Deps: Bump github/codeql-action from 3.29.4 to 3.29.8 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: github/codeql-action.

Updates github/codeql-action from 3.29.4 to 3.29.8

Release notes

Sourced from github/codeql-action's releases.

v3.29.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.8 - 08 Aug 2025

• Fix an issue where the Action would autodetect unsupported languages such as HTML. #3015

See the full CHANGELOG.md for more information.

v3.29.7

This is a re-release of v3.29.5 to mitigate an issue that was discovered with v3.29.6.

v3.29.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.6 - 07 Aug 2025

• The cleanup-level input to the analyze Action is now deprecated. The CodeQL Action has written a limited amount of intermediate results to the database since version 2.2.5, and now automatically manages cleanup. #2999
• Update default CodeQL bundle version to 2.22.3. #3000

See the full CHANGELOG.md for more information.

v3.29.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.5 - 29 Jul 2025

• Update default CodeQL bundle version to 2.22.2. #2986

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.29.8 - 08 Aug 2025

• Fix an issue where the Action would autodetect unsupported languages such as HTML. #3015

3.29.7 - 07 Aug 2025

This release rolls back 3.29.6 to address issues with language autodetection. It is identical to 3.29.5.

3.29.6 - 07 Aug 2025

• The cleanup-level input to the analyze Action is now deprecated. The CodeQL Action has written a limited amount of intermediate results to the database since version 2.2.5, and now automatically manages cleanup. #2999
• Update default CodeQL bundle version to 2.22.3. #3000

3.29.5 - 29 Jul 2025

• Update default CodeQL bundle version to 2.22.2. #2986

3.29.4 - 23 Jul 2025

No user facing changes.

3.29.3 - 21 Jul 2025

No user facing changes.

3.29.2 - 30 Jun 2025

• Experimental: When the quality-queries input for the init action is provided with an argument, separate .quality.sarif files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2935

3.29.1 - 27 Jun 2025

• Fix bug in PR analysis where user-provided include query filter fails to exclude non-included queries. #2938
• Update default CodeQL bundle version to 2.22.1. #2950

3.29.0 - 11 Jun 2025

• Update default CodeQL bundle version to 2.22.0. #2925
• Bump minimum CodeQL bundle version to 2.16.6. #2912

3.28.21 - 28 July 2025

No user facing changes.

... (truncated)

Commits

• 76621b6 Merge pull request #3019 from github/update-v3.29.8-679a40d33
• 29ac3ce Add release notes for 3.29.7
• 737cfde Update changelog for v3.29.8
• 679a40d Merge pull request #3014 from github/henrymercer/rebuild-dispatch
• 6fe50b2 Merge pull request #3015 from github/henrymercer/language-autodetection-worka...
• 6bc91d6 Add changelog note
• 6b4fedc Bump Action patch version
• 5794ffc Fix auto-detection of extractors that aren't languages
• bd62bf4 Finish in-progress merges
• 2afb4e6 Avoid specifying branch unnecessarily
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/github/codeql-action/analyze	76621b61decf072c1cee8dd1ce2d2a82d33c17ed	Unknown	Unknown
actions/github/codeql-action/init	76621b61decf072c1cee8dd1ce2d2a82d33c17ed	Unknown	Unknown

Scanned Files

• .github/workflows/codeql-analysis-python.yml

[github-actions]

Conventional Commits Report

Type	Number
Dependencies	1

🚀 Conventional commits found.

[github-actions]

🔍 Vulnerabilities of harbor-os.greenbone.net/community/gvm-tools:1241-merge-amd64

📦 Image Reference harbor-os.greenbone.net/community/gvm-tools:1241-merge-amd64

digest	sha256:24823f836e1ac2b25d2c437e71ad8a3092915de9d6170f6f9c6df443010cd3d3
vulnerabilities
size	83 MB
packages	180

📦 Base Image debian:stable-20250721-slim

also known as	stable-slim
digest	sha256:3249eafa46d713ba80c92f750b222ba4bfb8a7a71f52ad9925cedbc2f11aa208
vulnerabilities

zlib 1:1.2.13.dfsg-1 (deb) pkg:deb/debian/zlib@1:1.2.13.dfsg-1?os_distro=trixie&os_name=debian&os_version=13 Affected range <1:1.3.dfsg-2 Fixed version 1:1.3.dfsg-2 EPSS Score 0.51% EPSS Percentile 65th percentile Description MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API. zlib 1:1.3.dfsg-2 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054290) [bookworm] - zlib (contrib/minizip not built and src:zlib not producing binary packages) [bullseye] - zlib (contrib/minizip not built and src:zlib not producing binary packages) [buster] - zlib (contrib/minizip not built and src:zlib not producing binary packages) minizip (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056718) [bookworm] - minizip 1.1-8+deb12u1 [bullseye] - minizip 1.1-8+deb11u1 minizip: Check length of comment, filename, and extra field, in zipOpenNewFileInZip4_64 madler/zlib#843 madler/zlib@73331a6 src:zlib only starts building minizip starting in 1:1.2.13.dfsg-2 For older suites due to this an update can be ignored as no binary package built by the vulnerable source is affected (i.e. contrib/minizip not built and provided in those versions).

