Snyk test report
- - --
-
- public.ecr.aws/docker/library/redis:7.0.15-alpine/docker/library/redis (apk) -
- public.ecr.aws/docker/library/redis:7.0.15-alpine/tianon/gosu//usr/local/bin/gosu (gomodules) -
Out-of-bounds Write
-- - - -
- - -
Detailed paths
- - - -- -
NVD Description
-Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine.
- See How to fix? for Alpine:3.19 relevant fixed versions and status.
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
-Remediation
-Upgrade Alpine:3.19 busybox to version 1.36.1-r16 or higher.
References
- - -- - - -
Use After Free
-- - - -
- - -
Detailed paths
- - - -- -
NVD Description
-Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine.
- See How to fix? for Alpine:3.19 relevant fixed versions and status.
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.
-Remediation
-Upgrade Alpine:3.19 busybox to version 1.36.1-r17 or higher.
References
- - -- - - -
Use After Free
-- - - -
- - -
Detailed paths
- - - -- -
NVD Description
-Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine.
- See How to fix? for Alpine:3.19 relevant fixed versions and status.
A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.
-Remediation
-Upgrade Alpine:3.19 busybox to version 1.36.1-r17 or higher.
References
- - -- - - -
Use After Free
-- - - -
- - -
Detailed paths
- - - -- -
NVD Description
-Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine.
- See How to fix? for Alpine:3.19 relevant fixed versions and status.
A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.
-Remediation
-Upgrade Alpine:3.19 busybox to version 1.36.1-r17 or higher.
References
- - -- - - -
CVE-2024-4603
-- - - -
- - -
Detailed paths
- - - -- -
NVD Description
-Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
- See How to fix? for Alpine:3.19 relevant fixed versions and status.
Issue summary: Checking excessively long DSA keys or parameters may be very - slow.
-Impact summary: Applications that use the functions EVP_PKEY_param_check() - or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may - experience long delays. Where the key or parameters that are being checked - have been obtained from an untrusted source this may lead to a Denial of - Service.
-The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform
- various checks on DSA parameters. Some of those computations take a long time
- if the modulus (p parameter) is too large.
Trying to use a very large modulus is slow and OpenSSL will not allow using - public keys with a modulus which is over 10,000 bits in length for signature - verification. However the key and parameter check functions do not limit - the modulus size when performing the checks.
-An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() - and supplies a key or parameters obtained from an untrusted source could be - vulnerable to a Denial of Service attack.
-These functions are not called by OpenSSL itself on untrusted DSA keys so - only applications that directly call these functions may be vulnerable.
-Also vulnerable are the OpenSSL pkey and pkeyparam command line applications
- when using the -check option.
The OpenSSL SSL/TLS implementation is not affected by this issue.
-The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.
-Remediation
-Upgrade Alpine:3.19 openssl to version 3.1.5-r0 or higher.
References
--
-
- https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397 -
- https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e -
- https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d -
- https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740 -
- https://www.openssl.org/news/secadv/20240516.txt -
- - - -