Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 22, 2025

This PR contains the following updates:

Package Type Update Change
python minor 3.12 -> 3.13
python (source) requires-python minor >=3.12, <3.13 -> >=3.13, <3.14
python final minor 3.12-slim -> 3.13-slim
python stage minor 3.12 -> 3.13

Release Notes

python/cpython (python)

v3.13.5

Compare Source

v3.13.4

Compare Source

v3.13.3

Compare Source

v3.13.2

Compare Source

v3.13.1

Compare Source

v3.13.0

Compare Source


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

gitnotebooks bot commented Jun 22, 2025

Copy link
Contributor

sourcery-ai bot commented Jun 22, 2025

Reviewer's Guide

This PR bumps the project’s Python version from 3.12 to 3.13 across Docker images, metadata, and configuration by updating base image tags, version constraints, and regenerating the lock file.

File-Level Changes

Change Details Files
Bump Docker base images to Python 3.13
  • Update builder image FROM python:3.12@… to python:3.13@…
  • Update production image FROM python:3.12-slim@… to python:3.13-slim@…
Dockerfile
Adjust Python version constraint
  • Change requires-python from '>=3.12,<3.13' to '>=3.13,<3.14'
  • Bump local .python-version from 3.12 to 3.13
pyproject.toml
.python-version
Regenerate dependency lock file
  • Refresh uv.lock to reflect updated Python version and dependencies
uv.lock

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link
Contributor

coderabbitai bot commented Jun 22, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Explain this complex logic.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai explain this code block.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and explain its main purpose.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Join our Discord community for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Copy link
Contributor

deepsource-io bot commented Jun 22, 2025

Here's the code health analysis summary for commits 504ff51..0e39d16. View details on DeepSource ↗.

Analysis Summary

AnalyzerStatusSummaryLink
DeepSource Python LogoPython✅ SuccessView Check ↗
DeepSource Docker LogoDocker✅ SuccessView Check ↗
DeepSource Secrets LogoSecrets✅ SuccessView Check ↗

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

Copy link

@mergify mergify bot merged commit 0e39d16 into main Jun 22, 2025
25 checks passed
@mergify mergify bot deleted the renovate/python-3.x branch June 22, 2025 23:58
Copy link
Contributor

mergify bot commented Jun 22, 2025

Thank you for your contribution @renovate[bot]! Your pull request has been merged.

@MH0386
Copy link
Contributor

MH0386 commented Jun 23, 2025

🔍 Vulnerabilities of ghcr.io/alphaspheredotai/vocalizr:128-merge

📦 Image Reference ghcr.io/alphaspheredotai/vocalizr:128-merge
digestsha256:40eb23a3555b0ea635841a9101808cdecb053f16a0997ec977df71ce5089476d
vulnerabilitiescritical: 0 high: 6 medium: 5 low: 96 unspecified: 2
platformlinux/amd64
size3.5 GB
packages704
📦 Base Image python:3-slim
also known as
  • 3-slim-bookworm
  • 3.13-slim
  • 3.13-slim-bookworm
  • 3.13.5-slim
  • 3.13.5-slim-bookworm
  • 3db1e9d2d5addce309ce973bc2fa6209c2b9c62d17016354635ec28328951f5e
  • slim
  • slim-bookworm
digestsha256:83c04b3d51c2150e7d23f6f2911059e7f1a5a4ff8870ef6eb7d4ea4ac6b49638
vulnerabilitiescritical: 0 high: 1 medium: 0 low: 27
critical: 0 high: 3 medium: 0 low: 4 libxml2 2.9.14+dfsg-1.3~deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-1.3~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

high : CVE--2022--49043

Affected range>=2.9.14+dfsg-1.3~deb12u1
Fixed versionNot Fixed
EPSS Score0.030%
EPSS Percentile7th percentile
Description

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.


