Repository: greenbone/gvm-libs
Pull request #900: Add: openvasd_get_performance()
Author: login: jjnicola
Created: 2025-03-04T14:51:45Z | Merged: 2025-03-27T10:55:17Z

## What
Add: openvasd_get_performance()
Jira: SC-1039
<!--
  Describe what changes are being made, e.g. which feature/bug is being
  developed/fixed in this PR? How did you verify the changes in this PR?
-->

## Why

<!-- Describe why are these changes necessary? -->

## References

<!-- Add identifier for issue tickets, links to other PRs, etc. -->

## Checklist

<!-- Remove this section if not applicable to your changes -->

- [ ] Tests





Diff:
diff --git a/openvasd/openvasd.c b/openvasd/openvasd.c
index 04bd78c6e..4106c5143 100644
--- a/openvasd/openvasd.c
+++ b/openvasd/openvasd.c
@@ -838,8 +838,7 @@ parse_results (const gchar *body, GSList **results)
       goto res_cleanup;
 
     item = cJSON_GetObjectItem (result_obj, "detail");
-    if (item != NULL
-        && cJSON_IsObject (item))
+    if (item != NULL && cJSON_IsObject (item))
       {
         cJSON *detail_obj = NULL;
 
@@ -851,21 +850,21 @@ parse_results (const gchar *body, GSList **results)
           {
             detail_source_type = gvm_json_obj_str (detail_obj, "type");
             detail_source_name = gvm_json_obj_str (detail_obj, "name");
-            detail_source_description = gvm_json_obj_str (detail_obj, "description");
+            detail_source_description =
+              gvm_json_obj_str (detail_obj, "description");
           }
       }
 
-    result = openvasd_result_new (gvm_json_obj_double (result_obj, "id"),
-                                  gvm_json_obj_str (result_obj, "type"),
-                                  gvm_json_obj_str (result_obj, "ip_address"),
-                                  gvm_json_obj_str (result_obj, "hostname"),
-                                  gvm_json_obj_str (result_obj, "oid"),
-                                  gvm_json_obj_int (result_obj, "port"),
-                                  gvm_json_obj_str (result_obj, "protocol"),
-                                  gvm_json_obj_str (result_obj, "message"),
-                                  detail_name, detail_value,
-                                  detail_source_type, detail_source_name,
-                                  detail_source_description);
+    result = openvasd_result_new (
+      gvm_json_obj_double (result_obj, "id"),
+      gvm_json_obj_str (result_obj, "type"),
+      gvm_json_obj_str (result_obj, "ip_address"),
+      gvm_json_obj_str (result_obj, "hostname"),
+      gvm_json_obj_str (result_obj, "oid"),
+      gvm_json_obj_int (result_obj, "port"),
+      gvm_json_obj_str (result_obj, "protocol"),
+      gvm_json_obj_str (result_obj, "message"), detail_name, detail_value,
+      detail_source_type, detail_source_name, detail_source_description);
 
     *results = g_slist_append (*results, result);
     ret = 200;
@@ -1012,8 +1011,7 @@ openvasd_get_scan_progress_ext (openvasd_connector_t conn,
   // read progress of single running hosts
   cJSON *scanning;
   scanning = cJSON_GetObjectItem (reader, "scanning");
-  if (scanning != NULL
-      && cJSON_IsObject (scanning))
+  if (scanning != NULL && cJSON_IsObject (scanning))
     {
       cJSON *host = scanning->child;
       while (host)
@@ -1250,6 +1248,88 @@ openvasd_get_health_started (openvasd_connector_t conn)
   return response;
 }
 