gnutls28 3.7.9-2+deb12u5 (deb) pkg:deb/debian/gnutls28@3.7.9-2%2Bdeb12u5?os_distro=trixie&os_name=debian&os_version=13 Affected range <3.8.3-1 Fixed version 3.8.3-1 EPSS Score 1.01% EPSS Percentile 76th percentile Description A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack. gnutls28 3.8.3-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061045) [bookworm] - gnutls28 3.7.9-2+deb12u2 [bullseye] - gnutls28 3.7.1-5+deb11u5 [buster] - gnutls28 (Vulnerabity introduced in 3.7) https://gitlab.com/gnutls/gnutls/-/issues/1521 https://gnutls.org/security-new.html#GNUTLS-SA-2024-01-09 https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html https://gitlab.com/gnutls/gnutls/-/commit/9edbdaa84e38b1bfb53a7d72c1de44f8de373405 (3.8.3) Affected range <3.8.3-1 Fixed version 3.8.3-1 EPSS Score 1.03% EPSS Percentile 76th percentile Description A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. gnutls28 3.8.3-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061046) [bookworm] - gnutls28 3.7.9-2+deb12u2 [bullseye] - gnutls28 3.7.1-5+deb11u5 https://gitlab.com/gnutls/gnutls/-/issues/1522 https://gnutls.org/security-new.html#GNUTLS-SA-2024-01-14 https://gitlab.com/gnutls/gnutls/-/commit/40dbbd8de499668590e8af51a15799fbc430595e (3.8.3) https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html Issue exists because of incomplete fix for CVE-2023-5981 Affected range <3.8.9-3 Fixed version 3.8.9-3 EPSS Score 0.05% EPSS Percentile 16th percentile Description A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite(). gnutls28 3.8.9-3 https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html https://gitlab.com/gnutls/gnutls/-/issues/1718 Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/23135619773e6ec087ff2abc65405bd4d5676bad (3.8.10) Affected range <3.8.9-3 Fixed version 3.8.9-3 EPSS Score 0.06% EPSS Percentile 18th percentile Description A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system. gnutls28 3.8.9-3 https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html https://gitlab.com/gnutls/gnutls/-/issues/1696 Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/408bed40c36a4cc98f0c94a818f682810f731f32 (3.8.10) Affected range <3.8.9-3 Fixed version 3.8.9-3 EPSS Score 0.05% EPSS Percentile 16th percentile Description A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior. gnutls28 3.8.9-3 https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html https://gitlab.com/gnutls/gnutls/-/issues/1694 Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/608829769cbc247679ffe98841109fc73875e573 (3.8.10) Affected range <3.8.2-1 Fixed version 3.8.2-1 EPSS Score 0.56% EPSS Percentile 67th percentile Description A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. gnutls28 3.8.2-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056188) [bookworm] - gnutls28 3.7.9-2+deb12u1 [bullseye] - gnutls28 3.7.1-5+deb11u4 https://gitlab.com/gnutls/gnutls/-/issues/1511 https://gnutls.org/security-new.html#GNUTLS-SA-2023-10-23 https://lists.gnupg.org/pipermail/gnutls-help/2023-November/004837.html Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/29d6298d0b04cfff970b993915db71ba3f580b6d (3.8.2) Fixing this issue incompletely opens up CVE-2024-0553 Affected range <3.8.4-2 Fixed version 3.8.4-2 EPSS Score 1.54% EPSS Percentile 81st percentile Description A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel. [experimental] - gnutls28 3.8.4-1 gnutls28 3.8.4-2 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067464) [bookworm] - gnutls28 3.7.9-2+deb12u3 [buster] - gnutls28 (Vulnerable code not present) https://gitlab.com/gnutls/gnutls/-/issues/1516 https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html https://www.gnutls.org/security-new.html#GNUTLS-SA-2023-12-04 Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/1c4701ffc342259fc5965d5a0de90d87f780e3e5 (3.8.4) Introduced with: https://gitlab.com/gnutls/gnutls/-/merge_requests/1051 (gnutls_3_6_10) Affected range <3.8.9-2 Fixed version 3.8.9-2 EPSS Score 0.75% EPSS Percentile 72nd percentile Description A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition. [experimental] - gnutls28 3.8.9-1 gnutls28 3.8.9-2 https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-02-07 https://lists.gnupg.org/pipermail/gnutls-help/2025-February/004875.html https://gitlab.com/gnutls/gnutls/-/issues/1553 Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/4760bc63531e3f5039e70ede91a20e1194410892 (3.8.9) Affected range <3.8.4-2 Fixed version 3.8.4-2 EPSS Score 0.01% EPSS Percentile 2nd percentile Description A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command. [experimental] - gnutls28 3.8.4-1 gnutls28 3.8.4-2 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067463) [bookworm] - gnutls28 3.7.9-2+deb12u3 [buster] - gnutls28 (Vulnerable code not present) https://bugzilla.redhat.com/show_bug.cgi?id=2269084 https://gitlab.com/gnutls/gnutls/-/issues/1525 https://gitlab.com/gnutls/gnutls/-/issues/1527 https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html https://www.gnutls.org/security-new.html#GNUTLS-SA-2024-01-23 Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/e369e67a62f44561d417cb233acc566cc696d82d (3.8.4) Introduced with: https://gitlab.com/gnutls/gnutls/-/commit/d268f19510a95f92d11d8f8dc7d94fcae4d765cc (3.7.0) Affected range <3.8.9-3 Fixed version 3.8.9-3 EPSS Score 0.02% EPSS Percentile 4th percentile Description A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly. gnutls28 3.8.9-3 [bullseye] - gnutls28 (Vulnerable code introduced later) https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html https://gitlab.com/gnutls/gnutls/-/issues/1695 Introduced by: https://gitlab.com/gnutls/gnutls/-/commit/242abb6945cbb56c4a41c393d0253ea5b9d3a36a (3.7.3) Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/8e5ca951257202089246fa37e93a99d210ee5ca2 (3.8.10)

