #958 build(deps): bump openpgp from 5.7.0 to 5.8.0
  • #959 build(deps-dev): bump @​types/node from 18.15.10 to 18.15.12

3.1.2

Fixes

  • #718 Update README.md
  • #851 Remove unsupported path_to_write_report argument
  • #898 codeql-analysis.yml
  • #901 Update README to contain correct information - inputs and negate feature
  • #955 fix: add in all the extra arguments for uploader

Dependencies

  • #819 build(deps): bump openpgp from 5.4.0 to 5.5.0
  • #835 build(deps): bump node-fetch from 3.2.4 to 3.2.10
  • #840 build(deps): bump ossf/scorecard-action from 1.1.1 to 2.0.4
  • #841 build(deps): bump @​actions/core from 1.9.1 to 1.10.0
  • #843 build(deps): bump @​actions/github from 5.0.3 to 5.1.1
  • #869 build(deps): bump node-fetch from 3.2.10 to 3.3.0
  • #872 build(deps-dev): bump jest-junit from 13.2.0 to 15.0.0
  • #879 build(deps): bump decode-uri-component from 0.2.0 to 0.2.2

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot requested review from a team as code owners November 18, 2024 05:43
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 18, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Nov 18, 2024 •
edited
Loading

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA d191da7.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/codecov/codecov-action 5.*.* 🟢 7.7
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1028 out of 28 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 9Found 26/28 approved changesets -- score normalized to 9
Contributors🟢 10project has 10 contributing companies or organizations
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Vulnerabilities🟢 100 existing vulnerabilities detected

Scanned Files

  • .github/workflows/ci-js.yml

@github-actions GitHub Actions
Copy link

Conventional Commits Report

Type Number
Dependencies 1

🚀 Conventional commits found.

@dependabot dependabot bot changed the base branch from archived-main to main November 20, 2024 13:25
@dependabot dependabot bot force-pushed the dependabot/github_actions/codecov/codecov-action-5 branch 3 times, most recently from e7f4951 to c40c73a Compare November 22, 2024 14:19
@dependabot @a-h-abdelsalam
Deps: Bump codecov/codecov-action from 4 to 5
d191da7 
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4 to 5.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v4...v5)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@a-h-abdelsalam a-h-abdelsalam force-pushed the dependabot/github_actions/codecov/codecov-action-5 branch from c40c73a to d191da7 Compare November 28, 2024 13:28
@github-actions GitHub Actions
Copy link

🔍 Vulnerabilities of harbor-os.greenbone.net/community/gsa:4207-merge-amd64

📦 Image Reference harbor-os.greenbone.net/community/gsa:4207-merge-amd64
digestsha256:a0ea04741c6f3a0ac3560b2954b4249a5a8272186235f080529e62896efd88a0
vulnerabilitiescritical: 2 high: 3 medium: 3 low: 50 unspecified: 1
size67 MB
packages195
📦 Base Image greenbone/gsad:edge
digestsha256:14a3f3317e31d0d5e1e802d62f0776eb86bd165dc5a918baed3520bb4d8359d9
vulnerabilitiescritical: 2 high: 3 medium: 3 low: 49 unspecified: 1
critical: 1 high: 1 medium: 3 low: 1 unspecified: 1openssl 1.1.1w-0+deb11u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u1?os_distro=bullseye&os_name=debian&os_version=11

critical : CVE--2024--5535

Affected range<1.1.1w-0+deb11u2
Fixed version1.1.1w-0+deb11u2
EPSS Score0.04%
EPSS Percentile15th percentile
Description

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.

high : CVE--2024--4741

Affected range<1.1.1w-0+deb11u2
Fixed version1.1.1w-0+deb11u2
EPSS Score0.04%
EPSS Percentile12th percentile
Description

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use. The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use. The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use. While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

medium : CVE--2024--0727

Affected range<1.1.1w-0+deb11u2
Fixed version1.1.1w-0+deb11u2
EPSS Score0.23%
EPSS Percentile62nd percentile
Description

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

medium : CVE--2023--5678

Affected range<1.1.1w-0+deb11u2
Fixed version1.1.1w-0+deb11u2
EPSS Score0.10%
EPSS Percentile43rd percentile
Description

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

medium : CVE--2024--9143

Affected range<1.1.1w-0+deb11u2
Fixed version1.1.1w-0+deb11u2
EPSS Score0.04%
EPSS Percentile12th percentile
Description

Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an "exotic" curve encoding. The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions. Applications working with "exotic" explicit binary (GF(2^m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the above or similar APIs, may terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

low : CVE--2010--0928

Affected range>=1.1.1w-0+deb11u1
Fixed versionNot Fixed
EPSS Score0.07%
EPSS Percentile31st percentile
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

unspecified : CVE--2024--2511

Affected range<1.1.1w-0+deb11u2
Fixed version1.1.1w-0+deb11u2
EPSS Score0.04%
EPSS Percentile17th percentile
Description

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

critical: 1 high: 0 medium: 0 low: 1 glib2.0 2.66.8-1+deb11u4 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u4?os_distro=bullseye&os_name=debian&os_version=11

critical : CVE--2024--52533

Affected range<2.66.8-1+deb11u5
Fixed version2.66.8-1+deb11u5
EPSS Score0.04%
EPSS Percentile17th percentile
Description

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

low : CVE--2012--0039

Affected range>=2.66.8-1+deb11u4
Fixed versionNot Fixed
EPSS Score0.16%
EPSS Percentile53rd percentile
Description

GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.

critical: 0 high: 2 medium: 0 low: 2 perl 5.32.1-4+deb11u3 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u3?os_distro=bullseye&os_name=debian&os_version=11

high : CVE--2023--31484

Affected range<5.32.1-4+deb11u4
Fixed version5.32.1-4+deb11u4
EPSS Score0.33%
EPSS Percentile72nd percentile
Description

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

high : CVE--2020--16156

Affected range<5.32.1-4+deb11u4
Fixed version5.32.1-4+deb11u4
EPSS Score0.19%
EPSS Percentile57th percentile
Description

CPAN 2.28 allows Signature Verification Bypass.

low : CVE--2023--31486

Affected range>=5.32.1-4+deb11u3
Fixed versionNot Fixed
EPSS Score0.23%
EPSS Percentile62nd percentile
Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

low : CVE--2011--4116

Affected range>=5.32.1-4+deb11u3
Fixed versionNot Fixed
EPSS Score0.24%
EPSS Percentile65th percentile
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

critical: 0 high: 0 medium: 0 low: 7 glibc 2.31-13+deb11u11 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u11?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2019--9192

Affected range>=2.31-13+deb11u11
Fixed versionNot Fixed
EPSS Score0.11%
EPSS Percentile45th percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

low : CVE--2019--1010025

Affected range>=2.31-13+deb11u11
Fixed versionNot Fixed
EPSS Score0.35%
EPSS Percentile73rd percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.

low : CVE--2019--1010024

Affected range>=2.31-13+deb11u11
Fixed versionNot Fixed
EPSS Score3.02%
EPSS Percentile91st percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010023

Affected range>=2.31-13+deb11u11
Fixed versionNot Fixed
EPSS Score1.20%
EPSS Percentile86th percentile
Description

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010022

Affected range>=2.31-13+deb11u11
Fixed versionNot Fixed
EPSS Score0.41%
EPSS Percentile75th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2018--20796

Affected range>=2.31-13+deb11u11
Fixed versionNot Fixed
EPSS Score0.44%
EPSS Percentile76th percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

low : CVE--2010--4756

Affected range>=2.31-13+deb11u11
Fixed versionNot Fixed
EPSS Score0.82%
EPSS Percentile83rd percentile
Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

critical: 0 high: 0 medium: 0 low: 5 systemd 247.3-7+deb11u6 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u6?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2023--31439

Affected range>=247.3-7+deb11u5
Fixed versionNot Fixed
EPSS Score0.11%
EPSS Percentile45th percentile
Description

An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2023--31438

Affected range>=247.3-7+deb11u5
Fixed versionNot Fixed
EPSS Score0.11%
EPSS Percentile45th percentile
Description

An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2023--31437

Affected range>=247.3-7+deb11u5
Fixed versionNot Fixed
EPSS Score0.10%
EPSS Percentile42nd percentile
Description

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2020--13529

Affected range>=247.3-7+deb11u5
Fixed versionNot Fixed
EPSS Score0.14%
EPSS Percentile51st percentile
Description