[experimental] - libxml2 2.12.3+dfsg-0exp1

high : CVE--2025--24928

Affected range>=2.9.14+dfsg-1.3~deb12u1
Fixed versionNot Fixed
EPSS Score0.009%
EPSS Percentile1st percentile
Description

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.


high : CVE--2024--56171

Affected range>=2.9.14+dfsg-1.3~deb12u1
Fixed versionNot Fixed
EPSS Score0.008%
EPSS Percentile0th percentile
Description

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.


low : CVE--2025--32415

Affected range>=2.9.14+dfsg-1.3~deb12u1
Fixed versionNot Fixed
EPSS Score0.023%
EPSS Percentile5th percentile
Description

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.


low : CVE--2025--27113

Affected range>=2.9.14+dfsg-1.3~deb12u1
Fixed versionNot Fixed
EPSS Score0.069%
EPSS Percentile22nd percentile
Description

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.


low : CVE--2025--6170

Affected range>=2.9.14+dfsg-1.3~deb12u1
Fixed versionNot Fixed
EPSS Score0.013%
EPSS Percentile1st percentile
Description

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.


low : CVE--2024--34459

Affected range>=2.9.14+dfsg-1.3~deb12u1
Fixed versionNot Fixed
EPSS Score0.125%
EPSS Percentile33rd percentile
Description

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.


critical: 0 high: 1 medium: 0 low: 0 pam 1.5.2-6+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

high : CVE--2025--6020

Affected range>=1.5.2-6+deb12u1
Fixed versionNot Fixed
EPSS Score0.020%
EPSS Percentile4th percentile
Description

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.


critical: 0 high: 1 medium: 0 low: 0 gradio 5.33.0 (pypi)

pkg:pypi/[email protected]

# Dockerfile (42:42)
COPY --from=builder --chown=app:app /app/.venv /app/.venv

high 8.1: CVE--2023--6572 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range<2023-11-06
Fixed versionNot Fixed
CVSS Score8.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score1.662%
EPSS Percentile81st percentile
Description

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository gradio-app/gradio prior to main.

critical: 0 high: 1 medium: 0 low: 0 icu 72.1-3 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

high : CVE--2025--5222

Affected range>=72.1-3
Fixed versionNot Fixed
EPSS Score0.023%
EPSS Percentile4th percentile
Description

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.


critical: 0 high: 0 medium: 2 low: 0 urllib3 2.4.0 (pypi)

pkg:pypi/[email protected]

# Dockerfile (42:42)
COPY --from=builder --chown=app:app /app/.venv /app/.venv

medium 5.3: CVE--2025--50182 URL Redirection to Untrusted Site ('Open Redirect')

Affected range<2.5.0
Fixed version2.5.0
CVSS Score5.3
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score0.009%
EPSS Percentile1st percentile
Description

urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects.

However, the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior.

Affected usages

Any code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.

Impact

Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.

Remediation

If you use urllib3 in Node.js, upgrade to a patched version of urllib3.

Unfortunately, browsers provide no suitable way which urllib3 can use: XMLHttpRequest provides no control over redirects, the Fetch API returns opaqueredirect responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.

medium 5.3: CVE--2025--50181 URL Redirection to Untrusted Site ('Open Redirect')

Affected range<2.5.0
Fixed version2.5.0
CVSS Score5.3
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score0.010%
EPSS Percentile1st percentile
Description

urllib3 handles redirects and retries using the same mechanism, which is controlled by the Retry object. The most common way to disable redirects is at the request level, as follows:

resp = urllib3.request("GET", "https://httpbin.org/redirect/1", redirect=False)
print(resp.status)
# 302

However, it is also possible to disable redirects, for all requests, by instantiating a PoolManager and specifying retries in a way that disable redirects:

import urllib3

http = urllib3.PoolManager(retries=0)  # should raise MaxRetryError on redirect
http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0))  # equivalent to the above
http = urllib3.PoolManager(retries=False)  # should return the first response

resp = http.request("GET", "https://httpbin.org/redirect/1")

However, the retries parameter is currently ignored, which means all the above examples don't disable redirects.

Affected usages

Passing retries on PoolManager instantiation to disable redirects or restrict their number.