+openvasd_resp_t
+openvasd_get_performance (openvasd_connector_t conn,
+                          openvasd_get_performance_opts_t opts)
+{
+  openvasd_resp_t response;
+  gchar *query;
+  time_t now;
+  gvm_http_headers_t *customheader;
+
+  time (&now);
+
+  response = g_malloc0 (sizeof (struct openvasd_response));
+
+  if (!opts.titles || !strcmp (opts.titles, "") || opts.start < 0
+      || opts.start > now || opts.end < 0 || opts.end > now)
+    {
+      response->code = RESP_CODE_ERR;
+      response->body =
+        g_strdup ("{\"error\": \"Couldn't send get_performance command "
+                  "to scanner. Bad or missing parameters.\"}");
+      return response;
+    }
+
+  query = g_strdup_printf ("/health/performance?start=%d&end=%d&titles=%s",
+                     opts.start, opts.end, opts.titles);
+  customheader = init_customheader (conn->apikey, FALSE);
+  response = openvasd_send_request (conn, GET, query, NULL, customheader, NULL);
+  g_free (query);
+
+  gvm_http_headers_free (customheader);
+  if (response->code != RESP_CODE_ERR)
+    response->body = g_strdup (openvasd_vt_stream_str (conn));
+  else
+    {
+      response->body = g_strdup (
+        "{\"error\": \"Not possible to get performance information.\"}");
+      g_warning ("%s: Not possible to get performance information", __func__);
+    }
+
+  openvasd_reset_vt_stream (conn);
+  return response;
+}
+
+int
+openvasd_parsed_performance (openvasd_connector_t conn,
+                             openvasd_get_performance_opts_t opts,
+                             gchar **graph, gchar **err)
+{
+  openvasd_resp_t resp = NULL;
+  cJSON *parser;
+  cJSON *item;
+  int ret = 0;
+  resp = openvasd_get_performance (conn, opts);
+
+  // No results. No information.
+  parser = cJSON_Parse (resp->body);
+  if (parser == NULL)
+    {
+      *err = g_strdup ("Unable to parse sensor performance data");
+      ret = -1;
+    }
+  else if (resp->code != 200)
+    {
+      parser = cJSON_Parse (resp->body);
+      item = cJSON_GetObjectItem (parser, "error");
+      if (item != NULL)
+        *err = g_strdup (cJSON_GetStringValue (item));
+      ret = -1;
+    }
+  else
+    {
+      item = cJSON_GetArrayItem (parser, 0);
+      if (item != NULL)
+        *graph = g_strdup (cJSON_GetStringValue (item));
+    }
+
+  openvasd_response_cleanup (resp);
+  cJSON_Delete (parser);
+
+  return ret;
+}
+
 openvasd_resp_t
 openvasd_get_scan_preferences (openvasd_connector_t conn)
 {
@@ -1456,12 +1536,11 @@ openvasd_parsed_scans_preferences (openvasd_connector_t conn, GSList **params)
           }
       }
 
-    param =
-      openvasd_param_new (g_strdup (gvm_json_obj_str (param_obj, "id")),
-                          g_strdup (gvm_json_obj_str (param_obj, "name")),
-                          g_strdup (defval),
-                          g_strdup (gvm_json_obj_str (param_obj, "description")),
-                          g_strdup (param_type), mandatory);
+    param = openvasd_param_new (
+      g_strdup (gvm_json_obj_str (param_obj, "id")),
+      g_strdup (gvm_json_obj_str (param_obj, "name")), g_strdup (defval),
+      g_strdup (gvm_json_obj_str (param_obj, "description")),
+      g_strdup (param_type), mandatory);
     g_free (defval);
     g_free (param_type);
     *params = g_slist_append (*params, param);
diff --git a/openvasd/openvasd.h b/openvasd/openvasd.h
index d15cfcdc2..d353bde0c 100644
--- a/openvasd/openvasd.h
+++ b/openvasd/openvasd.h
@@ -110,6 +110,13 @@ struct openvasd_scan_status
   long response_code;
 };
 
+typedef struct
+{
+  int start;    /**< Start interval. */
+  int end;      /**< End interval. */
+  const gchar *titles; /**< Graph title. */
+} openvasd_get_performance_opts_t;
+
 typedef struct openvasd_response *openvasd_resp_t;
 
 typedef enum OPENVASD_RESULT_MEMBER_INT openvasd_result_member_int_t;
@@ -182,6 +189,13 @@ openvasd_resp_t openvasd_get_health_ready (openvasd_connector_t);
 
 openvasd_resp_t openvasd_get_health_started (openvasd_connector_t);
 
+openvasd_resp_t openvasd_get_performance (openvasd_connector_t,
+                                          openvasd_get_performance_opts_t);
+int
+openvasd_parsed_performance (openvasd_connector_t,
+                             openvasd_get_performance_opts_t, gchar **,
+                             gchar **err);
+
 /* Scanner preferences */
 
 typedef struct openvasd_param openvasd_param_t;


Reviews:
user: login: mattmundell
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-04T15:45:16Z
user: login: mattmundell
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T21:36:44Z
user: login: mattmundell
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T21:49:50Z
user: login: mattmundell
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T14:38:35Z
user: login: mattmundell
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-26T15:47:10Z
user: login: ArnoStiefvater
state: APPROVED
author_association: MEMBER
submitted_at: 2025-03-27T10:55:16Z

Review comments:
diff_hunk: @@ -1591,6 +1589,56 @@ openvasd_get_health_started (openvasd_connector_t conn)
   return response;
 }
 