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

low : CVE--2013--4392

Affected range>=247.3-7+deb11u5
Fixed versionNot Fixed
EPSS Score0.04%
EPSS Percentile5th percentile
Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

critical: 0 high: 0 medium: 0 low: 5 pcre3 2:8.39-13 (deb)

pkg:deb/debian/pcre3@2:8.39-13?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2019--20838

Affected range>=2:8.39-13
Fixed versionNot Fixed
EPSS Score0.98%
EPSS Percentile84th percentile
Description

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

low : CVE--2017--7246

Affected range>=2:8.39-13
Fixed versionNot Fixed
EPSS Score0.65%
EPSS Percentile80th percentile
Description

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.

low : CVE--2017--7245

Affected range>=2:8.39-13
Fixed versionNot Fixed
EPSS Score0.65%
EPSS Percentile80th percentile
Description

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.

low : CVE--2017--16231

Affected range>=2:8.39-13
Fixed versionNot Fixed
EPSS Score0.08%
EPSS Percentile37th percentile
Description

In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used

low : CVE--2017--11164

Affected range>=2:8.39-13
Fixed versionNot Fixed
EPSS Score0.37%
EPSS Percentile73rd percentile
Description

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

critical: 0 high: 0 medium: 0 low: 4 openldap 2.4.57+dfsg-3+deb11u1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-3%2Bdeb11u1?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2020--15719

Affected range>=2.4.57+dfsg-3+deb11u1
Fixed versionNot Fixed
EPSS Score0.16%
EPSS Percentile54th percentile
Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

low : CVE--2017--17740

Affected range>=2.4.57+dfsg-3+deb11u1
Fixed versionNot Fixed
EPSS Score0.41%
EPSS Percentile75th percentile
Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

low : CVE--2017--14159

Affected range>=2.4.57+dfsg-3+deb11u1
Fixed versionNot Fixed
EPSS Score0.04%
EPSS Percentile11th percentile
Description

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

low : CVE--2015--3276

Affected range>=2.4.57+dfsg-3+deb11u1
Fixed versionNot Fixed
EPSS Score0.42%
EPSS Percentile75th percentile
Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

critical: 0 high: 0 medium: 0 low: 4 libsepol 3.1-1 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2021--36087

Affected range<3.1-1+deb11u1
Fixed version3.1-1+deb11u1
EPSS Score0.07%
EPSS Percentile32nd percentile
Description

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

low : CVE--2021--36086

Affected range<3.1-1+deb11u1
Fixed version3.1-1+deb11u1
EPSS Score0.07%
EPSS Percentile31st percentile
Description

The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).

low : CVE--2021--36085

Affected range<3.1-1+deb11u1
Fixed version3.1-1+deb11u1
EPSS Score0.07%
EPSS Percentile31st percentile
Description

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).

low : CVE--2021--36084

Affected range<3.1-1+deb11u1
Fixed version3.1-1+deb11u1
EPSS Score0.10%
EPSS Percentile42nd percentile
Description

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).

critical: 0 high: 0 medium: 0 low: 3 krb5 1.18.3-6+deb11u5 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u5?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2024--26461

Affected range>=1.18.3-6+deb11u5
Fixed versionNot Fixed
EPSS Score0.04%
EPSS Percentile10th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

low : CVE--2024--26458

Affected range>=1.18.3-6+deb11u5
Fixed versionNot Fixed
EPSS Score0.04%
EPSS Percentile10th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

low : CVE--2018--5709

Affected range>=1.18.3-6+deb11u5
Fixed versionNot Fixed
EPSS Score0.10%
EPSS Percentile42nd percentile
Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

critical: 0 high: 0 medium: 0 low: 2 shadow 1:4.8.1-1 (deb)

pkg:deb/debian/shadow@1:4.8.1-1?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2013--4235

Affected range>=1:4.8.1-1
Fixed versionNot Fixed
EPSS Score0.06%
EPSS Percentile27th percentile
Description

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

low : CVE--2007--5686

Affected range>=1:4.8.1-1
Fixed versionNot Fixed
EPSS Score0.16%
EPSS Percentile53rd percentile
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

critical: 0 high: 0 medium: 0 low: 2 sqlite3 3.34.1-3+deb11u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u1?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2022--35737

Affected range>=3.34.1-3
Fixed versionNot Fixed
EPSS Score0.33%
EPSS Percentile72nd percentile
Description