By default, requests and botocore users are not affected.

Impact

Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.

Remediation

You can remediate this vulnerability with the following steps:

  • Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [email protected] to discuss sponsorship or contribution opportunities.
  • Disable redirects at the request() level instead of the PoolManager() level.
critical: 0 high: 0 medium: 1 low: 1 jpeg-xl 0.7.0-10 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

medium : CVE--2024--11403

Affected range>=0.7.0-10
Fixed versionNot Fixed
EPSS Score0.062%
EPSS Percentile20th percentile
Description

There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.


[experimental] - jpeg-xl 0.10.4-1

low : CVE--2021--36691

Affected range>=0.7.0-10
Fixed versionNot Fixed
EPSS Score0.303%
EPSS Percentile53rd percentile
Description

libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase(). When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service.


critical: 0 high: 0 medium: 1 low: 0 requests 2.32.3 (pypi)

pkg:pypi/[email protected]

# Dockerfile (42:42)
COPY --from=builder --chown=app:app /app/.venv /app/.venv

medium 5.3: CVE--2024--47081 Insufficiently Protected Credentials

Affected range<2.32.4
Fixed version2.32.4
CVSS Score5.3
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score0.062%
EPSS Percentile20th percentile
Description

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

psf/requests#6965
https://seclists.org/fulldisclosure/2025/Jun/2

critical: 0 high: 0 medium: 1 low: 0 torch 2.7.1 (pypi)

pkg:pypi/[email protected]

# Dockerfile (42:42)
COPY --from=builder --chown=app:app /app/.venv /app/.venv

medium 4.8: CVE--2025--3730 Improper Resource Shutdown or Release

Affected range<=2.7.1
Fixed versionNot Fixed
CVSS Score4.8
CVSS VectorCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS Score0.023%
EPSS Percentile5th percentile
Description

A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue.

critical: 0 high: 0 medium: 0 low: 12 openjpeg2 2.5.0-2+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2018--20846

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.313%
EPSS Percentile54th percentile
Description

Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).


low : CVE--2018--16376

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.566%
EPSS Percentile67th percentile
Description

An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.


low : CVE--2018--16375

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.437%
EPSS Percentile62nd percentile
Description

An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c can lead to a heap-based buffer overflow.


low : CVE--2017--17479

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score6.320%
EPSS Percentile90th percentile
Description

In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.


low : CVE--2016--9581

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.400%
EPSS Percentile60th percentile
Description

An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.


low : CVE--2016--9580

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.449%
EPSS Percentile63rd percentile
Description

An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.


low : CVE--2016--9117

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.357%
EPSS Percentile57th percentile
Description

NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.


low : CVE--2016--9116

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.357%
EPSS Percentile57th percentile
Description

NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.


low : CVE--2016--9115

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.374%
EPSS Percentile58th percentile
Description

Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.


low : CVE--2016--9114

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.607%
EPSS Percentile69th percentile
Description

There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image->comps[compno].data is not assigned a value after initialization(NULL). Impact is Denial of Service.


low : CVE--2016--9113

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.448%
EPSS Percentile63rd percentile
Description

There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a value after initialization(NULL). Impact is Denial of Service.


low : CVE--2016--10505

Affected range>=2.5.0-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.656%
EPSS Percentile70th percentile
Description

NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.


critical: 0 high: 0 medium: 0 low: 10 unspecified: 2tiff 4.5.0-6+deb12u2 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u2?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2024--6716

Affected range>=4.5.0-6+deb12u1
Fixed versionNot Fixed
EPSS Score0.043%
EPSS Percentile12th percentile
Description

REJECTED


REJECTED

low : CVE--2023--6228

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.014%
EPSS Percentile2nd percentile
Description

An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.


low : CVE--2023--3164

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.010%
EPSS Percentile1st percentile
Description

A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.


low : CVE--2023--1916

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.017%
EPSS Percentile2nd percentile
Description

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.


low : CVE--2022--1210

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.035%
EPSS Percentile9th percentile
Description