+openvasd_resp_t
+openvasd_get_performance (openvasd_connector_t conn,
+                          openvasd_get_performance_opts_t opts)
+{
+  openvasd_resp_t response = NULL;
+  gchar *err = NULL;
+  CURL *hnd = NULL;
+  struct curl_slist *customheader = NULL;
+  time_t now;
+  time (&now);
+
+  response = g_malloc0 (sizeof (struct openvasd_response));
+
+  if (!opts.titles || !strcmp (opts.titles, "") || opts.start < 0
+      || opts.start > now || opts.end < 0 || opts.end > now)
+    {
+      response->code = RESP_CODE_ERR;
+      response->body =
+        g_strdup ("{\"error\": \"Couldn't send get_performance command "
+                  "to scanner. Bad or missing parameters.\"}");
+      return response;
+    }
+  gchar *query =
+    g_strdup_printf ("/health/performance?start=%d&end=%d&titles=%s",
+                     opts.start, opts.end, opts.titles);
+  customheader = init_customheader (conn->apikey, FALSE);
+  hnd = handler (conn, GET, query, NULL, customheader, &err);
+  if (hnd == NULL)
+    {
+      curl_slist_free_all (customheader);
+      response->code = RESP_CODE_ERR;
+      response->body = err;
+      return response;
+    }
+
+  openvasd_send_request (hnd, NULL, response);
+  curl_slist_free_all (customheader);
+  if (response->code != RESP_CODE_ERR)
+    response->body = g_strdup (openvasd_vt_stream_str (conn));
+  else if (response->code == RESP_CODE_ERR)
path: openvasd/openvasd.c
user: login: mattmundell
body: You could drop the `if` and just have the `else` because the condition is always true.
created_at: 2025-03-04T15:30:50Z
author_association: CONTRIBUTOR
diff_hunk: @@ -110,6 +110,13 @@ struct openvasd_scan_status
   long response_code;
 };
 
+typedef struct
+{
+  int start;    /**< Start interval. */
+  int end;      /**< End interval. */
+  char *titles; /**< Graph title. */
path: openvasd/openvasd.h
user: login: mattmundell
body: ```suggestion
  gchar *titles; /**< Graph title. */
```
created_at: 2025-03-04T15:34:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1591,6 +1589,56 @@ openvasd_get_health_started (openvasd_connector_t conn)
   return response;
 }
 
+openvasd_resp_t
+openvasd_get_performance (openvasd_connector_t conn,
+                          openvasd_get_performance_opts_t opts)
+{
+  openvasd_resp_t response = NULL;
+  gchar *err = NULL;
+  CURL *hnd = NULL;
+  struct curl_slist *customheader = NULL;
+  time_t now;
+  time (&now);
+
+  response = g_malloc0 (sizeof (struct openvasd_response));
+
+  if (!opts.titles || !strcmp (opts.titles, "") || opts.start < 0
+      || opts.start > now || opts.end < 0 || opts.end > now)
+    {
+      response->code = RESP_CODE_ERR;
+      response->body =
+        g_strdup ("{\"error\": \"Couldn't send get_performance command "
+                  "to scanner. Bad or missing parameters.\"}");
+      return response;
+    }
+  gchar *query =
path: openvasd/openvasd.c
user: login: mattmundell
body: I'd like to see more consistency with the declarations. All the others are at the top of the block, even for example `hnd` which is first used below this.

Personally I'd also like you to drop the excess inits in general. Like response is set to NULL then it's set again basically straight away.
created_at: 2025-03-04T15:41:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1591,6 +1589,56 @@ openvasd_get_health_started (openvasd_connector_t conn)
   return response;
 }
 
+openvasd_resp_t
+openvasd_get_performance (openvasd_connector_t conn,
+                          openvasd_get_performance_opts_t opts)
+{
+  openvasd_resp_t response = NULL;
+  gchar *err = NULL;
+  CURL *hnd = NULL;
+  struct curl_slist *customheader = NULL;
+  time_t now;
+  time (&now);
path: openvasd/openvasd.c
user: login: mattmundell
body: ```suggestion

  time (&now);
```
created_at: 2025-03-04T15:41:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1591,6 +1589,56 @@ openvasd_get_health_started (openvasd_connector_t conn)
   return response;
 }
 
+openvasd_resp_t
+openvasd_get_performance (openvasd_connector_t conn,
+                          openvasd_get_performance_opts_t opts)
+{
+  openvasd_resp_t response = NULL;
+  gchar *err = NULL;
+  CURL *hnd = NULL;
+  struct curl_slist *customheader = NULL;
+  time_t now;
+  time (&now);
+
+  response = g_malloc0 (sizeof (struct openvasd_response));
+
+  if (!opts.titles || !strcmp (opts.titles, "") || opts.start < 0
+      || opts.start > now || opts.end < 0 || opts.end > now)
+    {
+      response->code = RESP_CODE_ERR;
+      response->body =
+        g_strdup ("{\"error\": \"Couldn't send get_performance command "
+                  "to scanner. Bad or missing parameters.\"}");
+      return response;
+    }
+  gchar *query =
+    g_strdup_printf ("/health/performance?start=%d&end=%d&titles=%s",
+                     opts.start, opts.end, opts.titles);
+  customheader = init_customheader (conn->apikey, FALSE);
+  hnd = handler (conn, GET, query, NULL, customheader, &err);
+  if (hnd == NULL)
+    {
+      curl_slist_free_all (customheader);
+      response->code = RESP_CODE_ERR;
+      response->body = err;
+      return response;
+    }
+
+  openvasd_send_request (hnd, NULL, response);
+  curl_slist_free_all (customheader);
+  if (response->code != RESP_CODE_ERR)
+    response->body = g_strdup (openvasd_vt_stream_str (conn));
+  else if (response->code == RESP_CODE_ERR)
path: openvasd/openvasd.c
user: login: mattmundell
body: Hmm, this is like this everywhere in this file. I'm happy to do them all as a PR.
created_at: 2025-03-04T15:42:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -110,6 +110,13 @@ struct openvasd_scan_status
   long response_code;
 };
 
