Skip to content

Instantly share code, notes, and snippets.

@Starttoaster

Starttoaster/trivy output

Created March 13, 2022 02:12
Show Gist options
  • Save Starttoaster/c6ecc1abc27bec82fb397c8349908166 to your computer and use it in GitHub Desktop.
Save Starttoaster/c6ecc1abc27bec82fb397c8349908166 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
trivy output
2022-03-13T02:10:43.932Z INFO Need to update DB
2022-03-13T02:10:43.932Z INFO Downloading DB...
29.91 MiB / 29.91 MiB [---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 23.00 MiB p/s 1.5s
2022-03-13T02:10:51.051Z INFO Detected OS: debian
2022-03-13T02:10:51.051Z INFO Detecting Debian vulnerabilities...
2022-03-13T02:10:51.058Z INFO Number of language-specific files: 2
2022-03-13T02:10:51.058Z INFO Detecting python-pkg vulnerabilities...
2022-03-13T02:10:51.060Z INFO Detecting node-pkg vulnerabilities...
ghcr.io/chia-network/chia:latest (debian 11.2)
==============================================
Total: 104 (UNKNOWN: 0, LOW: 80, MEDIUM: 10, HIGH: 6, CRITICAL: 8)
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| apt | CVE-2011-3374 | LOW | 2.2.4 | | It was found that apt-key in apt, |
| | | | | | all versions, do not correctly... |
| | | | | | -->avd.aquasec.com/nvd/cve-2011-3374 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| bsdutils | CVE-2022-0563 | | 2.36.1-8+deb11u1 | | util-linux: partial disclosure |
| | | | | | of arbitrary files in chfn |
| | | | | | and chsh when compiled... |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-0563 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| coreutils | CVE-2016-2781 | | 8.32-4 | | coreutils: Non-privileged |
| | | | | | session can escape to the |
| | | | | | parent session in chroot |
| | | | | | -->avd.aquasec.com/nvd/cve-2016-2781 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2017-18018 | | | | coreutils: race condition |
| | | | | | vulnerability in chown and chgrp |
| | | | | | -->avd.aquasec.com/nvd/cve-2017-18018 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| curl | CVE-2021-22945 | CRITICAL | 7.74.0-1.3+deb11u1 | | curl: use-after-free and |
| | | | | | double-free in MQTT sending |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22945 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-22946 | HIGH | | | curl: Requirement to use |
| | | | | | TLS not properly enforced |
| | | | | | for IMAP, POP3, and... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22946 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-22947 | MEDIUM | | | curl: Server responses |
| | | | | | received before STARTTLS |
| | | | | | processed after TLS handshake |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22947 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-22898 | LOW | | | curl: TELNET stack |
| | | | | | contents disclosure |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22898 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-22922 | | | | curl: Content not matching hash |
| | | | | | in Metalink is not being discarded |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22922 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-22923 | | | | curl: Metalink download |
| | | | | | sends credentials |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22923 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-22924 | | | | curl: Bad connection reuse |
| | | | | | due to flawed path name checks |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22924 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libapt-pkg6.0 | CVE-2011-3374 | | 2.2.4 | | It was found that apt-key in apt, |
| | | | | | all versions, do not correctly... |
| | | | | | -->avd.aquasec.com/nvd/cve-2011-3374 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libblkid1 | CVE-2022-0563 | | 2.36.1-8+deb11u1 | | util-linux: partial disclosure |
| | | | | | of arbitrary files in chfn |
| | | | | | and chsh when compiled... |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-0563 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| libc-bin | CVE-2021-33574 | CRITICAL | 2.31-13+deb11u2 | | glibc: mq_notify does |
| | | | | | not handle separately |
| | | | | | allocated thread attributes |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-33574 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2022-23218 | | | | glibc: Stack-based buffer overflow |
| | | | | | in svcunix_create via long pathnames |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-23218 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2022-23219 | | | | glibc: Stack-based buffer |
| | | | | | overflow in sunrpc clnt_create |
| | | | | | via a long pathname |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-23219 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-3999 | HIGH | | | glibc: Off-by-one buffer |
| | | | | | overflow/underflow in getcwd() |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-3999 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-3998 | MEDIUM | | | glibc: Unexpected return |
| | | | | | value from realpath() could |
| | | | | | leak data based on the... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-3998 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2010-4756 | LOW | | | glibc: glob implementation |