A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.


low : CVE--2018--10126

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.456%
EPSS Percentile63rd percentile
Description

ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c.


low : CVE--2017--9117

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.097%
EPSS Percentile28th percentile
Description

In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).


low : CVE--2017--5563

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.457%
EPSS Percentile63rd percentile
Description

LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.


low : CVE--2017--17973

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.272%
EPSS Percentile50th percentile
Description

In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue


low : CVE--2017--16232

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score1.738%
EPSS Percentile82nd percentile
Description

LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue


unspecified : CVE--2023--38289

Affected range>=4.5.0-6
Fixed versionNot Fixed
Description

REJECTED


REJECTED

unspecified : CVE--2023--38288

Affected range>=4.5.0-6
Fixed versionNot Fixed
Description

REJECTED


REJECTED

critical: 0 high: 0 medium: 0 low: 9 llvm-toolchain-15 1:15.0.6-4 (deb)

pkg:deb/debian/llvm-toolchain-15@1%3A15.0.6-4?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2024--31852

Affected range>=1:15.0.6-4
Fixed versionNot Fixed
EPSS Score0.105%
EPSS Percentile30th percentile
Description

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."


low : CVE--2023--29942

Affected range>=1:15.0.6-4
Fixed versionNot Fixed
EPSS Score0.032%
EPSS Percentile7th percentile
Description

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLVM::LLVMVoidType.


low : CVE--2023--29941

Affected range>=1:15.0.6-4
Fixed versionNot Fixed
EPSS Score0.024%
EPSS Percentile5th percentile
Description

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOpmlir::sparse_tensor::SortOp(mlir::sparse_tensor::SortOp.


low : CVE--2023--29939

Affected range>=1:15.0.6-4
Fixed versionNot Fixed
EPSS Score0.020%
EPSS Percentile4th percentile
Description

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr).


low : CVE--2023--29935

Affected range>=1:15.0.6-4
Fixed versionNot Fixed
EPSS Score0.032%
EPSS Percentile8th percentile
Description

llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.


low : CVE--2023--29934

Affected range>=1:15.0.6-4
Fixed versionNot Fixed
EPSS Score0.020%
EPSS Percentile4th percentile
Description

llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().


low : CVE--2023--29933

Affected range>=1:15.0.6-4
Fixed versionNot Fixed
EPSS Score0.020%
EPSS Percentile4th percentile
Description

llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.


low : CVE--2023--29932

Affected range>=1:15.0.6-4
Fixed versionNot Fixed
EPSS Score0.020%
EPSS Percentile4th percentile
Description

llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand.


low : CVE--2023--26924

Affected range>=1:15.0.6-4
Fixed versionNot Fixed
EPSS Score0.025%
EPSS Percentile5th percentile
Description

LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. NOTE: third parties dispute this because the LLVM security policy excludes "Language front-ends ... for which a malicious input file can cause undesirable behavior."


critical: 0 high: 0 medium: 0 low: 7 elfutils 0.188-2.1 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2025--1377

Affected range>=0.188-2.1
Fixed versionNot Fixed
EPSS Score0.083%
EPSS Percentile25th percentile
Description

A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.


low : CVE--2025--1376

Affected range>=0.188-2.1
Fixed versionNot Fixed
EPSS Score0.061%
EPSS Percentile20th percentile
Description

A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.


low : CVE--2025--1372

Affected range>=0.188-2.1
Fixed versionNot Fixed
EPSS Score0.034%
EPSS Percentile9th percentile
Description

A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.


low : CVE--2025--1371

Affected range>=0.188-2.1
Fixed versionNot Fixed
EPSS Score0.034%
EPSS Percentile8th percentile
Description

A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue.


low : CVE--2025--1365

Affected range>=0.188-2.1
Fixed versionNot Fixed
EPSS Score0.034%
EPSS Percentile9th percentile
Description

A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.