systemd 252.38-1~deb12u1 (deb) pkg:deb/debian/systemd@252.38-1~deb12u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <255.4-1 Fixed version 255.4-1 EPSS Score 47.86% EPSS Percentile 98th percentile Description The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. bind9 1:9.19.21-1 dnsmasq 2.90-1 [bookworm] - dnsmasq 2.90-4~deb12u1 knot-resolver 5.7.1-1 [bullseye] - knot-resolver (Too intrusive to backport, if DNSSEC is used Bookworm can be used) [buster] - knot-resolver (Too intrusive to backport, if DNSSEC is used Bookworm can be used) pdns-recursor 4.9.3-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063852) [bullseye] - pdns-recursor (No longer supported with security updates in Bullseye) unbound 1.19.1-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063845) systemd 255.4-1 [bookworm] - systemd 252.23-1~deb12u1 [buster] - systemd (DNSSEC is disabled by default in systemd-resolved; can be fixed via point release) dnsjava 3.6.2-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1077751) [bookworm] - dnsjava (Minor issue) [bullseye] - dnsjava (Minor issue) https://kb.isc.org/docs/cve-2023-50868 https://downloads.isc.org/isc/bind9/9.16.48/patches/0005-CVE-2023-50387-CVE-2023-50868.patch https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html https://www.knot-resolver.cz/2024-02-13-knot-resolver-5.7.1.html CZ-NIC/knot-resolver@e966b7f (v5.7.1) CZ-NIC/knot-resolver@eccb8e2 (v5.7.1) CZ-NIC/knot-resolver@b5051ac (v5.7.1) CZ-NIC/knot-resolver@24699e9 (v5.7.1) CZ-NIC/knot-resolver@a05cf1d (v5.7.1) CZ-NIC/knot-resolver@9b421cd (v5.7.1) CZ-NIC/knot-resolver@5e80624 CZ-NIC/knot-resolver@f9ba52e (v5.7.1) CZ-NIC/knot-resolver@b044bab (v5.7.1) https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released Fixed by: rec: CVE-2023-50387 and CVE-2023-50868 PowerDNS/pdns#13781 https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ https://nlnetlabs.nl/downloads/unbound/CVE-2023-50387_CVE-2023-50868.txt Fixed by: NLnetLabs/unbound@92f2a1c (release-1.19.1) Status of CVE-2023-50387 and CVE-2023-50868 unknown systemd/systemd#31413 systemd/systemd@67d0ce8 (v256) systemd/systemd@eba2911 (v256) systemd/systemd-stable@1ebdb19 (v255.4) systemd/systemd-stable@572692f (v255.4) systemd/systemd-stable@2f5edff (v254.10) systemd/systemd-stable@9899281 (v254.10) systemd/systemd-stable@7886eea (v253.17) systemd/systemd-stable@156e519 (v253.17) systemd/systemd-stable@7633d96 (v252.23) systemd/systemd-stable@b43bcb5 (v252.23) systemd: DNSSEC is default to off in systemd-resolved GHSA-mmwx-rj87-vfgr dnsjava/dnsjava@711af79 (v3.6.0) Affected range <255.4-1 Fixed version 255.4-1 EPSS Score 37.71% EPSS Percentile 97th percentile Description Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. bind9 1:9.19.21-1 dnsmasq 2.90-1 [bookworm] - dnsmasq 2.90-4~deb12u1 knot-resolver 5.7.1-1 [bullseye] - knot-resolver (Too intrusive to backport, if DNSSEC is used Bookworm can be used) [buster] - knot-resolver (Too intrusive to backport) pdns-recursor 4.9.3-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063852) [bullseye] - pdns-recursor (No longer supported with security updates in Bullseye) unbound 1.19.1-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063845) systemd 255.4-1 [bookworm] - systemd 252.23-1~deb12u1 [buster] - systemd (DNSSEC is disabled by default in systemd-resolved; can be fixed via point release) dnsjava 3.6.2-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1077750) [bookworm] - dnsjava (Minor issue) [bullseye] - dnsjava (Minor issue) https://kb.isc.org/docs/cve-2023-50387 https://gitlab.isc.org/isc-projects/bind9/-/commit/c12608ca934c0433d280e65fe6c631013e200cfe (v9.16.48) https://gitlab.isc.org/isc-projects/bind9/-/commit/751b7cc4750ede6d8c5232751d60aad8ad84aa67 (v9.16.48) https://gitlab.isc.org/isc-projects/bind9/-/commit/6a65a425283d70da86bf732449acd6d7c8dec718 (v9.16.48) https://gitlab.isc.org/isc-projects/bind9/-/commit/3d206e918b3efbc20074629ad9d99095fbd2e5fd (v9.16.48) https://gitlab.isc.org/isc-projects/bind9/-/commit/a520fbc0470a0d6b72db6aa0b8deda8798551614 (v9.16.48) https://downloads.isc.org/isc/bind9/9.16.48/patches/0005-CVE-2023-50387-CVE-2023-50868.patch https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html https://www.knot-resolver.cz/2024-02-13-knot-resolver-5.7.1.html CZ-NIC/knot-resolver@7ddabe8 CZ-NIC/knot-resolver@feb65eb (v5.7.1) CZ-NIC/knot-resolver@cc5051b (v5.7.1) https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released Fixed by: rec: CVE-2023-50387 and CVE-2023-50868 PowerDNS/pdns#13781 https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ https://nlnetlabs.nl/downloads/unbound/CVE-2023-50387_CVE-2023-50868.txt Fixed by: NLnetLabs/unbound@882903f (release-1.19.1) Status of CVE-2023-50387 and CVE-2023-50868 unknown systemd/systemd#31413 systemd/systemd@67d0ce8 (v256) systemd/systemd@eba2911 (v256) systemd/systemd-stable@1ebdb19 (v255.4) systemd/systemd-stable@572692f (v255.4) systemd/systemd-stable@2f5edff (v254.10) systemd/systemd-stable@9899281 (v254.10) systemd/systemd-stable@7886eea (v253.17) systemd/systemd-stable@156e519 (v253.17) systemd/systemd-stable@7633d96 (v252.23) systemd/systemd-stable@b43bcb5 (v252.23) systemd: DNSSEC is default to off in systemd-resolved GHSA-crjg-w57m-rqqf dnsjava/dnsjava@07ac36a (v3.6.0) dnsjava/dnsjava@3ddc45c (v3.6.0) Affected range <255.1-3 Fixed version 255.1-3 EPSS Score 0.30% EPSS Percentile 52nd percentile Description A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records. systemd 255.1-3 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059278) [bookworm] - systemd 252.21-1~deb12u1 [buster] - systemd (Minor issue) https://bugzilla.redhat.com/show_bug.cgi?id=2222672 resolved DNSSEC validation can be bypassed by MITM systemd/systemd#25676 systemd-resolved defaults to DNSSEC=no (disabled) everywhere, and is affected only when manually enabled. Introduced by: systemd/systemd@105e151 (v229) Fixed by: systemd/systemd@3b4cc14 (v256) Fixed by: systemd/systemd-stable@6da5ca9 (v255.2) Fixed by: systemd/systemd-stable@0292727 (v254.8) Fixed by: systemd/systemd-stable@5c149c7 (v253.15) Fixed by: systemd/systemd-stable@bb78da7 (v252.21) Fixed by: systemd/systemd-stable@f58fc88 (v251.20) Fixed by: systemd/systemd-stable@4ada129 (v250.14) Fixed by: systemd/systemd-stable@c8578ce (v249.17) Fixed by: systemd/systemd-stable@3a409b2 (v248.13) Affected range <257.6-1 Fixed version 257.6-1 EPSS Score 0.01% EPSS Percentile 1st percentile Description A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality. systemd 257.6-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1106785) https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt For a comprehensive fix a kernel change is required (to hand a pidfd to the usermode coredump helper): https://git.kernel.org/linus/b5325b2a270fcaf7b2a9a0f23d422ca8a5a8bdea Backports (src:linux): https://lore.kernel.org/linux-fsdevel/CAMw=ZnT4KSk_+Z422mEZVzfAkTueKvzdw=r9ZB2JKg5-1t6BDw@mail.gmail.com/ Fixed by: systemd/systemd@49f1f2d (main) Fixed by: systemd/systemd@0c49e00 (main) Fixed by: systemd/systemd@8fc7b2a (main) Follow up (optional): systemd/systemd@13902e0 (main) Follow up (optional): systemd/systemd@868d955 (main) Follow up (optional): systemd/systemd@e6a8687 (main) Follow up (optional): systemd/systemd@76e0ab4 (main) Follow up (optional): systemd/systemd@9ce8e3e (main) Fixed by: systemd/systemd@0c49e00 (v258) Fixed by: systemd/systemd@868d955 (v258) Fixed by: systemd/systemd@c58a8a6 (v257.6) Fixed by: systemd/systemd@6155669 (v257.6) Fixed by: systemd/systemd@19d4391 (v256.16) Fixed by: systemd/systemd-stable@254ab8d (v255.21) Fixed by: systemd/systemd-stable@7fc7aa5 (v254.26) Fixed by: systemd/systemd-stable@19b2286 (v253.33) Fixed by: systemd/systemd-stable@2eb46dc (v252.38) Issue relates to race condition exploitable while checking if a user should be allowed to read a core file or not via the grant_user_access() function, which was introduced as part of the fix for CVE-2022-4415.