| | | | | | can cause excessive CPU and |
| | | | | | memory consumption due to... |
| | | | | | -->avd.aquasec.com/nvd/cve-2010-4756 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2018-20796 | | | | glibc: uncontrolled recursion in |
| | | | | | function check_dst_limits_calc_pos_1 |
| | | | | | in posix/regexec.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2018-20796 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-1010022 | | | | glibc: stack guard protection bypass |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-1010022 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-1010023 | | | | glibc: running ldd on malicious ELF |
| | | | | | leads to code execution because of... |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-1010023 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-1010024 | | | | glibc: ASLR bypass using |
| | | | | | cache of thread stack and heap |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-1010024 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-1010025 | | | | glibc: information disclosure of heap |
| | | | | | addresses of pthread_created thread |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-1010025 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-9192 | | | | glibc: uncontrolled recursion in |
| | | | | | function check_dst_limits_calc_pos_1 |
| | | | | | in posix/regexec.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-9192 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-43396 | | | | glibc: conversion from |
| | | | | | ISO-2022-JP-3 with iconv may |
| | | | | | emit spurious NUL character on... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-43396 |
+------------------+------------------+----------+ +---------------+-----------------------------------------+
| libc6 | CVE-2021-33574 | CRITICAL | | | glibc: mq_notify does |
| | | | | | not handle separately |
| | | | | | allocated thread attributes |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-33574 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2022-23218 | | | | glibc: Stack-based buffer overflow |
| | | | | | in svcunix_create via long pathnames |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-23218 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2022-23219 | | | | glibc: Stack-based buffer |
| | | | | | overflow in sunrpc clnt_create |
| | | | | | via a long pathname |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-23219 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-3999 | HIGH | | | glibc: Off-by-one buffer |
| | | | | | overflow/underflow in getcwd() |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-3999 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-3998 | MEDIUM | | | glibc: Unexpected return |
| | | | | | value from realpath() could |
| | | | | | leak data based on the... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-3998 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2010-4756 | LOW | | | glibc: glob implementation |
| | | | | | can cause excessive CPU and |
| | | | | | memory consumption due to... |
| | | | | | -->avd.aquasec.com/nvd/cve-2010-4756 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2018-20796 | | | | glibc: uncontrolled recursion in |
| | | | | | function check_dst_limits_calc_pos_1 |
| | | | | | in posix/regexec.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2018-20796 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-1010022 | | | | glibc: stack guard protection bypass |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-1010022 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-1010023 | | | | glibc: running ldd on malicious ELF |
| | | | | | leads to code execution because of... |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-1010023 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-1010024 | | | | glibc: ASLR bypass using |
| | | | | | cache of thread stack and heap |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-1010024 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-1010025 | | | | glibc: information disclosure of heap |
| | | | | | addresses of pthread_created thread |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-1010025 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-9192 | | | | glibc: uncontrolled recursion in |
| | | | | | function check_dst_limits_calc_pos_1 |
| | | | | | in posix/regexec.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-9192 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-43396 | | | | glibc: conversion from |
| | | | | | ISO-2022-JP-3 with iconv may |
| | | | | | emit spurious NUL character on... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-43396 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| libcurl4 | CVE-2021-22945 | CRITICAL | 7.74.0-1.3+deb11u1 | | curl: use-after-free and |
| | | | | | double-free in MQTT sending |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22945 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-22946 | HIGH | | | curl: Requirement to use |
| | | | | | TLS not properly enforced |
