DAT-18039 DevOps :: Docker Vulnerability Scanning Enhancements

[jandroav]

DAT-18039
✨ (vulnerability-scan.yml): Add vulnerability scanning workflow to check for vulnerabilities in Docker images using Trivy and Docker Scout actions

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[github-actions]

🔍 Vulnerabilities of liquibase/liquibase:2e65901dd6363040ded4d709a5e958b1ceabfdfb

📦 Image Reference liquibase/liquibase:2e65901dd6363040ded4d709a5e958b1ceabfdfb

digest	sha256:684a78ae3371141a47e93617b2ac7c78db9f053398f3686dd06a7427e7325bad
vulnerabilities
size	222 MB
packages	213

📦 Base Image eclipse-temurin:17-jre

also known as	17-jre-jammy 17.0.11_9-jre 17.0.11_9-jre-jammy
digest	sha256:c9e02d480ed00720b66c7af626404858c2435ea3ffa6f1b20a9bf8b45f255f8d
vulnerabilities

krb5 1.19.2-2ubuntu0.3 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 9th percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 9th percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 9th percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

libgcrypt20 1.9.4-3ubuntu3 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 16th percentile Description A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

wget 1.21.2-2ubuntu1.1 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 0.08% EPSS Percentile 36th percentile Description GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

xz-utils 5.2.5-2ubuntu1 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.05% EPSS Percentile 22nd percentile Description ** DISPUTED ** An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.

openssl 3.0.2-0ubuntu1.16 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed Description Use After Free with SSL_free_buffers Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 10th percentile Description Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (p parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the -check option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 10th percentile Description Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

ncurses 6.3-2ubuntu0.1 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.05% EPSS Percentile 21st percentile Description NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 9th percentile Description ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.

glibc 2.35-0ubuntu3.8 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.15% EPSS Percentile 52nd percentile Description sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

libzstd 1.4.8+dfsg-3build1 (deb) pkg:deb/ubuntu/[email protected]%2Bdfsg-3build1?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.13% EPSS Percentile 48th percentile Description A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

systemd 249.11-0ubuntu3.12 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.10% EPSS Percentile 43rd percentile Description A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

shadow 1:4.8.1-2ubuntu2.2 (deb) pkg:deb/ubuntu/shadow@1:4.8.1-2ubuntu2.2?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 3.3 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N EPSS Score 0.04% EPSS Percentile 16th percentile Description In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

pcre3 2:8.39-13ubuntu0.22.04.1 (deb) pkg:deb/ubuntu/pcre3@2:8.39-13ubuntu0.22.04.1?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 7.5 CVSS Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.37% EPSS Percentile 73rd percentile Description In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

libpng1.6 1.6.37-3build5 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.05% EPSS Percentile 19th percentile Description A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a segmentation fault and denial of service in png_setup_paeth_row() function.

coreutils 8.32-4.1ubuntu1.2 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 6.5 CVSS Vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N EPSS Score 0.04% EPSS Percentile 5th percentile Description chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

gcc-12 12.3.0-1ubuntu1~22.04 (deb) pkg:deb/ubuntu/[email protected]~22.04?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.07% EPSS Percentile 32nd percentile Description libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

gnupg2 2.2.27-3ubuntu2.1 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 3.3 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.05% EPSS Percentile 17th percentile Description GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

stdlib 1.22.4 (golang) pkg:golang/[email protected] Affected range >=1.22.0-0 <1.22.5 Fixed version 1.22.5 Description The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.