UNCLASSIFIED - NO CUI

Skip to content
Snippets Groups Projects
New look: Off

chore(findings): opensource/grafana/tempo

    • Closed Issue created by Ghost User @ghost

    Summary

    opensource/grafana/tempo has 50 new findings discovered during continuous monitoring.

    More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=opensource/grafana/tempo&tag=2.7.0&branch=master

    id source severity package impact workaround
    CVE-2015-5312 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2015-7497 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2015-7498 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2015-7499 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2015-7500 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2015-7941 Twistlock CVE Low libxml2-2.9.13-6.el9_5.1
    CVE-2015-7942 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2015-8035 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2015-8241 Twistlock CVE Low libxml2-2.9.13-6.el9_5.1
    CVE-2015-8242 Twistlock CVE Low libxml2-2.9.13-6.el9_5.1
    CVE-2015-8317 Twistlock CVE Low libxml2-2.9.13-6.el9_5.1
    CVE-2015-8710 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-1762 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-1833 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-1834 Twistlock CVE High libxml2-2.9.13-6.el9_5.1
    CVE-2016-1835 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-1836 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-1837 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-1838 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-1839 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-1840 Twistlock CVE High libxml2-2.9.13-6.el9_5.1
    CVE-2016-3627 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-3705 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-4447 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-4448 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-4449 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-4483 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-4658 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-5131 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2016-9318 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2017-0663 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2017-15412 Twistlock CVE High libxml2-2.9.13-6.el9_5.1
    CVE-2017-18258 Twistlock CVE Low libxml2-2.9.13-6.el9_5.1
    CVE-2017-5130 Twistlock CVE High libxml2-2.9.13-6.el9_5.1
    CVE-2017-7375 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2017-8872 Twistlock CVE Low libxml2-2.9.13-6.el9_5.1
    CVE-2017-9047 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2017-9048 Twistlock CVE Low libxml2-2.9.13-6.el9_5.1
    CVE-2017-9049 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2017-9050 Twistlock CVE Medium libxml2-2.9.13-6.el9_5.1
    CVE-2018-14567 Twistlock CVE Low libxml2-2.9.13-6.el9_5.1
    CVE-2020-11023 Anchore CVE Medium libstdc++-11.5.0-5.el9_5
    CVE-2020-11023 Anchore CVE Medium libgcc-11.5.0-5.el9_5
    CVE-2022-27943 Anchore CVE Low libgcc-11.5.0-5.el9_5
    CVE-2022-27943 Anchore CVE Low libstdc++-11.5.0-5.el9_5
    CVE-2022-27943 Twistlock CVE Low gcc-11.5.0-5.el9_5
    CVE-2022-49043 Twistlock CVE High libxml2-2.9.13-6.el9_5.1
    CVE-2022-49043 Anchore CVE High libxml2-2.9.13-6.el9_5.1
    CVE-2023-45322 Anchore CVE Low libxml2-2.9.13-6.el9_5.1
    CVE-2024-34459 Anchore CVE Low libxml2-2.9.13-6.el9_5.1

    More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=opensource/grafana/tempo&tag=2.7.0&branch=master

    Tasks

    Contributor:

    • Provide justifications for findings in the VAT (docs)
    • Apply the StatusVerification label to this issue and wait for feedback

    Iron Bank:

    • Review findings and justifications

    Note: If the above process is rejected for any reason, the Verification label will be removed and the issue will be sent back to Open. Any comments will be listed in this issue for you to address. Once they have been addressed, you must re-add the Verification label.

    Questions?

    Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add /cc @ironbank-notifications/onboarding.

    Additionally, Iron Bank hosts an AMA working session every Wednesday from 1630-1730EST to answer questions.

    0 of 3 checklist items completed
    To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

    Child items 0

    • No child items are currently assigned. Use child items to break down this issue into smaller parts.

    Activity

    Please register or sign in to reply

    UNCLASSIFIED - NO CUI