perl 5.36.0-7+deb12u2 (deb) pkg:deb/debian/perl@5.36.0-7%2Bdeb12u2?os_distro=trixie&os_name=debian&os_version=13 Affected range <5.38.2-2 Fixed version 5.38.2-2 EPSS Score 0.91% EPSS Percentile 75th percentile Description CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. [experimental] - perl 5.38.0~rc2-1 perl 5.38.2-2 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1035109) [bookworm] - perl (Minor issue) [buster] - perl (Minor issue) Add verify_SSL=>1 to HTTP::Tiny in CPAN::HTTP::Client to verify https server identity andk/cpanpm#175 andk/cpanpm@9c98370 (2.35-TRIAL) Affected range <5.36.0-10 Fixed version 5.36.0-10 EPSS Score 0.14% EPSS Percentile 35th percentile Description A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer. perl 5.36.0-10 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746) [bookworm] - perl 5.36.0-7+deb12u1 [bullseye] - perl 5.32.1-4+deb11u3 [buster] - perl (Vulnerable code introduced later) Fixed by: Perl/perl5@12c313c (v5.34.2) Fixed by: Perl/perl5@7047915 (v5.36.2) Fixed by: Perl/perl5@92a9eb3 (v5.38.1) Fixed by: Perl/perl5@ff1f9f5 (bleed) Affected range <5.40.1-5 Fixed version 5.40.1-5 EPSS Score 0.01% EPSS Percentile 0th percentile Description Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6 [experimental] - perl 5.40.1-4 perl 5.40.1-5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226) [bookworm] - perl (Minor issue; Perl maintainer will fix it via point release) [bullseye] - perl (Minor issue, revisit when fixed upstream) Thread creation while a directory handle is open does a fchdir, affecting other threads (race condition) Perl/perl5#23010 Fixed by: Perl/perl5@fc8063a (v5.41.13) Fixed by: Perl/perl5@a1327b5 (v5.41.13) Fixed by: Perl/perl5@1f9097b (v5.41.13) Fixed by: Perl/perl5@5c2e757 (v5.41.13) Squashed version of fix (to help backports): Perl/perl5@918bfff https://lists.security.metacpan.org/cve-announce/msg/30017499/ Affected range <5.40.1-3 Fixed version 5.40.1-3 EPSS Score 0.05% EPSS Percentile 15th percentile Description A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the tr operator, S_do_trans_invmap can overflow the destination pointer d.    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses. perl 5.40.1-3 [bullseye] - perl (Vulnerable code introduced later) https://lists.security.metacpan.org/cve-announce/msg/28708725/ Introduced by: Perl/perl5@a311ee0 (v5.33.1) Fixed by: Perl/perl5@87f42aa Affected range <5.38.2-2 Fixed version 5.38.2-2 EPSS Score 0.45% EPSS Percentile 63rd percentile Description HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. libhttp-tiny-perl 0.088-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962407; unimportant) [experimental] - perl 5.38.0~rc2-1 perl 5.38.2-2 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=954089) https://www.openwall.com/lists/oss-security/2023/04/18/14 verify_SSL being true by default (redux) chansen/p5-http-tiny#134 https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/ https://hackeriet.github.io/cpan-http-tiny-overview/ Applications need to explicitly opt in to enable verification.