| | | | | | for IMAP, POP3, and... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22946 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-22947 | MEDIUM | | | curl: Server responses |
| | | | | | received before STARTTLS |
| | | | | | processed after TLS handshake |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22947 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-22898 | LOW | | | curl: TELNET stack |
| | | | | | contents disclosure |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22898 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-22922 | | | | curl: Content not matching hash |
| | | | | | in Metalink is not being discarded |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22922 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-22923 | | | | curl: Metalink download |
| | | | | | sends credentials |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22923 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-22924 | | | | curl: Bad connection reuse |
| | | | | | due to flawed path name checks |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-22924 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libexpat1 | CVE-2013-0340 | | 2.2.10-2+deb11u2 | | expat: internal entity expansion |
| | | | | | -->avd.aquasec.com/nvd/cve-2013-0340 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| libgcrypt20 | CVE-2021-33560 | HIGH | 1.8.7-6 | | libgcrypt: mishandles ElGamal |
| | | | | | encryption because it lacks |
| | | | | | exponent blinding to address a... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-33560 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2018-6829 | LOW | | | libgcrypt: ElGamal implementation |
| | | | | | doesn't have semantic security due |
| | | | | | to incorrectly encoded plaintexts... |
| | | | | | -->avd.aquasec.com/nvd/cve-2018-6829 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| libgnutls30 | CVE-2021-4209 | MEDIUM | 3.7.1-5 | | GnuTLS: Null pointer |
| | | | | | dereference in MD_UPDATE |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-4209 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2011-3389 | LOW | | | HTTPS: block-wise chosen-plaintext |
| | | | | | attack against SSL/TLS (BEAST) |
| | | | | | -->avd.aquasec.com/nvd/cve-2011-3389 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libgssapi-krb5-2 | CVE-2004-0971 | | 1.18.3-6+deb11u1 | | security flaw |
| | | | | | -->avd.aquasec.com/nvd/cve-2004-0971 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2018-5709 | | | | krb5: integer overflow |
| | | | | | in dbentry->n_key_data |
| | | | | | in kadmin/dbutil/dump.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2018-5709 |
+------------------+------------------+ + +---------------+-----------------------------------------+
| libk5crypto3 | CVE-2004-0971 | | | | security flaw |
| | | | | | -->avd.aquasec.com/nvd/cve-2004-0971 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2018-5709 | | | | krb5: integer overflow |
| | | | | | in dbentry->n_key_data |
| | | | | | in kadmin/dbutil/dump.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2018-5709 |
+------------------+------------------+ + +---------------+-----------------------------------------+
| libkrb5-3 | CVE-2004-0971 | | | | security flaw |
| | | | | | -->avd.aquasec.com/nvd/cve-2004-0971 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2018-5709 | | | | krb5: integer overflow |
| | | | | | in dbentry->n_key_data |
| | | | | | in kadmin/dbutil/dump.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2018-5709 |
+------------------+------------------+ + +---------------+-----------------------------------------+
| libkrb5support0 | CVE-2004-0971 | | | | security flaw |
| | | | | | -->avd.aquasec.com/nvd/cve-2004-0971 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2018-5709 | | | | krb5: integer overflow |
| | | | | | in dbentry->n_key_data |
| | | | | | in kadmin/dbutil/dump.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2018-5709 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libldap-2.4-2 | CVE-2015-3276 | | 2.4.57+dfsg-3 | | openldap: incorrect multi-keyword |
| | | | | | mode cipherstring parsing |
| | | | | | -->avd.aquasec.com/nvd/cve-2015-3276 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2017-14159 | | | | openldap: Privilege escalation |
| | | | | | via PID file manipulation |
| | | | | | -->avd.aquasec.com/nvd/cve-2017-14159 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2017-17740 | | | | openldap: |
| | | | | | contrib/slapd-modules/nops/nops.c |
| | | | | | attempts to free stack buffer |
| | | | | | allowing remote attackers to cause... |
| | | | | | -->avd.aquasec.com/nvd/cve-2017-17740 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2020-15719 | | | | openldap: Certificate |
| | | | | | validation incorrectly |
| | | | | | matches name against CN-ID |
| | | | | | -->avd.aquasec.com/nvd/cve-2020-15719 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libmount1 | CVE-2022-0563 | | 2.36.1-8+deb11u1 | | util-linux: partial disclosure |
| | | | | | of arbitrary files in chfn |