+typedef struct
+{
+  int start;    /**< Start interval. */
+  int end;      /**< End interval. */
+  gchar *titles; /**< Graph title. */
path: openvasd/openvasd.h
user: login: mattmundell
body: This should actually also be a `const`. The code only needs to read `titles`.
created_at: 2025-03-24T21:48:59Z
author_association: CONTRIBUTOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-03-04T14:51:58Z
body: <h1>Dependency Review</h1>
✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.<h2>Snapshot Warnings</h2>
<blockquote>⚠️: No snapshots were found for the head SHA a5d4bab443caf11cfb3e20cca4d49c64895870dc.</blockquote>
Ensure that dependencies are being submitted on PR branches and consider enabling <em>retry-on-snapshot-warnings</em>. See <a href="https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#best-practices-for-using-the-dependency-review-api-and-the-dependency-submission-api-together">the documentation</a> for more information and troubleshooting advice.<h2>OpenSSF Scorecard</h2>
<table><tr><th>Package</th><th>Version</th><th>Score</th><th>Details</th></tr>
</table><h2>Scanned Files</h2>
<ul>


<!-- dependency-review-pr-comment-marker -->
author_association: NONE
user: login: jjnicola
created_at: 2025-03-04T14:53:34Z
body: Depends on greenbone/openvas-scanner#1859

author_association: MEMBER
user: login: github-actions[bot]
created_at: 2025-03-04T14:56:50Z
body: <!-- Docker Scout | cves | Build & Push Container Images -- build-and-push -->

<h2>:mag: Vulnerabilities of <code>harbor-os.greenbone.net/community/gvm-libs:900-merge-amd64</code></h2>

<details open="true"><summary>:package: Image Reference</strong> <code>harbor-os.greenbone.net/community/gvm-libs:900-merge-amd64</code></summary>
<table>
<tr><td>digest</td><td><code>sha256:69727bc1acfeb7d228985dfea7a746f016674caccd6baab9752ed072419e816a</code></td><tr><tr><td>vulnerabilities</td><td><img alt="critical: 0" src="https://img.shields.io/badge/critical-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/high-0-lightgrey"/> <img alt="medium: 2" src="https://img.shields.io/badge/medium-2-fbb552"/> <img alt="low: 22" src="https://img.shields.io/badge/low-22-fce1a9"/> <!-- unspecified: 0 --></td></tr>
<tr><td>size</td><td>66 MB</td></tr>
<tr><td>packages</td><td>201</td></tr>
</table>
</details>
<details><summary>:package: Base Image</strong> <code>debian:testing-20250317-slim</code></summary>
<table>
<tr><td>also known as</td>
<td><ul>
<li><code>testing-slim</code></li>
</ul>
</td></tr>
<tr><td>digest</td><td><code>sha256:474f359b3e4947d76de8cdda2f537972226dc72de02db5a25c8bf6b556def37e</code></td></tr>
<tr><td>vulnerabilities</td><td><img alt="critical: 0" src="https://img.shields.io/badge/critical-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/high-0-lightgrey"/> <img alt="medium: 1" src="https://img.shields.io/badge/medium-1-fbb552"/> <img alt="low: 11" src="https://img.shields.io/badge/low-11-fce1a9"/> <!-- unspecified: 0 --></td></tr>
</table>
</details>

<table>
<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 1" src="https://img.shields.io/badge/M-1-fbb552"/> <img alt="low: 1" src="https://img.shields.io/badge/L-1-fce1a9"/> <!-- unspecified: 0 --><strong>libgcrypt20</strong> <code>1.11.0-7</code> (deb)</summary>

<small><code>pkg:deb/debian/libgcrypt20@1.11.0-7?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2024-2236?s=debian&n=libgcrypt20&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D1.11.0-7"><img alt="medium : CVE--2024--2236" src="https://img.shields.io/badge/CVE--2024--2236-lightgrey?label=medium%20&labelColor=fbb552"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=1.11.0-7</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.54%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>65th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

---
- libgcrypt20 <unfixed> (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1065683)
[bookworm] - libgcrypt20 <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - libgcrypt20 <no-dsa> (Minor issue)
[buster] - libgcrypt20 <postponed> (Minor issue; side-channel timing attack)
https://bugzilla.redhat.com/show_bug.cgi?id=2268268
https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html
https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt
https://people.redhat.com/~hkario/marvin/
https://dev.gnupg.org/T7136
https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2018-6829?s=debian&n=libgcrypt20&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D1.11.0-7"><img alt="low : CVE--2018--6829" src="https://img.shields.io/badge/CVE--2018--6829-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=1.11.0-7</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.84%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>72nd percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

---
- libgcrypt20 <unfixed> (unimportant)
- libgcrypt11 <removed> (unimportant)
- gnupg1 <unfixed> (unimportant)
- gnupg <removed> (unimportant)
https://github.com/weikengchen/attack-on-libgcrypt-elgamal
https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki
https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html
GnuPG uses ElGamal in hybrid mode only.
This is not a vulnerability in libgcrypt, but in an application using
it in an insecure manner, see also
https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004401.html

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 1" src="https://img.shields.io/badge/M-1-fbb552"/> <img alt="low: 0" src="https://img.shields.io/badge/L-0-lightgrey"/> <!-- unspecified: 0 --><strong>libcap2</strong> <code>1:2.66-5+b1</code> (deb)</summary>

<small><code>pkg:deb/debian/libcap2@1:2.66-5%2Bb1?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2025-1390?s=debian&n=libcap2&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3C1%3A2.73-4"><img alt="medium : CVE--2025--1390" src="https://img.shields.io/badge/CVE--2025--1390-lightgrey?label=medium%20&labelColor=fbb552"/></a> 

<table>
<tr><td>Affected range</td><td><code><1:2.73-4</code></td></tr>
<tr><td>Fixed version</td><td><code>1:2.73-4</code></td></tr>
<tr><td>EPSS Score</td><td><code>0.01%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>1st percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.

---
- libcap2 1:2.73-4 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098318)
[bookworm] - libcap2 <no-dsa> (Minor issue)
https://bugzilla.openanolis.cn/show_bug.cgi?id=18804
Fixed by: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=1ad42b66c3567481cc5fa22fc1ba1556a316d878 (cap/v1.2.74-rc4)

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 4" src="https://img.shields.io/badge/L-4-fce1a9"/> <!-- unspecified: 0 --><strong>openldap</strong> <code>2.6.9+dfsg-2</code> (deb)</summary>

<small><code>pkg:deb/debian/openldap@2.6.9%2Bdfsg-2?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2020-15719?s=debian&n=openldap&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D2.6.9%2Bdfsg-2"><img alt="low : CVE--2020--15719" src="https://img.shields.io/badge/CVE--2020--15719-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=2.6.9+dfsg-2</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.41%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>59th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

---
- openldap <unfixed> (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965184)
https://bugs.openldap.org/show_bug.cgi?id=9266
https://bugzilla.redhat.com/show_bug.cgi?id=1740070
RedHat/CentOS applied patch: https://git.centos.org/rpms/openldap/raw/67459960064be9d226d57c5f82aaba0929876813/f/SOURCES/openldap-tlso-dont-check-cn-when-bad-san.patch
OpenLDAP upstream did dispute the issue as beeing valid, as the current libldap
behaviour does conform with RFC4513. RFC6125 does not superseed the rules for
verifying service identity provided in specifications for existing application
protocols published prior to RFC6125, like RFC4513 for LDAP.

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2017-17740?s=debian&n=openldap&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D2.6.9%2Bdfsg-2"><img alt="low : CVE--2017--17740" src="https://img.shields.io/badge/CVE--2017--17740-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=2.6.9+dfsg-2</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>5.76%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>89th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

---
- openldap <unfixed> (unimportant)
http://www.openldap.org/its/index.cgi/Incoming?id=8759
nops slapd-module not built

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2017-14159?s=debian&n=openldap&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D2.6.9%2Bdfsg-2"><img alt="low : CVE--2017--14159" src="https://img.shields.io/badge/CVE--2017--14159-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=2.6.9+dfsg-2</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.08%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>22nd percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript.

---
- openldap <unfixed> (unimportant)
http://www.openldap.org/its/index.cgi?findid=8703
Negligible security impact, but filed #877512

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2015-3276?s=debian&n=openldap&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D2.6.9%2Bdfsg-2"><img alt="low : CVE--2015--3276" src="https://img.shields.io/badge/CVE--2015--3276-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=2.6.9+dfsg-2</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>1.59%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>80th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

---
- openldap <unfixed> (unimportant)
Debian builds with GNUTLS, not NSS

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 4" src="https://img.shields.io/badge/L-4-fce1a9"/> <!-- unspecified: 0 --><strong>systemd</strong> <code>257.4-3</code> (deb)</summary>