pam 1.5.2-6+deb12u1 (deb) pkg:deb/debian/pam@1.5.2-6%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <1.7.0-5 Fixed version 1.7.0-5 EPSS Score 0.02% EPSS Percentile 3rd percentile Description A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions. [experimental] - pam 1.7.0-4 pam 1.7.0-5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107919) https://www.openwall.com/lists/oss-security/2025/06/17/1 GHSA-f9p8-gjr4-j9gx Fixed by: linux-pam/linux-pam@475bd60 (v1.7.1) Fixed by: linux-pam/linux-pam@592d84e (v1.7.1) Fixed by: linux-pam/linux-pam@976c200 (v1.7.1) Affected range <1.5.3-4 Fixed version 1.5.3-4 EPSS Score 0.08% EPSS Percentile 24th percentile Description linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. [experimental] - pam 1.5.3-2 pam 1.5.3-4 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061097) [bookworm] - pam (Minor issue) [bullseye] - pam (Minor issue) [buster] - pam (Minor issue) https://www.openwall.com/lists/oss-security/2024/01/18/3 linux-pam/linux-pam@031bb5a (v1.6.0) Affected range <1.7.0-2 Fixed version 1.7.0-2 EPSS Score 0.03% EPSS Percentile 7th percentile Description A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications. [experimental] - pam 1.7.0-1 pam 1.7.0-2 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1086038) [bookworm] - pam (Minor issue; requires src:apparmor changes, cf #1110326) [bullseye] - pam (Minor issue; requires src:apparmor changes, cf #1110326, and may break SELINUX) https://bugzilla.redhat.com/show_bug.cgi?id=2319212 CVE-2024-10041 pam: libpam: Libpam vulnerable to read hashed password linux-pam/linux-pam#846 pam_unix/passverify: always run the helper to obtain shadow password file entries linux-pam/linux-pam#686 linux-pam/linux-pam@b3020da (v1.6.0) linux-pam/linux-pam@b7b9636 (v1.6.1) Affected range <1.7.0-5 Fixed version 1.7.0-5 EPSS Score 0.22% EPSS Percentile 44th percentile Description A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals. pam 1.7.0-5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1087019) [bookworm] - pam (The vulnerable code was introduced in 1.5.3) [bullseye] - pam (The vulnerable code was introduced in 1.5.3) https://bugzilla.redhat.com/show_bug.cgi?id=2324291 pam_access.so considers tty* names as hostnames linux-pam/linux-pam#834 Introduced in linux-pam/linux-pam@23393be (v1.5.3) Mitigated by: linux-pam/linux-pam@940747f (v1.7.1) Since pam/1.7.0-5 in Debian unstable backports upstream commit to implement the nodns option to allow people to work around #1087019, even though it doesn't fix the root cause.

