chore(findings): codesecure/codesonar/codesonar-hub
Summary
codesecure/codesonar/codesonar-hub has 38 new findings discovered during continuous monitoring.
More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=codesecure/codesonar/codesonar-hub&tag=9.1p0&branch=master
EPSS (Exploit Prediction Scoring System) provides an estimate of the likelihood that a vulnerability will be exploited in the wild.
KEV (Known Exploited Vulnerabilities) indicates whether a vulnerability is actively being exploited according to CISA.
| id | source | severity | package | impact | workaround | epss_score | kev |
|---|---|---|---|---|---|---|---|
| CVE-2025-50106 | Twistlock CVE | High | java-21.0.7 | 0.00174 | false | ||
| CVE-2025-50106 | Anchore CVE | High | openjdk-21.0.7-CodeSecure-jdk21u7 | 0.00174 | false | ||
| CVE-2025-30749 | Twistlock CVE | High | java-21.0.7 | 0.00174 | false | ||
| CVE-2025-30749 | Anchore CVE | High | openjdk-21.0.7-CodeSecure-jdk21u7 | 0.00174 | false | ||
| CVE-2025-4517 | Anchore CVE | Critical | python-3.11.5 | 0.00146 | false | ||
| CVE-2025-4330 | Anchore CVE | High | python-3.11.5 | 0.00120 | false | ||
| CVE-2025-4207 | Anchore CVE | Medium | postgresql-17.4 | 0.00117 | false | ||
| CVE-2025-4138 | Anchore CVE | High | python-3.11.5 | 0.00100 | false | ||
| CVE-2024-12718 | Anchore CVE | Medium | python-3.11.5 | 0.00097 | false | ||
| CVE-2025-8194 | Anchore CVE | High | python-3.11.5 | 0.00096 | false | ||
| CVE-2025-6069 | Anchore CVE | Medium | python-3.11.5 | 0.00090 | false | ||
| CVE-2025-4435 | Anchore CVE | High | python-3.11.5 | 0.00067 | false | ||
| CVE-2025-48924 | Twistlock CVE | Medium | org.apache.commons_commons-lang3-3.14.0 | 0.00063 | false | ||
| CVE-2025-9086 | Anchore CVE | High | curl-8.14.1 | 0.00054 | false | ||
| CVE-2025-50059 | Twistlock CVE | Low | java-21.0.7 | 0.00054 | false | ||
| CVE-2025-50059 | Anchore CVE | High | openjdk-21.0.7-CodeSecure-jdk21u7 | 0.00054 | false | ||
| CVE-2025-8715 | Anchore CVE | High | postgresql-17.4 | 0.00053 | false | ||
| CVE-2025-8713 | Anchore CVE | Low | postgresql-17.4 | 0.00048 | false | ||
| CVE-2025-30698 | Anchore CVE | Medium | openjdk-21.0.7-CodeSecure-jdk21u7 | 0.00038 | false | ||
| CVE-2025-21587 | Anchore CVE | High | openjdk-21.0.7-CodeSecure-jdk21u7 | 0.00037 | false | ||
| CVE-2025-30754 | Twistlock CVE | Low | java-21.0.7 | 0.00036 | false | ||
| CVE-2025-30754 | Anchore CVE | Medium | openjdk-21.0.7-CodeSecure-jdk21u7 | 0.00036 | false | ||
| CVE-2025-41249 | Twistlock CVE | High | spring-core-6.2.8 | 0.00035 | false | ||
| CVE-2025-4516 | Anchore CVE | Medium | python-3.11.5 | 0.00027 | false | ||
| CVE-2025-8714 | Anchore CVE | High | postgresql-17.4 | 0.00026 | false | ||
| CVE-2025-30691 | Anchore CVE | Medium | openjdk-21.0.7-CodeSecure-jdk21u7 | 0.00025 | false | ||
| CVE-2025-10148 | Anchore CVE | Medium | curl-8.14.1 | 0.00025 | false | ||
| CVE-2025-50181 | Twistlock CVE | Medium | urllib3-2.3.0 | Most users dont disable redirects on the PoolManager. | Set redirectsFalseredirects0 on the .request call instead of on the toplevel urllib3.PoolManager | 0.00015 | false |
| CVE-2025-50182 | Twistlock CVE | Medium | urllib3-2.3.0 | Pyodide is extremely rare configuration for users in production. | 0.00013 | false | |
| e979dad24ff4ad78d47de822897187a2 | Anchore Compliance | Critical | N/A | N/A | |||
| GHSA-pq67-6m6q-mj2v | Anchore CVE | Medium | urllib3-2.3.0 | N/A | N/A | ||
| GHSA-jmp9-x22r-554x | Anchore CVE | High | spring-core-6.2.8 | N/A | N/A | ||
| GHSA-j288-q9x7-2f5v | Anchore CVE | Medium | commons-lang3-3.14.0 | N/A | N/A | ||
| GHSA-j288-q9x7-2f5v | Anchore CVE | Medium | commons-lang3-3.14.0 | N/A | N/A | ||
| GHSA-48p4-8xcf-vxj5 | Anchore CVE | Medium | urllib3-2.3.0 | N/A | N/A | ||
| GHSA-22wj-vf5f-wrvj | Anchore CVE | High | h2-2.1.210 | N/A | N/A | ||
| CCE-87771-2 | OSCAP Compliance | Medium | N/A | N/A | |||
| 8ec3515214170d0cc60bd30317f9b063 | Anchore Compliance | Critical | N/A | N/A |
More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=codesecure/codesonar/codesonar-hub&tag=9.1p0&branch=master
Tasks
Contributor:
-
Apply the StatusReview label to this issue for a merge request reviewand wait for feedback
OR
-
Provide justifications for findings in the VAT (docs) -
Apply the StatusVerification label to this issue for a VAT justifications reviewand wait for feedback
Iron Bank:
-
Review findings and justifications
Note: If the above process is rejected for any reason, the
RevieworVerificationlabel will be removed and the issue will be sent back toTo-Do. Any comments will be listed in this issue for you to address. Once they have been addressed, you must re-add theRevieworVerificationlabel.
Questions?
Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add /cc @ironbank-notifications/onboarding.
Additionally, Iron Bank hosts an AMA working session every Wednesday from 1630-1730EST to answer questions.