Open dependabot[bot] opened 3 months ago
This will fix the following vulnerabilities (severity moderate, low) highlighted in https://github.com/platform9/luigi/security
trilokk@FVFFJ0RPQ05F ~ % trivy image alpine:3.19 --scanners=vuln
2024-05-28T13:33:25+05:30 INFO Vulnerability scanning is enabled
2024-05-28T13:33:28+05:30 INFO Detected OS family="alpine" version="3.19.1"
2024-05-28T13:33:28+05:30 INFO [alpine] Detecting vulnerabilities... os_version="3.19" repository="3.19" pkg_num=15
2024-05-28T13:33:28+05:30 INFO Number of language-specific files num=0
alpine:3.19 (alpine 3.19.1)
Total: 10 (UNKNOWN: 0, LOW: 2, MEDIUM: 8, HIGH: 0, CRITICAL: 0)
┌───────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├───────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ busybox │ CVE-2023-42363 │ MEDIUM │ fixed │ 1.36.1-r15 │ 1.36.1-r17 │ busybox: use-after-free in awk │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-42363 │
│ ├────────────────┤ │ │ ├───────────────┼───────────────────────────────────────────────────────────┤
│ │ CVE-2023-42366 │ │ │ │ 1.36.1-r16 │ busybox: A heap-buffer-overflow │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-42366 │
├───────────────┼────────────────┤ │ │ ├───────────────┼───────────────────────────────────────────────────────────┤
│ busybox-binsh │ CVE-2023-42363 │ │ │ │ 1.36.1-r17 │ busybox: use-after-free in awk │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-42363 │
│ ├────────────────┤ │ │ ├───────────────┼───────────────────────────────────────────────────────────┤
│ │ CVE-2023-42366 │ │ │ │ 1.36.1-r16 │ busybox: A heap-buffer-overflow │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-42366 │
├───────────────┼────────────────┤ │ ├───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ libcrypto3 │ CVE-2024-4603 │ │ │ 3.1.4-r5 │ 3.1.5-r0 │ openssl: Excessive time spent checking DSA keys and │
│ │ │ │ │ │ │ parameters │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-4603 │
│ ├────────────────┼──────────┤ │ ├───────────────┼───────────────────────────────────────────────────────────┤
│ │ CVE-2024-2511 │ LOW │ │ │ 3.1.4-r6 │ openssl: Unbounded memory growth with session handling in │
│ │ │ │ │ │ │ TLSv1.3 │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-2511 │
├───────────────┼────────────────┼──────────┤ │ ├───────────────┼───────────────────────────────────────────────────────────┤
│ libssl3 │ CVE-2024-4603 │ MEDIUM │ │ │ 3.1.5-r0 │ openssl: Excessive time spent checking DSA keys and │
│ │ │ │ │ │ │ parameters │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-4603 │
│ ├────────────────┼──────────┤ │ ├───────────────┼───────────────────────────────────────────────────────────┤
│ │ CVE-2024-2511 │ LOW │ │ │ 3.1.4-r6 │ openssl: Unbounded memory growth with session handling in │
│ │ │ │ │ │ │ TLSv1.3 │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-2511 │
├───────────────┼────────────────┼──────────┤ ├───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ ssl_client │ CVE-2023-42363 │ MEDIUM │ │ 1.36.1-r15 │ 1.36.1-r17 │ busybox: use-after-free in awk │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-42363 │
│ ├────────────────┤ │ │ ├───────────────┼───────────────────────────────────────────────────────────┤
│ │ CVE-2023-42366 │ │ │ │ 1.36.1-r16 │ busybox: A heap-buffer-overflow │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-42366 │
└───────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘
trilokk@FVFFJ0RPQ05F ~ % trivy image alpine:3.20 --scanners=vuln
2024-05-28T13:34:09+05:30 INFO Vulnerability scanning is enabled
2024-05-28T13:34:13+05:30 INFO Detected OS family="alpine" version="3.20.0"
2024-05-28T13:34:13+05:30 WARN This OS version is not on the EOL list family="alpine" version="3.20"
2024-05-28T13:34:13+05:30 INFO [alpine] Detecting vulnerabilities... os_version="3.20" repository="3.20" pkg_num=14
2024-05-28T13:34:13+05:30 INFO Number of language-specific files num=0
alpine:3.20 (alpine 3.20.0)
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
@dependabot rebase
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!
If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate
.
Bumps alpine from 3.19 to 3.20.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show