low : CVE--2025--1352

Affected range>=0.188-2.1
Fixed versionNot Fixed
EPSS Score0.151%
EPSS Percentile37th percentile
Description

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.


low : CVE--2024--25260

Affected range>=0.188-2.1
Fixed versionNot Fixed
EPSS Score0.014%
EPSS Percentile2nd percentile
Description

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.


critical: 0 high: 0 medium: 0 low: 7 glibc 2.36-9+deb12u10 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u10?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2019--9192

Affected range>=2.36-9+deb12u10
Fixed versionNot Fixed
EPSS Score0.164%
EPSS Percentile38th percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern


low : CVE--2019--1010025

Affected range>=2.36-9+deb12u10
Fixed versionNot Fixed
EPSS Score0.235%
EPSS Percentile46th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.


low : CVE--2019--1010024

Affected range>=2.36-9+deb12u10
Fixed versionNot Fixed
EPSS Score0.375%
EPSS Percentile58th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.


low : CVE--2019--1010023

Affected range>=2.36-9+deb12u10
Fixed versionNot Fixed
EPSS Score0.703%
EPSS Percentile71st percentile
Description

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.


low : CVE--2019--1010022

Affected range>=2.36-9+deb12u10
Fixed versionNot Fixed
EPSS Score0.145%
EPSS Percentile36th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.


low : CVE--2018--20796

Affected range>=2.36-9+deb12u10
Fixed versionNot Fixed
EPSS Score1.996%
EPSS Percentile83rd percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.


low : CVE--2010--4756

Affected range>=2.36-9+deb12u10
Fixed versionNot Fixed
EPSS Score0.373%
EPSS Percentile58th percentile
Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.


  • glibc (unimportant)
  • eglibc (unimportant)
    That's standard POSIX behaviour implemented by (e)glibc. Applications using
    glob need to impose limits for themselves
critical: 0 high: 0 medium: 0 low: 4 systemd 252.38-1~deb12u1 (deb)

pkg:deb/debian/[email protected]~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2023--31439

Affected range>=252.36-1~deb12u1
Fixed versionNot Fixed
EPSS Score0.094%
EPSS Percentile28th percentile
Description

An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."


low : CVE--2023--31438

Affected range>=252.36-1~deb12u1
Fixed versionNot Fixed
EPSS Score0.100%
EPSS Percentile29th percentile
Description

An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."


low : CVE--2023--31437

Affected range>=252.36-1~deb12u1
Fixed versionNot Fixed
EPSS Score0.128%
EPSS Percentile33rd percentile
Description

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."


low : CVE--2013--4392

Affected range>=252.36-1~deb12u1
Fixed versionNot Fixed
EPSS Score0.074%
EPSS Percentile23rd percentile
Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.


critical: 0 high: 0 medium: 0 low: 4 mesa 22.3.6-1+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2023--45931

Affected range>=22.3.6-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.187%
EPSS Percentile41st percentile
Description

Mesa 23.0.4 was discovered to contain a NULL pointer dereference in check_xshm() for the has_error state. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.


low : CVE--2023--45922

Affected range>=22.3.6-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.060%
EPSS Percentile19th percentile
Description

glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.


low : CVE--2023--45919

Affected range>=22.3.6-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.041%
EPSS Percentile12th percentile
Description

Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.


low : CVE--2023--45913

Affected range>=22.3.6-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.017%
EPSS Percentile2nd percentile
Description

Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability is triggered when the X11 server sends an DRI2_BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.


critical: 0 high: 0 medium: 0 low: 3 krb5 1.20.1-2+deb12u3 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u3?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2024--26461

Affected range>=1.20.1-2+deb12u3
Fixed versionNot Fixed
EPSS Score0.081%
EPSS Percentile25th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.


low : CVE--2024--26458

Affected range>=1.20.1-2+deb12u3
Fixed versionNot Fixed
EPSS Score0.152%
EPSS Percentile37th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.


low : CVE--2018--5709

Affected range>=1.20.1-2+deb12u3
Fixed versionNot Fixed
EPSS Score0.463%
EPSS Percentile63rd percentile
Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.