python3.13 3.13.5-2 (deb) pkg:deb/debian/python3.13@3.13.5-2?os_distro=trixie&os_name=debian&os_version=13 Affected range >=3.13.5-2 Fixed version Not Fixed EPSS Score 0.09% EPSS Percentile 26th percentile Description There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 python3.13 3.13.6-1 python3.12 python3.11 [bookworm] - python3.11 (Minor issue) python3.9 [bullseye] - python3.9 (Minor issue) python2.7 [bullseye] - python2.7 (EOL in bullseye LTS) tarfile.StreamError: seeking backwards is not allowed due to unskipped block with bad checksum python/cpython#130577 gh-130577: tarfile now validates archives to ensure member offsets are non-negative python/cpython#137027 https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/ Fixed by: python/cpython@7040aa5 (main) Fixed by: python/cpython@cdae923 (3.13-branch) Affected range >=3.13.5-2 Fixed version Not Fixed EPSS Score 0.08% EPSS Percentile 24th percentile Description The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service. python3.13 3.13.6-1 python3.12 python3.11 [bookworm] - python3.11 (Minor issue) python3.9 [bullseye] - python3.9 (Minor issue; can be fixed in next update) python2.7 [bullseye] - python2.7 (EOL in bullseye LTS) pypy3 [bullseye] - pypy3 (Minor issue; DoS) jython (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109376) [bookworm] - jython (Minor issue) [bullseye] - jython (EOL in bullseye LTS) https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/ Worst case quadratic complexity in HTMLParser python/cpython#135462 gh-135462: Fix quadratic complexity in processing special input in HTMLParser python/cpython#135464 python/cpython@6eb6c5d (main) python/cpython@d851f8e (v3.14.0b3) python/cpython@4455cba (3.13-branch)

dpkg 1.21.22 (deb) pkg:deb/debian/dpkg@1.21.22?os_distro=trixie&os_name=debian&os_version=13 Affected range <1.22.21 Fixed version 1.22.21 EPSS Score 0.08% EPSS Percentile 25th percentile Description It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions. dpkg 1.22.21 [bookworm] - dpkg (Minor issue) [bullseye] - dpkg (Minor issue) Fixed by: https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=ed6bbd445dd8800308c67236ba35d08004c98e82 (main) Fixed by: https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=98c623c8d6814ae46a3b30ca22e584c77d47d86b (1.22.21)

tar 1.34+dfsg-1.2+deb12u1 (deb) pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <1.34+dfsg-1.3 Fixed version 1.34+dfsg-1.3 EPSS Score 0.04% EPSS Percentile 10th percentile Description In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. tar 1.34+dfsg-1.3 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079) [bookworm] - tar 1.34+dfsg-1.2+deb12u1 [bullseye] - tar 1.34+dfsg-1+deb11u1 Fixed by: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4 (v1.35) Affected range <1.34+dfsg-1.4 Fixed version 1.34+dfsg-1.4 EPSS Score 0.03% EPSS Percentile 7th percentile Description GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. tar 1.34+dfsg-1.4 (unimportant) [bookworm] - tar 1.34+dfsg-1.2+deb12u1 [bullseye] - tar 1.34+dfsg-1+deb11u1 Crash in CLI tool, no security impact https://savannah.gnu.org/bugs/?62387 https://savannah.gnu.org/patch/?10307 Fixed by: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=3da78400eafcccb97e2f2fd4b227ea40d794ede8 (v1.35)

shadow 1:4.13+dfsg1-1+deb12u1 (deb) pkg:deb/debian/shadow@1:4.13%2Bdfsg1-1%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <1:4.13+dfsg1-2 Fixed version 1:4.13+dfsg1-2 EPSS Score 0.02% EPSS Percentile 2nd percentile Description A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory. shadow 1:4.13+dfsg1-2 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051062) [bookworm] - shadow 1:4.13+dfsg1-1+deb12u1 [buster] - shadow (Minor issue) https://bugzilla.redhat.com/show_bug.cgi?id=2215945 shadow-maint/shadow@65c88a4 (4.14.0-rc1) Affected range <1:4.13+dfsg1-2 Fixed version 1:4.13+dfsg1-2 EPSS Score 0.03% EPSS Percentile 7th percentile Description In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account. shadow 1:4.13+dfsg1-2 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034482) [bookworm] - shadow 1:4.13+dfsg1-1+deb12u1 [buster] - shadow (Minor issue) Control character check shadow-maint/shadow#687 Fixed by: shadow-maint/shadow@e5905c4 (4.14.0-rc1) Regression fix: shadow-maint/shadow@2eaea70 (4.14.0-rc1) https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/