| | | | | | and chsh when compiled... |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-0563 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libncursesw6 | CVE-2021-39537 | | 6.2+20201114-2 | | ncurses: heap-based buffer overflow |
| | | | | | in _nc_captoinfo() in captoinfo.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-39537 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libpcre3 | CVE-2017-11164 | | 2:8.39-13 | | pcre: OP_KETRMAX feature in the |
| | | | | | match function in pcre_exec.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2017-11164 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2017-16231 | | | | pcre: self-recursive call |
| | | | | | in match() in pcre_exec.c |
| | | | | | leads to denial of service... |
| | | | | | -->avd.aquasec.com/nvd/cve-2017-16231 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2017-7245 | | | | pcre: stack-based buffer overflow |
| | | | | | write in pcre32_copy_substring |
| | | | | | -->avd.aquasec.com/nvd/cve-2017-7245 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2017-7246 | | | | pcre: stack-based buffer overflow |
| | | | | | write in pcre32_copy_substring |
| | | | | | -->avd.aquasec.com/nvd/cve-2017-7246 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-20838 | | | | pcre: Buffer over-read in JIT |
| | | | | | when UTF is disabled and \X or... |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-20838 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libsepol1 | CVE-2021-36084 | | 3.1-1 | | libsepol: use-after-free in |
| | | | | | __cil_verify_classperms() |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-36084 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-36085 | | | | libsepol: use-after-free in |
| | | | | | __cil_verify_classperms() |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-36085 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-36086 | | | | libsepol: use-after-free in |
| | | | | | cil_reset_classpermission() |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-36086 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2021-36087 | | | | libsepol: heap-based buffer |
| | | | | | overflow in ebitmap_match_any() |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-36087 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libsmartcols1 | CVE-2022-0563 | | 2.36.1-8+deb11u1 | | util-linux: partial disclosure |
| | | | | | of arbitrary files in chfn |
| | | | | | and chsh when compiled... |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-0563 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| libsqlite3-0 | CVE-2021-45346 | MEDIUM | 3.34.1-3 | | sqlite: crafted SQL query |
| | | | | | allows a malicious user to |
| | | | | | obtain sensitive information... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-45346 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2021-36690 | LOW | | | ** DISPUTED ** A segmentation fault |
| | | | | | can occur in the sqlite3.exe comma... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-36690 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| libssl1.1 | CVE-2021-4160 | MEDIUM | 1.1.1k-1+deb11u1 | | openssl: Carry propagation |
| | | | | | bug in the MIPS32 and |
| | | | | | MIPS64 squaring procedure |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-4160 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2007-6755 | LOW | | | Dual_EC_DRBG: weak pseudo |
| | | | | | random number generator |
| | | | | | -->avd.aquasec.com/nvd/cve-2007-6755 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2010-0928 | | | | openssl: RSA authentication weakness |
| | | | | | -->avd.aquasec.com/nvd/cve-2010-0928 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| libsystemd0 | CVE-2021-3997 | MEDIUM | 247.3-6 | | systemd: Uncontrolled recursion in |
| | | | | | systemd-tmpfiles when removing files |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-3997 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2013-4392 | LOW | | | systemd: TOCTOU race condition |
| | | | | | when updating file permissions |
| | | | | | and SELinux security contexts... |
| | | | | | -->avd.aquasec.com/nvd/cve-2013-4392 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2020-13529 | | | | systemd: DHCP FORCERENEW |
| | | | | | authentication not implemented |
| | | | | | can cause a system running the... |
| | | | | | -->avd.aquasec.com/nvd/cve-2020-13529 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libtinfo6 | CVE-2021-39537 | | 6.2+20201114-2 | | ncurses: heap-based buffer overflow |
| | | | | | in _nc_captoinfo() in captoinfo.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-39537 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| libudev1 | CVE-2021-3997 | MEDIUM | 247.3-6 | | systemd: Uncontrolled recursion in |
| | | | | | systemd-tmpfiles when removing files |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-3997 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2013-4392 | LOW | | | systemd: TOCTOU race condition |
| | | | | | when updating file permissions |
| | | | | | and SELinux security contexts... |
| | | | | | -->avd.aquasec.com/nvd/cve-2013-4392 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2020-13529 | | | | systemd: DHCP FORCERENEW |
| | | | | | authentication not implemented |