critical: 0 high: 0 medium: 0 low: 3 mbedtls 2.28.3-1 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2024--45157

Affected range>=2.28.3-1
Fixed versionNot Fixed
EPSS Score0.017%
EPSS Percentile2nd percentile
Description

An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled.


low : CVE--2023--43615

Affected range>=2.28.3-1
Fixed versionNot Fixed
EPSS Score0.309%
EPSS Percentile54th percentile
Description

Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.


low : CVE--2018--1000520

Affected range>=2.28.3-1
Fixed versionNot Fixed
EPSS Score0.104%
EPSS Percentile29th percentile
Description

ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can result in ECDSA-signed certificates are accepted, when only RSA-signed ones should be.. This attack appear to be exploitable via Peers negotiate a TLS-ECDH-RSA-* ciphersuite. Any of the peers can then provide an ECDSA-signed certificate, when only an RSA-signed one should be accepted..


critical: 0 high: 0 medium: 0 low: 2 lcms2 2.14-2 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2025--29070

Affected range>=2.14-2
Fixed versionNot Fixed
EPSS Score0.145%
EPSS Percentile36th percentile
Description

A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation."


low : CVE--2025--29069

Affected range>=2.14-2
Fixed versionNot Fixed
EPSS Score0.055%
EPSS Percentile17th percentile
Description

A heap buffer overflow vulnerability has been identified in the lcms2-2.16. The vulnerability exists in the UnrollChunkyBytes function in cmspack.c, which is responsible for handling color space transformations.


mm2/Little-CMS#476
Not considered an issue in src:lcms2 but in the fuzzer

critical: 0 high: 0 medium: 0 low: 2 openssl 3.0.16-1~deb12u1 (deb)

pkg:deb/debian/[email protected]~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2025--27587

Affected range>=3.0.16-1~deb12u1
Fixed versionNot Fixed
EPSS Score0.018%
EPSS Percentile3rd percentile
Description

OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.


low : CVE--2010--0928

Affected range>=3.0.11-1~deb12u2
Fixed versionNot Fixed
EPSS Score0.098%
EPSS Percentile28th percentile
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."


http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
openssl/openssl#24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

critical: 0 high: 0 medium: 0 low: 2 slang2 2.3.3-3 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2023--45929

Affected range>=2.3.3-3
Fixed versionNot Fixed
EPSS Score0.149%
EPSS Percentile37th percentile
Description

S-Lang 2.3.2 was discovered to contain a segmentation fault via the function fixup_tgetstr().


low : CVE--2023--45927

Affected range>=2.3.3-3
Fixed versionNot Fixed
EPSS Score0.195%
EPSS Percentile42nd percentile
Description

S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf().


critical: 0 high: 0 medium: 0 low: 2 expat 2.5.0-1+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2024--28757

Affected range>=2.5.0-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.474%
EPSS Percentile64th percentile
Description

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).


low : CVE--2023--52426

Affected range>=2.5.0-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.019%
EPSS Percentile3rd percentile
Description

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.


critical: 0 high: 0 medium: 0 low: 2 coreutils 9.1-1 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2025--5278

Affected range>=9.1-1
Fixed versionNot Fixed
EPSS Score0.014%
EPSS Percentile2nd percentile
Description

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.


low : CVE--2017--18018

Affected range>=9.1-1
Fixed versionNot Fixed
EPSS Score0.057%
EPSS Percentile18th percentile
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.


critical: 0 high: 0 medium: 0 low: 2 perl 5.36.0-7+deb12u2 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u2?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2023--31486

Affected range>=5.36.0-7+deb12u2
Fixed versionNot Fixed
EPSS Score0.785%
EPSS Percentile73rd percentile
Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.


low : CVE--2011--4116

Affected range>=5.36.0-7+deb12u2
Fixed versionNot Fixed
EPSS Score0.815%
EPSS Percentile73rd percentile
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.


critical: 0 high: 0 medium: 0 low: 2 libgcrypt20 1.10.1-3 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2024--2236

Affected range>=1.10.1-3
Fixed versionNot Fixed
EPSS Score0.228%
EPSS Percentile46th percentile
Description

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.


low : CVE--2018--6829

Affected range>=1.10.1-3
Fixed versionNot Fixed
EPSS Score1.266%
EPSS Percentile79th percentile
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.


critical: 0 high: 0 medium: 0 low: 1 libtheora 1.1.1+dfsg.1-16.1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg.1-16.1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2024--56431

Affected range>=1.1.1+dfsg.1-16.1
Fixed versionNot Fixed
EPSS Score7.751%
EPSS Percentile91st percentile
Description

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.


critical: 0 high: 0 medium: 0 low: 1 apt 2.6.1 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2011--3374

Affected range>=2.6.1
Fixed versionNot Fixed
EPSS Score1.509%
EPSS Percentile80th percentile
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.


critical: 0 high: 0 medium: 0 low: 1 cairo 1.16.0-7 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2018--18064

Affected range>=1.16.0-7
Fixed versionNot Fixed
EPSS Score0.196%
EPSS Percentile42nd percentile
Description

cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).


critical: 0 high: 0 medium: 0 low: 1 tar 1.34+dfsg-1.2+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-1.2%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2005--2541

Affected range>=1.34+dfsg-1.2+deb12u1
Fixed versionNot Fixed
EPSS Score2.806%
EPSS Percentile85th percentile
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.


This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

critical: 0 high: 0 medium: 0 low: 1 x264 2:0.164.3095+gitbaee400-3 (deb)

pkg:deb/debian/x264@2%3A0.164.3095%2Bgitbaee400-3?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2025--25467

Affected range>=2:0.164.3095+gitbaee400-3
Fixed versionNot Fixed
EPSS Score0.166%
EPSS Percentile39th percentile
Description

Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.


critical: 0 high: 0 medium: 0 low: 1 gcc-12 12.2.0-14+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2022--27943

Affected range>=12.2.0-14+deb12u1
Fixed versionNot Fixed
EPSS Score0.044%
EPSS Percentile13th percentile
Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.


critical: 0 high: 0 medium: 0 low: 1 sqlite3 3.40.1-2+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2021--45346

Affected range>=3.40.1-2+deb12u1
Fixed versionNot Fixed
EPSS Score0.172%
EPSS Percentile39th percentile
Description

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.


critical: 0 high: 0 medium: 0 low: 1 glib2.0 2.74.6-2+deb12u6 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u6?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2012--0039

Affected range>=2.74.6-2+deb12u6
Fixed versionNot Fixed
EPSS Score0.489%
EPSS Percentile64th percentile
Description

GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.


critical: 0 high: 0 medium: 0 low: 1 jbigkit 2.1-6.1 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2017--9937

Affected range>=2.1-6.1
Fixed versionNot Fixed
EPSS Score0.271%
EPSS Percentile50th percentile
Description

In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.


critical: 0 high: 0 medium: 0 low: 1 shadow 1:4.13+dfsg1-1+deb12u1 (deb)

pkg:deb/debian/shadow@1%3A4.13%2Bdfsg1-1%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2007--5686

Affected range>=1:4.13+dfsg1-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.245%
EPSS Percentile48th percentile
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.


  • shadow (unimportant)
    See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so
    unknown usernames are not recorded on login failures
critical: 0 high: 0 medium: 0 low: 1 libpng1.6 1.6.39-2 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2021--4214

Affected range>=1.6.39-2
Fixed versionNot Fixed
EPSS Score0.043%
EPSS Percentile13th percentile
Description

A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.


critical: 0 high: 0 medium: 0 low: 1 libvpx 1.12.0-1+deb12u4 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u4?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2017--0641

Affected range>=1.12.0-1+deb12u3
Fixed versionNot Fixed
EPSS Score2.719%
EPSS Percentile85th percentile
Description

A remote denial of service vulnerability in libvpx in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34360591.