libcap2 1:2.66-4+deb12u1 (deb) pkg:deb/debian/libcap2@1:2.66-4%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <1:2.73-4 Fixed version 1:2.73-4 EPSS Score 0.03% EPSS Percentile 6th percentile Description The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames. libcap2 1:2.73-4 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098318) [bookworm] - libcap2 1:2.66-4+deb12u1 https://bugzilla.openanolis.cn/show_bug.cgi?id=18804 Fixed by: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=1ad42b66c3567481cc5fa22fc1ba1556a316d878 (cap/v1.2.74-rc4)

ncurses 6.5+20250216-2 (deb) pkg:deb/debian/ncurses@6.5%2B20250216-2?os_distro=trixie&os_name=debian&os_version=13 Affected range >=6.5+20250216-2 Fixed version Not Fixed EPSS Score 0.02% EPSS Percentile 2nd percentile Description A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. ncurses (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107937) [bookworm] - ncurses (Minor issue) [bullseye] - ncurses (Minor issue) https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html https://invisible-island.net/ncurses/NEWS.html#index-t20250329

libtasn1-6 4.19.0-2+deb12u1 (deb) pkg:deb/debian/libtasn1-6@4.19.0-2%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <4.20.0-1 Fixed version 4.20.0-1 EPSS Score 0.32% EPSS Percentile 55th percentile Description A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack. libtasn1-6 4.20.0-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1095406) https://www.openwall.com/lists/oss-security/2025/02/06/6 https://gitlab.com/gnutls/libtasn1/-/issues/52 https://gitlab.com/gnutls/libtasn1/-/commit/4082ca2220b5ba910b546afddf7780fc4a51f75a (v4.20.0) https://gitlab.com/gnutls/libtasn1/-/commit/869a97aa259dffa2620dabcad84e1c22545ffc3d (v4.20.0) https://lists.gnu.org/archive/html/help-libtasn1/2025-02/msg00001.html

glibc 2.41-12 (deb) pkg:deb/debian/glibc@2.41-12?os_distro=trixie&os_name=debian&os_version=13 Affected range >=2.41-12 Fixed version Not Fixed EPSS Score 0.16% EPSS Percentile 38th percentile Description In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern glibc (unimportant) eglibc (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=24269 Affected range >=2.41-12 Fixed version Not Fixed EPSS Score 0.23% EPSS Percentile 46th percentile Description GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22853 Affected range >=2.41-12 Fixed version Not Fixed EPSS Score 0.38% EPSS Percentile 58th percentile Description GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22852 Affected range >=2.41-12 Fixed version Not Fixed EPSS Score 0.70% EPSS Percentile 71st percentile Description GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22851 Affected range >=2.41-12 Fixed version Not Fixed EPSS Score 0.14% EPSS Percentile 36th percentile Description GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22850 Affected range >=2.41-12 Fixed version Not Fixed EPSS Score 2.00% EPSS Percentile 83rd percentile Description In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep. glibc (unimportant) eglibc (unimportant) https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141 https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html No treated as vulnerability: https://sourceware.org/glibc/wiki/Security%20Exceptions Affected range >=2.41-12 Fixed version Not Fixed EPSS Score 0.37% EPSS Percentile 58th percentile Description The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. glibc (unimportant) eglibc (unimportant) That's standard POSIX behaviour implemented by (e)glibc. Applications using glob need to impose limits for themselves

xz-utils 5.4.1-1 (deb) pkg:deb/debian/xz-utils@5.4.1-1?os_distro=trixie&os_name=debian&os_version=13 Affected range <5.8.1-1 Fixed version 5.8.1-1 EPSS Score 0.12% EPSS Percentile 32nd percentile Description XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases. xz-utils 5.8.1-1 [bullseye] - xz-utils (Vulnerable code introduced later) https://www.openwall.com/lists/oss-security/2025/04/03/1 https://tukaani.org/xz/threaded-decoder-early-free.html GHSA-6cc8-p5mm-29w2 Affected range <5.6.1+really5.4.5-1 Fixed version 5.6.1+really5.4.5-1 EPSS Score 83.74% EPSS Percentile 99th percentile Description Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. xz-utils 5.6.1+really5.4.5-1 [bookworm] - xz-utils (Vulnerable code not present) [bullseye] - xz-utils (Vulnerable code not present) [buster] - xz-utils (Vulnerable code not present) https://www.openwall.com/lists/oss-security/2024/03/29/4 https://tukaani.org/xz-backdoor/ https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://rya.nc/xz-valid-n.html https://lwn.net/Articles/967192/ https://securelist.com/xz-backdoor-story-part-1/112354/ https://securelist.com/xz-backdoor-story-part-2-social-engineering/112476/ https://securelist.com/xz-backdoor-part-3-hooking-ssh/113007/