<small><code>pkg:deb/debian/systemd@257.4-3?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2023-31439?s=debian&n=systemd&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D257.4-3"><img alt="low : CVE--2023--31439" src="https://img.shields.io/badge/CVE--2023--31439-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=257.4-3</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.12%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>28th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

---
- systemd <unfixed> (unimportant)
Disputed by upstream
https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2023-31438?s=debian&n=systemd&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D257.4-3"><img alt="low : CVE--2023--31438" src="https://img.shields.io/badge/CVE--2023--31438-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=257.4-3</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.12%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>28th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

---
- systemd <unfixed> (unimportant)
Disputed by upstream
https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2023-31437?s=debian&n=systemd&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D257.4-3"><img alt="low : CVE--2023--31437" src="https://img.shields.io/badge/CVE--2023--31437-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=257.4-3</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.11%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>26th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

---
- systemd <unfixed> (unimportant)
Disputed by upstream
https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2013-4392?s=debian&n=systemd&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D257.4-3"><img alt="low : CVE--2013--4392" src="https://img.shields.io/badge/CVE--2013--4392-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=257.4-3</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.14%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>31st percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

---
- systemd <unfixed> (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)
[wheezy] - systemd <not-affected> (/etc/tmpfiles.d not supported in Wheezy)
https://bugzilla.redhat.com/show_bug.cgi?id=859060
only relevant to systems running systemd along with selinux

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 3" src="https://img.shields.io/badge/L-3-fce1a9"/> <!-- unspecified: 0 --><strong>krb5</strong> <code>1.21.3-5</code> (deb)</summary>

<small><code>pkg:deb/debian/krb5@1.21.3-5?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2024-26461?s=debian&n=krb5&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D1.21.3-5"><img alt="low : CVE--2024--26461" src="https://img.shields.io/badge/CVE--2024--26461-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=1.21.3-5</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.18%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>37th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

---
- krb5 <unfixed> (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098754; unimportant)
https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md
Fixed by: https://github.com/krb5/krb5/commit/c5f9c816107f70139de11b38aa02db2f1774ee0d
Codepath cannot be triggered via API calls, negligible security impact
https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2024-26458?s=debian&n=krb5&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D1.21.3-5"><img alt="low : CVE--2024--26458" src="https://img.shields.io/badge/CVE--2024--26458-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=1.21.3-5</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.06%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>15th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

---
- krb5 <unfixed> (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098754; unimportant)
https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md
Fixed by: https://github.com/krb5/krb5/commit/c5f9c816107f70139de11b38aa02db2f1774ee0d
Unused codepath, negligible security impact
https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2018-5709?s=debian&n=krb5&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D1.21.3-5"><img alt="low : CVE--2018--5709" src="https://img.shields.io/badge/CVE--2018--5709-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=1.21.3-5</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.87%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>73rd percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

---
- krb5 <unfixed> (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889684)
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
non-issue, codepath is only run on trusted input, potential integer
overflow is non-issue

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 2" src="https://img.shields.io/badge/L-2-fce1a9"/> <!-- unspecified: 0 --><strong>coreutils</strong> <code>9.5-1+b1</code> (deb)</summary>

<small><code>pkg:deb/debian/coreutils@9.5-1%2Bb1?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2017-18018?s=debian&n=coreutils&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D9.5-1"><img alt="low : CVE--2017--18018" src="https://img.shields.io/badge/CVE--2017--18018-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=9.5-1</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.04%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>11th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

---
- coreutils <unfixed> (unimportant)
http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html
https://www.openwall.com/lists/oss-security/2018/01/04/3
Documentation patches proposed:
https://lists.gnu.org/archive/html/coreutils/2017-12/msg00072.html
https://lists.gnu.org/archive/html/coreutils/2017-12/msg00073.html
Neutralised by kernel hardening

</blockquote>
</details>

<a href="https://scout.docker.com/v/CVE-2016-2781?s=debian&n=coreutils&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D9.5-1"><img alt="low : CVE--2016--2781" src="https://img.shields.io/badge/CVE--2016--2781-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=9.5-1</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.07%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>19th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

---
- coreutils <unfixed> (low; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816320)
[bookworm] - coreutils <ignored> (Minor issue)
[bullseye] - coreutils <ignored> (Minor issue)
[buster] - coreutils <ignored> (Minor issue)
[stretch] - coreutils <ignored> (Minor issue)
[jessie] - coreutils <ignored> (Minor issue)
[wheezy] - coreutils <ignored> (Minor issue)
Restricting ioctl on the kernel side seems the better approach, but rejected by Linux upstream
Fixing this issue via setsid() would introduce regressions:
https://www.kernel.org/pub/linux/utils/util-linux/v2.28/v2.28-ReleaseNotes

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 1" src="https://img.shields.io/badge/L-1-fce1a9"/> <!-- unspecified: 0 --><strong>perl</strong> <code>5.40.1-2</code> (deb)</summary>

<small><code>pkg:deb/debian/perl@5.40.1-2?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2011-4116?s=debian&n=perl&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D5.40.1-2"><img alt="low : CVE--2011--4116" src="https://img.shields.io/badge/CVE--2011--4116-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=5.40.1-2</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.81%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>72nd percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

---
- perl <unfixed> (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776268)
http://thread.gmane.org/gmane.comp.security.oss.general/6174/focus=6177
https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 1" src="https://img.shields.io/badge/L-1-fce1a9"/> <!-- unspecified: 0 --><strong>util-linux</strong> <code>2.40.4-5</code> (deb)</summary>

<small><code>pkg:deb/debian/util-linux@2.40.4-5?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2022-0563?s=debian&n=util-linux&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D2.40.4-5"><img alt="low : CVE--2022--0563" src="https://img.shields.io/badge/CVE--2022--0563-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=2.40.4-5</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.02%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>3rd percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

---
- util-linux <unfixed> (unimportant)
https://bugzilla.redhat.com/show_bug.cgi?id=2053151
https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u
https://github.com/util-linux/util-linux/commit/faa5a3a83ad0cb5e2c303edbfd8cd823c9d94c17
util-linux in Debian does build with readline support but chfn and chsh are provided
by src:shadow and util-linux is configured with --disable-chfn-chsh

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 1" src="https://img.shields.io/badge/L-1-fce1a9"/> <!-- unspecified: 0 --><strong>tar</strong> <code>1.35+dfsg-3.1</code> (deb)</summary>

<small><code>pkg:deb/debian/tar@1.35%2Bdfsg-3.1?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2005-2541?s=debian&n=tar&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D1.35%2Bdfsg-3.1"><img alt="low : CVE--2005--2541" src="https://img.shields.io/badge/CVE--2005--2541-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=1.35+dfsg-3.1</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>2.54%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>84th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

---
This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag
- tar <unfixed> (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328228; unimportant)

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 1" src="https://img.shields.io/badge/L-1-fce1a9"/> <!-- unspecified: 0 --><strong>sqlite3</strong> <code>3.46.1-2</code> (deb)</summary>

<small><code>pkg:deb/debian/sqlite3@3.46.1-2?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2021-45346?s=debian&n=sqlite3&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D3.46.1-2"><img alt="low : CVE--2021--45346" src="https://img.shields.io/badge/CVE--2021--45346-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=3.46.1-2</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.17%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>35th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

---
- sqlite3 <unfixed> (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005974)
- sqlite <removed> (unimportant)
https://github.com/guyinatuxedo/sqlite3_record_leaking
https://bugzilla.redhat.com/show_bug.cgi?id=2054793
https://sqlite.org/forum/forumpost/056d557c2f8c452ed5bb9c215414c802b215ce437be82be047726e521342161e
Negligible security impact

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 1" src="https://img.shields.io/badge/L-1-fce1a9"/> <!-- unspecified: 0 --><strong>glib2.0</strong> <code>2.84.0-2</code> (deb)</summary>

<small><code>pkg:deb/debian/glib2.0@2.84.0-2?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2012-0039?s=debian&n=glib2.0&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D2.84.0-2"><img alt="low : CVE--2012--0039" src="https://img.shields.io/badge/CVE--2012--0039-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=2.84.0-2</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.49%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>63rd percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.

---
- glib2.0 <unfixed> (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655044)

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 1" src="https://img.shields.io/badge/L-1-fce1a9"/> <!-- unspecified: 0 --><strong>openssl</strong> <code>3.4.1-1</code> (deb)</summary>

<small><code>pkg:deb/debian/openssl@3.4.1-1?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2010-0928?s=debian&n=openssl&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D3.2.2-1"><img alt="low : CVE--2010--0928" src="https://img.shields.io/badge/CVE--2010--0928-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=3.2.2-1</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.09%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>24th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

---
http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
https://github.com/openssl/openssl/discussions/24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 1" src="https://img.shields.io/badge/L-1-fce1a9"/> <!-- unspecified: 0 --><strong>gnutls28</strong> <code>3.8.9-2</code> (deb)</summary>

<small><code>pkg:deb/debian/gnutls28@3.8.9-2?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2011-3389?s=debian&n=gnutls28&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D3.8.9-2"><img alt="low : CVE--2011--3389" src="https://img.shields.io/badge/CVE--2011--3389-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=3.8.9-2</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>4.62%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>88th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