| | | | | | can cause a system running the... |
| | | | | | -->avd.aquasec.com/nvd/cve-2020-13529 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| libuuid1 | CVE-2022-0563 | | 2.36.1-8+deb11u1 | | util-linux: partial disclosure |
| | | | | | of arbitrary files in chfn |
| | | | | | and chsh when compiled... |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-0563 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| login | CVE-2007-5686 | | 1:4.8.1-1 | | initscripts in rPath Linux |
| | | | | | 1 sets insecure permissions |
| | | | | | for the /var/lo ...... |
| | | | | | -->avd.aquasec.com/nvd/cve-2007-5686 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2013-4235 | | | | shadow-utils: TOCTOU race |
| | | | | | conditions by copying and |
| | | | | | removing directory trees |
| | | | | | -->avd.aquasec.com/nvd/cve-2013-4235 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-19882 | | | | shadow-utils: local users can |
| | | | | | obtain root access because setuid |
| | | | | | programs are misconfigured... |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-19882 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| mount | CVE-2022-0563 | | 2.36.1-8+deb11u1 | | util-linux: partial disclosure |
| | | | | | of arbitrary files in chfn |
| | | | | | and chsh when compiled... |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-0563 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| ncurses-base | CVE-2021-39537 | | 6.2+20201114-2 | | ncurses: heap-based buffer overflow |
| | | | | | in _nc_captoinfo() in captoinfo.c |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-39537 |
+------------------+ + + +---------------+ +
| ncurses-bin | | | | | |
| | | | | | |
| | | | | | |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| openssl | CVE-2021-4160 | MEDIUM | 1.1.1k-1+deb11u1 | | openssl: Carry propagation |
| | | | | | bug in the MIPS32 and |
| | | | | | MIPS64 squaring procedure |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-4160 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2007-6755 | LOW | | | Dual_EC_DRBG: weak pseudo |
| | | | | | random number generator |
| | | | | | -->avd.aquasec.com/nvd/cve-2007-6755 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2010-0928 | | | | openssl: RSA authentication weakness |
| | | | | | -->avd.aquasec.com/nvd/cve-2010-0928 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| passwd | CVE-2007-5686 | | 1:4.8.1-1 | | initscripts in rPath Linux |
| | | | | | 1 sets insecure permissions |
| | | | | | for the /var/lo ...... |
| | | | | | -->avd.aquasec.com/nvd/cve-2007-5686 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2013-4235 | | | | shadow-utils: TOCTOU race |
| | | | | | conditions by copying and |
| | | | | | removing directory trees |
| | | | | | -->avd.aquasec.com/nvd/cve-2013-4235 |
+ +------------------+ + +---------------+-----------------------------------------+
| | CVE-2019-19882 | | | | shadow-utils: local users can |
| | | | | | obtain root access because setuid |
| | | | | | programs are misconfigured... |
| | | | | | -->avd.aquasec.com/nvd/cve-2019-19882 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
| perl-base | CVE-2020-16156 | HIGH | 5.32.1-4+deb11u2 | | perl-CPAN: Bypass of verification |
| | | | | | of signatures in CHECKSUMS files |
| | | | | | -->avd.aquasec.com/nvd/cve-2020-16156 |
+ +------------------+----------+ +---------------+-----------------------------------------+
| | CVE-2011-4116 | LOW | | | perl: File::Temp insecure |
| | | | | | temporary file handling |
| | | | | | -->avd.aquasec.com/nvd/cve-2011-4116 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| tar | CVE-2005-2541 | | 1.34+dfsg-1 | | tar: does not properly warn the user |
| | | | | | when extracting setuid or setgid... |
| | | | | | -->avd.aquasec.com/nvd/cve-2005-2541 |
+------------------+------------------+ +--------------------+---------------+-----------------------------------------+
| util-linux | CVE-2022-0563 | | 2.36.1-8+deb11u1 | | util-linux: partial disclosure |
| | | | | | of arbitrary files in chfn |
| | | | | | and chsh when compiled... |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-0563 |
+------------------+------------------+----------+--------------------+---------------+-----------------------------------------+
Node.js (node-pkg)
==================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
Python (python-pkg)
===================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)
+------------+------------------+----------+-------------------+---------------+---------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |
+------------+------------------+----------+-------------------+---------------+---------------------------------------+
| websockets | CVE-2021-33880 | MEDIUM | 8.1 | 9.1 | The aaugustin websockets |
| | | | | | library before 9.1 for |
| | | | | | Python has an Observab ...... |
| | | | | | -->avd.aquasec.com/nvd/cve-2021-33880 |
+------------+------------------+----------+-------------------+---------------+---------------------------------------+
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment