docker-wallarm-node icon indicating copy to clipboard operation
docker-wallarm-node copied to clipboard

DEVOPS-2804 Update docker scout creds

Open nedvna opened this issue 1 year ago • 2 comments

nedvna avatar Jul 16 '24 15:07 nedvna

Overview

Image reference wallarm/node:latest node-x86_64.tar
- digest 69e78a93cfb4 7186f2b523c8
- tag latest
- provenance https://github.com/wallarm/docker-wallarm-node/commit/2010096b4d7597ef75257888e289ad0826af44c6 https://github.com/wallarm/docker-wallarm-node/commit/git-673b4fc
- vulnerabilities critical: 0 high: 1 medium: 1 low: 0 critical: 0 high: 1 medium: 1 low: 0
- platform linux/amd64 linux/amd64
- size 246 MB 274 MB (+29 MB)
- packages 331 331
Base Image alpine:3
also known as:
3.20
3.20.1
latest
alpine:3
also known as:
3.20
3.20.1
latest
- vulnerabilities critical: 1 high: 0 medium: 0 low: 0 critical: 1 high: 0 medium: 0 low: 0
Labels (2 changes)
  • ± 2 changed
  • 8 unchanged
 com.wallarm.nginx-docker.versions.aio=4.10.8
 com.wallarm.nginx-docker.versions.alpine=3.20
 com.wallarm.nginx-docker.versions.gomplate=3.11.7
 com.wallarm.nginx-docker.versions.nginx=1.26.1
 org.opencontainers.image.documentation=https://docs.wallarm.com/installation/inline/compute-instances/docker/nginx-based
-org.opencontainers.image.revision=git-2010096
+org.opencontainers.image.revision=git-673b4fc
 org.opencontainers.image.source=https://github.com/wallarm/docker-wallarm-node
 org.opencontainers.image.title=Docker official image for Wallarm Node. API security platform agent
 org.opencontainers.image.vendor=Wallarm
-org.opencontainers.image.version=4.10.8-1
+org.opencontainers.image.version=test

github-actions[bot] avatar Jul 16 '24 15:07 github-actions[bot]

:mag: Vulnerabilities of node-x86_64.tar

:package: Image Reference node-x86_64.tar
digestsha256:7186f2b523c82bc2b793e401976bfd22fce586dd1a7565caf35385a99b6e41b0
vulnerabilitiescritical: 0 high: 1 medium: 0 low: 0
size274 MB
packages331
:package: Base Image alpine:3
also known as
  • 3.20
  • 3.20.1
  • latest
digestsha256:dabf91b69c191a1a0a1628fd6bdd029c0c4018041c7f052870bb13c5a222ae76
vulnerabilitiescritical: 1 high: 0 medium: 0 low: 0
critical: 0 high: 1 medium: 0 low: 0 setuptools 68.0.0 (pypi)

pkg:pypi/[email protected]
high 8.8: CVE--2024--6345 Improper Control of Generation of Code ('Code Injection')

Affected range
Fixed version70.0.0
CVSS Score8.8
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score0.04%
EPSS Percentile9th percentile
Description

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

github-actions[bot] avatar Jul 16 '24 15:07 github-actions[bot]