---
- sun-java6 <removed> (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645881)
[lenny] - sun-java6 <no-dsa> (Non-free not supported)
[squeeze] - sun-java6 <no-dsa> (Non-free not supported)
- openjdk-6 6b23~pre11-1
- openjdk-7 7~b147-2.0-1
- iceweasel <not-affected> (Vulnerable code not present)
http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/
- chromium-browser 15.0.874.106~r107270-1
[squeeze] - chromium-browser <end-of-life>
- lighttpd 1.4.30-1
strictly speaking this is no lighttpd issue, but lighttpd adds a workaround
- curl 7.24.0-1
http://curl.haxx.se/docs/adv_20120124B.html
- python2.6 2.6.8-0.1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684511)
[squeeze] - python2.6 <no-dsa> (Minor issue)
- python2.7 2.7.3~rc1-1
- python3.1 <unfixed> (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678998)
[squeeze] - python3.1 <no-dsa> (Minor issue)
- python3.2 3.2.3~rc1-1
http://bugs.python.org/issue13885
python3.1 is fixed starting 3.1.5
- cyassl <removed>
- gnutls26 <removed> (unimportant)
- gnutls28 <unfixed> (unimportant)
No mitigation for gnutls, it is recommended to use TLS 1.1 or 1.2 which is supported since 2.0.0
- haskell-tls <unfixed> (unimportant)
No mitigation for haskell-tls, it is recommended to use TLS 1.1, which is supported since 0.2
- matrixssl <removed> (low)
[squeeze] - matrixssl <no-dsa> (Minor issue)
[wheezy] - matrixssl <no-dsa> (Minor issue)
matrixssl fix this upstream in 3.2.2
- bouncycastle 1.49+dfsg-1
[squeeze] - bouncycastle <no-dsa> (Minor issue)
[wheezy] - bouncycastle <no-dsa> (Minor issue)
No mitigation for bouncycastle, it is recommended to use TLS 1.1, which is supported since 1.4.9
- nss 3.13.1.with.ckbi.1.88-1
https://bugzilla.mozilla.org/show_bug.cgi?id=665814
https://hg.mozilla.org/projects/nss/rev/7f7446fcc7ab
- polarssl <unfixed> (unimportant)
No mitigation for polarssl, it is recommended to use TLS 1.1, which is supported in all releases
- tlslite <removed>
[wheezy] - tlslite <no-dsa> (Minor issue)
- pound 2.6-2
Pound 2.6-2 added an anti_beast.patch to mitigate BEAST attacks.
- erlang 1:15.b-dfsg-1
[squeeze] - erlang <no-dsa> (Minor issue)
- asterisk 1:13.7.2~dfsg-1
[jessie] - asterisk 1:11.13.1~dfsg-2+deb8u1
[wheezy] - asterisk <no-dsa> (Minor issue)
[squeeze] - asterisk <end-of-life> (Not supported in Squeeze LTS)
http://downloads.digium.com/pub/security/AST-2016-001.html
https://issues.asterisk.org/jira/browse/ASTERISK-24972
patch for 11 (jessie): https://code.asterisk.org/code/changelog/asterisk?cs=f233bcd81d85626ce5bdd27b05bc95d131faf3e4
all versions vulnerable, backport required for wheezy

</blockquote>
</details>
</details></td></tr>

<tr><td valign="top">
<details><summary><img alt="critical: 0" src="https://img.shields.io/badge/C-0-lightgrey"/> <img alt="high: 0" src="https://img.shields.io/badge/H-0-lightgrey"/> <img alt="medium: 0" src="https://img.shields.io/badge/M-0-lightgrey"/> <img alt="low: 1" src="https://img.shields.io/badge/L-1-fce1a9"/> <!-- unspecified: 0 --><strong>pam</strong> <code>1.7.0-3</code> (deb)</summary>

<small><code>pkg:deb/debian/pam@1.7.0-3?os_distro=trixie&os_name=debian&os_version=unstable</code></small><br/>
<a href="https://scout.docker.com/v/CVE-2024-10963?s=debian&n=pam&ns=debian&t=deb&osn=debian&osv=unstable&vr=%3E%3D1.7.0-3"><img alt="low : CVE--2024--10963" src="https://img.shields.io/badge/CVE--2024--10963-lightgrey?label=low%20&labelColor=fce1a9"/></a> 

<table>
<tr><td>Affected range</td><td><code>>=1.7.0-3</code></td></tr>
<tr><td>Fixed version</td><td><strong>Not Fixed</strong></td></tr>
<tr><td>EPSS Score</td><td><code>0.16%</code></td></tr>
<tr><td>EPSS Percentile</td><td><code>34th percentile</code></td></tr>
</table>

<details><summary>Description</summary>
<blockquote>

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

---
- pam <unfixed> (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1087019)
[bookworm] - pam <not-affected> (The vulnerable code was introduced in 1.5.3)
[bullseye] - pam <not-affected> (The vulnerable code was introduced in 1.5.3)
https://bugzilla.redhat.com/show_bug.cgi?id=2324291
https://github.com/linux-pam/linux-pam/issues/834
Introduced in https://github.com/linux-pam/linux-pam/commit/23393bef92c1e768eda329813d7af55481c6ca9f (v1.5.3)

</blockquote>
</details>
</details></td></tr>
</table>


author_association: NONE