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

low : CVE--2021--45346

Affected range>=3.34.1-3
Fixed versionNot Fixed
EPSS Score0.22%
EPSS Percentile61st percentile
Description

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

critical: 0 high: 0 medium: 0 low: 2 libpcap 1.10.0-2 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2024--8006

Affected range>=1.10.0-2
Fixed versionNot Fixed
EPSS Score0.04%
EPSS Percentile10th percentile
Description

Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.

low : CVE--2023--7256

Affected range>=1.10.0-2
Fixed versionNot Fixed
EPSS Score0.04%
EPSS Percentile10th percentile
Description

In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.

critical: 0 high: 0 medium: 0 low: 1 tar 1.34+dfsg-1+deb11u1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-1%2Bdeb11u1?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2005--2541

Affected range>=1.34+dfsg-1+deb11u1
Fixed versionNot Fixed
EPSS Score0.69%
EPSS Percentile81st percentile
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.36.1-8+deb11u2 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u2?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2022--0563

Affected range>=2.36.1-8+deb11u2
Fixed versionNot Fixed
EPSS Score0.05%
EPSS Percentile19th percentile
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.2.27-2+deb11u2 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u2?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2022--3219

Affected range>=2.2.27-2+deb11u2
Fixed versionNot Fixed
EPSS Score0.05%
EPSS Percentile19th percentile
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

critical: 0 high: 0 medium: 0 low: 1 gcc-9 9.3.0-22 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2023--4039

Affected range>=9.3.0-22
Fixed versionNot Fixed
EPSS Score0.06%
EPSS Percentile26th percentile
Description

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

critical: 0 high: 0 medium: 0 low: 1 libgcrypt20 1.8.7-6 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2018--6829

Affected range>=1.8.7-6
Fixed versionNot Fixed
EPSS Score0.19%
EPSS Percentile58th percentile
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 1 apt 2.2.4 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2011--3374

Affected range>=2.2.4
Fixed versionNot Fixed
EPSS Score0.17%
EPSS Percentile54th percentile
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

critical: 0 high: 0 medium: 0 low: 1 gnutls28 3.7.1-5+deb11u6 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u6?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2011--3389

Affected range>=3.7.1-5+deb11u5
Fixed versionNot Fixed
EPSS Score0.60%
EPSS Percentile79th percentile
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

critical: 0 high: 0 medium: 0 low: 1 pcre2 10.36-2+deb11u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u1?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2022--41409

Affected range>=10.36-2+deb11u1
Fixed versionNot Fixed
EPSS Score0.09%
EPSS Percentile38th percentile
Description

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

critical: 0 high: 0 medium: 0 low: 1 gcc-10 10.2.1-6 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2023--4039

Affected range>=10.2.1-6
Fixed versionNot Fixed
EPSS Score0.06%
EPSS Percentile26th percentile
Description

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

critical: 0 high: 0 medium: 0 low: 1 libxml2 2.9.10+dfsg-6.7+deb11u5 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-6.7%2Bdeb11u5?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2024--34459

Affected range>=2.9.10+dfsg-6.7+deb11u4
Fixed versionNot Fixed
EPSS Score0.04%
EPSS Percentile12th percentile
Description

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

critical: 0 high: 0 medium: 0 low: 1 hiredis 0.14.1-1 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2021--32765

Affected range>=0.14.1-1
Fixed versionNot Fixed
EPSS Score3.61%
EPSS Percentile92nd percentile
Description

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk (array-like) replies, hiredis fails to check if count * sizeof(redisReply*) can be represented in SIZE_MAX. If it can not, and the calloc() call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the maxelements context option to a value small enough that no overflow is possible.

critical: 0 high: 0 medium: 0 low: 1 coreutils 8.32-4+b1 (deb)

pkg:deb/debian/[email protected]%2Bb1?os_distro=bullseye&os_name=debian&os_version=11

low : CVE--2017--18018

Affected range>=8.32-4
Fixed versionNot Fixed
EPSS Score0.04%
EPSS Percentile5th percentile
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

@a-h-abdelsalam a-h-abdelsalam merged commit ce1cc17 into main Nov 28, 2024
18 checks passed
@a-h-abdelsalam a-h-abdelsalam deleted the dependabot/github_actions/codecov/codecov-action-5 branch November 28, 2024 13:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@a-h-abdelsalam a-h-abdelsalam a-h-abdelsalam approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@a-h-abdelsalam