coreutils 9.1-1 (deb) pkg:deb/debian/coreutils@9.1-1?os_distro=trixie&os_name=debian&os_version=13 Affected range <9.5-1 Fixed version 9.5-1 EPSS Score 0.07% EPSS Percentile 22nd percentile Description A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service. coreutils 9.5-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061138) [bookworm] - coreutils (Vulnerable code not present) [bullseye] - coreutils (Vulnerable code not present) [buster] - coreutils (Vulnerable code not present) https://www.openwall.com/lists/oss-security/2024/01/18/2 Introduced by: coreutils/coreutils@40bf159#diff-30bc328ab3afa0ab9f17c6e7cf1752d558ae37cf4200e95bbb04c405c2b59518L821 (v9.2) Fixed by: coreutils/coreutils@c4c5ed8 (v9.5) Affected range <9.4-1 Fixed version 9.4-1 EPSS Score 0.07% EPSS Percentile 22nd percentile Description chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer. coreutils 9.4-1 (low; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816320) [bookworm] - coreutils (Minor issue) [bullseye] - coreutils (Minor issue) [buster] - coreutils (Minor issue) [stretch] - coreutils (Minor issue) [jessie] - coreutils (Minor issue) [wheezy] - coreutils (Minor issue) Restricting ioctl on the kernel side seems the better approach, but rejected by Linux upstream Fixing this issue via setsid() would introduce regressions: https://www.kernel.org/pub/linux/utils/util-linux/v2.28/v2.28-ReleaseNotes Since Linux 6.4.4-1 (uploaded on 23 Jul 2023), TIOCSTI is disabled on the kernel side, marking the first coreutils upload after that date (9.4-1) as the fixed version

gcc-12 12.2.0-14+deb12u1 (deb) pkg:deb/debian/gcc-12@12.2.0-14%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <12.3.0-9 Fixed version 12.3.0-9 EPSS Score 0.15% EPSS Percentile 36th percentile Description DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself. gcc-13 13.2.0-4 (unimportant) gcc-12 12.3.0-9 (unimportant) [bookworm] - gcc-12 12.2.0-14+deb12u1 gcc-11 11.4.0-4 (unimportant) gcc-10 10.5.0-3 (unimportant) gcc-9 9.5.0-6 (unimportant) gcc-8 (unimportant) gcc-7 (unimportant) GHSA-x7ch-h5rf-w2mf Not considered a security issue by GCC upstream https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64

python-pip 25.1.1+dfsg-1 (deb) pkg:deb/debian/python-pip@25.1.1%2Bdfsg-1?os_distro=trixie&os_name=debian&os_version=13 Affected range >=25.1.1+dfsg-1 Fixed version Not Fixed EPSS Score 2.54% EPSS Percentile 85th percentile Description An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely python-pip (unimportant) https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html pip is inherently affected by malicious packages, use packages from Debian instead :-)

sqlite3 3.46.1-7 (deb) pkg:deb/debian/sqlite3@3.46.1-7?os_distro=trixie&os_name=debian&os_version=13 Affected range >=3.46.1-7 Fixed version Not Fixed EPSS Score 0.20% EPSS Percentile 43rd percentile Description A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect. sqlite3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005974) sqlite (unimportant) https://github.com/guyinatuxedo/sqlite3_record_leaking https://bugzilla.redhat.com/show_bug.cgi?id=2054793 https://sqlite.org/forum/forumpost/056d557c2f8c452ed5bb9c215414c802b215ce437be82be047726e521342161e Negligible security impact

openssl 3.5.1-1 (deb) pkg:deb/debian/openssl@3.5.1-1?os_distro=trixie&os_name=debian&os_version=13 Affected range >=3.2.1-3 Fixed version Not Fixed EPSS Score 0.11% EPSS Percentile 30th percentile Description OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack." http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf openssl/openssl#24540 Fault injection based attacks are not within OpenSSLs threat model according to the security policy: https://www.openssl.org/policies/general/security-policy.html

gnupg2 2.2.40-1.1 (deb) pkg:deb/debian/gnupg2@2.2.40-1.1?os_distro=trixie&os_name=debian&os_version=13 Affected range <2.2.46-5 Fixed version 2.2.46-5 EPSS Score 0.02% EPSS Percentile 3rd percentile Description In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS." gnupg2 2.2.46-5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100990) [bookworm] - gnupg2 (Minor issue) [bullseye] - gnupg2 (Minor issue) https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html https://dev.gnupg.org/T7527 https://gitlab.com/freepg/gnupg/-/merge_requests/18 Fixed by: https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158 Follow-up (#1099141): https://dev.gnupg.org/T7547 Follow-up: https://dev.gnupg.org/rGd3d7713c1799754160260cb350309dd183b397f5 Double-free of internal data: https://gitlab.com/freepg/gnupg/-/merge_requests/22 Follow-up: https://dev.gnupg.org/rG0666a8858fafefb6664c976eb94b73550a7e3da4

util-linux 2.38.1-5+deb12u3 (deb) pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?os_distro=trixie&os_name=debian&os_version=13 Affected range <2.39.3-11 Fixed version 2.39.3-11 EPSS Score 11.73% EPSS Percentile 93rd percentile Description wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover. util-linux 2.39.3-11 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067849) https://www.openwall.com/lists/oss-security/2024/03/27/5 util-linux/util-linux@404b078 (v2.40)