critical: 0 high: 0 medium: 0 low: 1 libcaca 0.99.beta20-3 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2022--0856

Affected range>=0.99.beta20-3
Fixed versionNot Fixed
EPSS Score3.206%
EPSS Percentile86th percentile
Description

libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service


critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.2.40-1.1 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2022--3219

Affected range>=2.2.40-1.1
Fixed versionNot Fixed
EPSS Score0.012%
EPSS Percentile1st percentile
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.


critical: 0 high: 0 medium: 0 low: 1 pixman 0.42.2-1 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2023--37769

Affected range>=0.42.2-1
Fixed versionNot Fixed
EPSS Score0.029%
EPSS Percentile7th percentile
Description

stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c.


critical: 0 high: 0 medium: 0 low: 1 util-linux 2.38.1-5+deb12u3 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u3?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2022--0563

Affected range>=2.38.1-5+deb12u3
Fixed versionNot Fixed
EPSS Score0.025%
EPSS Percentile5th percentile
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.


critical: 0 high: 0 medium: 0 low: 1 libglvnd 1.6.0-1 (deb)

pkg:deb/debian/[email protected]?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (33:38)
RUN groupadd app && \
    useradd -m -g app -s /bin/bash app && \
    apt-get update -qq && \
    apt-get install -qq -y --no-install-recommends espeak-ng ffmpeg && \
    apt-get clean -qq && \
    rm -rf /var/lib/apt/lists/*

low : CVE--2023--45924

Affected range>=1.6.0-1
Fixed versionNot Fixed
EPSS Score0.090%
EPSS Percentile27th percentile
Description

libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.


critical: 0 high: 0 medium: 0 low: 1 gnutls28 3.7.9-2+deb12u4 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u4?os_distro=bookworm&os_name=debian&os_version=12

# Dockerfile (25:25)
FROM python:3.13-slim@sha256:f2fdaec50160418e0c2867ba3e254755edd067171725886d5d303fd7057bbf81 AS production

low : CVE--2011--3389

Affected range>=3.7.9-2+deb12u4
Fixed versionNot Fixed
EPSS Score5.423%
EPSS Percentile90th percentile
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.


@MH0386
Copy link
Contributor

MH0386 commented Jun 23, 2025

Your image ghcr.io/alphaspheredotai/vocalizr:128-merge critical: 0 high: 6 medium: 5 low: 96 unspecified: 2
Current base image python:3.13-slim critical: 0 high: 1 medium: 0 low: 27
Updated base image python:alpine critical: 0 high: 0 medium: 0 low: 0

@MH0386
Copy link
Contributor

MH0386 commented Jun 23, 2025

Recommended fixes for image ghcr.io/alphaspheredotai/vocalizr:128-merge

Base image is python:3.13-slim

Name3.13.5-slim-bookworm
Digestsha256:83c04b3d51c2150e7d23f6f2911059e7f1a5a4ff8870ef6eb7d4ea4ac6b49638
Vulnerabilitiescritical: 0 high: 1 medium: 0 low: 27
Pushed1 week ago
Size44 MB
Packages139
Flavordebian
OS12
Runtime3.13.5
Slim
The base image is also available under the supported tag(s): 3-slim, 3-slim-bookworm, 3.13-slim-bookworm, 3.13.5-slim, 3.13.5-slim-bookworm, slim, slim-bookworm

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
alpine
Tag is preferred tag
Also known as:
  • alpine3.22
  • 3.13.5-alpine
  • 3.13.5-alpine3.22
  • 3.13-alpine
  • 3.13-alpine3.22
  • 3-alpine
  • 3-alpine3.22
Benefits:
  • Patch runtime version update
  • Image is smaller by 26 MB
  • Image contains 100 fewer packages
  • Tag is preferred tag
  • Image introduces no new vulnerability but removes 28
  • alpine was pulled 41K times last month
Image details:
  • Size: 17 MB
  • Flavor: alpine
  • OS: 3.22
  • Runtime: 3.13.5
1 week ago



Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant