[0KRunning with gitlab-runner 17.8.0 (e4f782b3)[0;m
[0K on gitlab-runner-dsop-privileged-7c569bdb78-w7t5q t2_g2CUf, system ID: r_KxM1tK9mgcsY[0;m
[0K feature flags: FF_USE_FASTZIP:true[0;m
[0K[36;1mResolving secrets[0;m[0;m
section_start:1743815860:prepare_executor
[0K[0K[36;1mPreparing the "kubernetes" executor[0;m[0;m
[0KUsing Kubernetes namespace: gitlab-runner-dsop-privileged[0;m
[0KUsing Kubernetes executor with image [MASKED]/ironbank-pipelines/pipeline-runner-alpine:25.03.24-162625-01 ...[0;m
[0KUsing attach strategy to execute scripts...[0;m
section_end:1743815860:prepare_executor
[0Ksection_start:1743815860:prepare_script
[0K[0K[36;1mPreparing environment[0;m[0;m
[0KUsing FF_USE_POD_ACTIVE_DEADLINE_SECONDS, the Pod activeDeadlineSeconds will be set to the job timeout: 1h0m0s...[0;m
Waiting for pod gitlab-runner-dsop-privileged/runner-t2g2cuf-project-11791-concurrent-1-alahq7bj to be running, status is Pending
Waiting for pod gitlab-runner-dsop-privileged/runner-t2g2cuf-project-11791-concurrent-1-alahq7bj to be running, status is Pending
ContainersNotInitialized: "containers with incomplete status: [istio-proxy init-permissions]"
ContainersNotReady: "containers with unready status: [istio-proxy build helper]"
ContainersNotReady: "containers with unready status: [istio-proxy build helper]"
Running on runner-t2g2cuf-project-11791-concurrent-1-alahq7bj via gitlab-runner-dsop-privileged-7c569bdb78-w7t5q...
section_end:1743815867:prepare_script
[0Ksection_start:1743815867:get_sources
[0K[0K[36;1mGetting source from Git repository[0;m[0;m
[32;1mFetching changes with git depth set to 50...[0;m
Initialized empty Git repository in /builds/dsop/opensource/haproxy/haproxy24/.git/
[32;1mCreated fresh repository.[0;m
[32;1mChecking out 2f53910d as detached HEAD (ref is master)...[0;m
[32;1mSkipping Git submodules setup[0;m
section_end:1743815867:get_sources
[0Ksection_start:1743815867:download_artifacts
[0K[0K[36;1mDownloading artifacts[0;m[0;m
[32;1mDownloading artifacts for build-amd64 (44047140)...[0;m
Downloading artifacts 0 B (0 B/s)
Downloading artifacts 25.72 MB (66.4 MB/s)
Downloading artifacts from coordinator... ok [0;m host[0;m=ib-prod-gitlab-artifacts.s3.us-gov-west-1.amazonaws.com id[0;m=44047140 responseStatus[0;m=200 OK token[0;m=glcbt-64
[32;1mDownloading artifacts for setup (44047138)...[0;m
Downloading artifacts 0 B (0 B/s)
Downloading artifacts 1.18 MB (8.5 MB/s)
Downloading artifacts from coordinator... ok [0;m host[0;m=ib-prod-gitlab-artifacts.s3.us-gov-west-1.amazonaws.com id[0;m=44047138 responseStatus[0;m=200 OK token[0;m=glcbt-64
section_end:1743815868:download_artifacts
[0Ksection_start:1743815868:step_script
[0K[0K[36;1mExecuting "step_script" stage of the job script[0;m[0;m
[32;1m$ "${PIPELINE_REPO_DIR}/pipeline1/3-scan/twistlock_scan.sh"[0;m
scanning amd64 ([MASKED]/opensource/haproxy/haproxy24@sha256:e6ce7647180b3620b40c9cd7e5a04b2ab5296ef40258ef41361e007b3ee82552)
Trying to pull [MASKED]/opensource/haproxy/haproxy24@sha256:e6ce7647180b3620b40c9cd7e5a04b2ab5296ef40258ef41361e007b3ee82552...
Getting image source signatures
Copying blob sha256:a51a27b42a0208175bc9211450943a26ab83401c13bfc60419acce0122e165c9
Copying blob sha256:d4cb20dd5cad1ea19f0e857b56614f8b02eb977288e4f1a49f5bbbef8ff64b43
Copying blob sha256:44d117d635acf411b6b4106c39d1cdcadbe7b7b49d48995c3585269733701f6a
Copying blob sha256:dbe3750b0a0499b64b74074ddea996c3531f69f6aba9b0ae1d8fec8f70500098
Copying config sha256:0cd3edbfcb6287befe1a37e929721db5f490137f8bf7306b042f1f831cbe2f27
Writing manifest to image destination
0cd3edbfcb6287befe1a37e929721db5f490137f8bf7306b042f1f831cbe2f27
[1mScan results for: image [MASKED]/opensource/haproxy/haproxy24@sha256:e6ce7647180b3620b40c9cd7e5a04b2ab5296ef40258ef41361e007b3ee82552 0cd3edbfcb6287befe1a37e929721db5f490137f8bf7306b042f1f831cbe2f27[0m
[1mVulnerabilities[0m
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [1m CVE [0m | [1mSEVERITY[0m | [1mCVSS[0m | [1m PACKAGE [0m | [1m VERSION [0m | [1m STATUS [0m | [1m PUBLISHED [0m | [1mDISCOVERED[0m | [1m DESCRIPTION [0m | [1mCUSTOM LABELS[0m |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-37967[0m | [91;1mhigh[0m | [0m7.20[0m | [0mkrb5[0m | [0m1.21.1-4.el9_5[0m | [0maffected[0m | [0m> 2 years[0m | [0m< 1 hour[0m | [0mWindows Kerberos Elevation of Privilege[0m | [0m[0m |
| | | | | | | | | Vulnerability | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-4899[0m | [33;1mmedium[0m | [0m7.50[0m | [0mzstd[0m | [0m1.5.1-2.el9[0m | [0mwill not fix[0m | [0m> 2 years[0m | [0m< 1 hour[0m | [0mA vulnerability was found in zstd v1.4.10, where[0m | [0m[0m |
| | | | | | | | | an attacker can supply empty string as an argument | |
| | | | | | | | | to the command line tool to cause buffer overrun. | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2023-25950[0m | [33;1mmedium[0m | [0m7.30[0m | [0mhaproxy[0m | [0m2.4.22-3.el9_5.1[0m | [0mwill not fix[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mHTTP request/response smuggling vulnerability in[0m | [0m[0m |
| | | | | | | | | HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows | |
| | | | | | | | | a remote attacker to alter a legitimate user\'s | |
| | | | | | | | | requ... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-52533[0m | [33;1mmedium[0m | [0m7.00[0m | [0mglib2[0m | [0m2.68.4-14.el9_4.1[0m | [0mwill not fix[0m | [0m> 4 months[0m | [0m< 1 hour[0m | [0mgio/gsocks4aproxy.c in GNOME GLib before 2.82.1[0m | [0m[0m |
| | | | | | | | | has an off-by-one error and resultant buffer | |
| | | | | | | | | overflow because SOCKS4_CONN_MSG_LEN is not | |
| | | | | | | | | sufficient fo... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-0938[0m | [33;1mmedium[0m | [0m6.80[0m | [0mpython3.9[0m | [0m3.9.21-1.el9_5[0m | [0maffected[0m | [0m63 days[0m | [0m< 1 hour[0m | [0mThe Python standard library functions[0m | [0m[0m |
| | | | | | | | | `urllib.parse.urlsplit` and `urlparse` accepted | |
| | | | | | | | | domain names that included square brackets which | |
| | | | | | | | | isn\'t valid ac... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-24528[0m | [33;1mmedium[0m | [0m6.50[0m | [0mkrb5[0m | [0m1.21.1-4.el9_5[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mA flaw was found in krb5. With incremental[0m | [0m[0m |
| | | | | | | | | propagation enabled, an authenticated attacker | |
| | | | | | | | | can cause kadmind to write beyond the end of the | |
| | | | | | | | | mapped regi... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-1931[0m | [33;1mmedium[0m | [0m5.90[0m | [0munbound[0m | [0m1.16.2-8.el9_5.1[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mNLnet Labs Unbound version 1.18.0 up to and[0m | [0m[0m |
| | | | | | | | | including version 1.19.1 contain a vulnerability | |
| | | | | | | | | that can cause denial of service by a certain code | |
| | | | | | | | | path t... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2021-23336[0m | [33;1mmedium[0m | [0m5.90[0m | [0mpython3.9[0m | [0m3.9.21-1.el9_5[0m | [0maffected[0m | [0m> 4 years[0m | [0m< 1 hour[0m | [0mThe package python/cpython from 0 and before[0m | [0m[0m |
| | | | | | | | | 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 | |
| | | | | | | | | and before 3.8.8, from 3.9.0 and before 3.9.2 are | |
| | | | | | | | | vulner... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-35195[0m | [33;1mmedium[0m | [0m5.60[0m | [0mpython-requests[0m | [0m2.25.1-8.el9[0m | [0maffected[0m | [0m> 10 months[0m | [0m< 1 hour[0m | [0mRequests is a HTTP library. Prior to 2.32.0, when[0m | [0m[0m |
| | | | | | | | | making requests through a Requests `Session`, if | |
| | | | | | | | | the first request is made with `verify=False` to | |
| | | | | | | | | di... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-0395[0m | [33;1mmedium[0m | [0m5.50[0m | [0mglibc[0m | [0m2.34-125.el9_5.3[0m | [0maffected[0m | [0m72 days[0m | [0m< 1 hour[0m | [0mWhen the assert() function in the GNU C Library[0m | [0m[0m |
| | | | | | | | | versions 2.13 to 2.40 fails, it does not allocate | |
| | | | | | | | | enough space for the assertion failure message | |
| | | | | | | | | strin... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2021-3997[0m | [33;1mmedium[0m | [0m5.50[0m | [0msystemd[0m | [0m252-46.el9_5.3[0m | [0maffected[0m | [0m> 2 years[0m | [0m< 1 hour[0m | [0mA flaw was found in systemd. An uncontrolled[0m | [0m[0m |
| | | | | | | | | recursion in systemd-tmpfiles may lead to a denial | |
| | | | | | | | | of service at boot time when too many nested | |
| | | | | | | | | directori... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-12243[0m | [33;1mmedium[0m | [0m5.30[0m | [0mgnutls[0m | [0m3.8.3-4.el9_4[0m | [0maffected[0m | [0m53 days[0m | [0m< 1 hour[0m | [0mA flaw was found in GnuTLS, which relies on[0m | [0m[0m |
| | | | | | | | | libtasn1 for ASN.1 data processing. Due to an | |
| | | | | | | | | inefficient algorithm in libtasn1, decoding | |
| | | | | | | | | certain DER-enco... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-12133[0m | [33;1mmedium[0m | [0m5.30[0m | [0mlibtasn1[0m | [0m4.16.0-8.el9_1[0m | [0maffected[0m | [0m53 days[0m | [0m< 1 hour[0m | [0mA flaw in libtasn1 causes inefficient handling of[0m | [0m[0m |
| | | | | | | | | specific certificate data. When processing a large | |
| | | | | | | | | number of elements in a certificate, libtasn1 | |
| | | | | | | | | tak... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2023-30571[0m | [33;1mmedium[0m | [0m5.30[0m | [0mlibarchive[0m | [0m3.5.3-4.el9[0m | [0mwill not fix[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mLibarchive through 3.6.2 can cause directories[0m | [0m[0m |
| | | | | | | | | to have world-writable permissions. The umask() | |
| | | | | | | | | call inside archive_write_disk_posix.c changes the | |
| | | | | | | | | umas... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2021-45941[0m | [33;1mmedium[0m | [0m4.50[0m | [0mlibbpf[0m | [0m1.4.0-1.el9[0m | [0mwill not fix[0m | [0m> 3 years[0m | [0m< 1 hour[0m | [0mlibbpf 0.6.0 and 0.6.1 has a heap-based buffer[0m | [0m[0m |
| | | | | | | | | overflow (8 bytes) in __bpf_object__open | |
| | | | | | | | | (called from bpf_object__open_mem and | |
| | | | | | | | | bpf-object-fuzzer.c). | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2021-45940[0m | [33;1mmedium[0m | [0m4.50[0m | [0mlibbpf[0m | [0m1.4.0-1.el9[0m | [0mwill not fix[0m | [0m> 3 years[0m | [0m< 1 hour[0m | [0mlibbpf 0.6.0 and 0.6.1 has a heap-based buffer[0m | [0m[0m |
| | | | | | | | | overflow (4 bytes) in __bpf_object__open | |
| | | | | | | | | (called from bpf_object__open_mem and | |
| | | | | | | | | bpf-object-fuzzer.c). | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-29040[0m | [33;1mmedium[0m | [0m4.40[0m | [0mtpm2-tss[0m | [0m3.2.3-1.el9[0m | [0maffected[0m | [0m> 9 months[0m | [0m< 1 hour[0m | [0mThis repository hosts source code implementing[0m | [0m[0m |
| | | | | | | | | the Trusted Computing Group\'s (TCG) TPM2 Software | |
| | | | | | | | | Stack (TSS). The JSON Quote Info returned by | |
| | | | | | | | | Fapi_Qu... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-25724[0m | [33;1mmedium[0m | [0m4.00[0m | [0mlibarchive[0m | [0m3.5.3-4.el9[0m | [0maffected[0m | [0m33 days[0m | [0m< 1 hour[0m | [0mlist_item_verbose in tar/util.c in libarchive[0m | [0m[0m |
| | | | | | | | | through 3.7.7 does not check an strftime return | |
| | | | | | | | | value, which can lead to a denial of service or | |
| | | | | | | | | unspecif... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2023-2953[0m | [93;1mlow[0m | [0m7.10[0m | [0mopenldap[0m | [0m2.6.6-3.el9[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mA vulnerability was found in openldap. This[0m | [0m[0m |
| | | | | | | | | security flaw causes a null pointer dereference in | |
| | | | | | | | | ber_memalloc_x() function. | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2023-50495[0m | [93;1mlow[0m | [0m6.50[0m | [0mncurses[0m | [0m6.2-10.20210508.el9[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mNCurse v6.4-20230418 was discovered to[0m | [0m[0m |
| | | | | | | | | contain a segmentation fault via the component | |
| | | | | | | | | _nc_wrap_entry(). | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2023-32636[0m | [93;1mlow[0m | [0m6.20[0m | [0mglib2[0m | [0m2.68.4-14.el9_4.1[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mA flaw was found in glib, where the gvariant[0m | [0m[0m |
| | | | | | | | | deserialization code is vulnerable to a denial of | |
| | | | | | | | | service introduced by additional input validation | |
| | | | | | | | | added... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-3219[0m | [93;1mlow[0m | [0m6.20[0m | [0mgnupg2[0m | [0m2.3.3-4.el9[0m | [0maffected[0m | [0m> 2 years[0m | [0m< 1 hour[0m | [0mGnuPG can be made to spin on a relatively small[0m | [0m[0m |
| | | | | | | | | input by (for example) crafting a public key with | |
| | | | | | | | | thousands of signatures attached, compressed down | |
| | | | | | | | | to... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2023-4156[0m | [93;1mlow[0m | [0m6.10[0m | [0mgawk[0m | [0m5.1.0-6.el9[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mA heap out-of-bounds read flaw was found in[0m | [0m[0m |
| | | | | | | | | builtin.c in the gawk package. This issue may lead | |
| | | | | | | | | to a crash and could be used to read sensitive | |
| | | | | | | | | informat... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-29458[0m | [93;1mlow[0m | [0m6.10[0m | [0mncurses[0m | [0m6.2-10.20210508.el9[0m | [0maffected[0m | [0m> 2 years[0m | [0m< 1 hour[0m | [0mncurses 6.3 before patch 20220416 has an[0m | [0m[0m |
| | | | | | | | | out-of-bounds read and segmentation violation | |
| | | | | | | | | in convert_strings in tinfo/read_entry.c in the | |
| | | | | | | | | terminfo librar... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-41996[0m | [93;1mlow[0m | [0m5.90[0m | [0mopenssl[0m | [0m3.2.2-6.el9_5.1[0m | [0mwill not fix[0m | [0m> 7 months[0m | [0m< 1 hour[0m | [0mValidating the order of the public keys in the[0m | [0m[0m |
| | | | | | | | | Diffie-Hellman Key Agreement Protocol, when | |
| | | | | | | | | an approved safe prime is used, allows remote | |
| | | | | | | | | attackers (fr... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-11053[0m | [93;1mlow[0m | [0m5.90[0m | [0mcurl[0m | [0m7.76.1-31.el9[0m | [0maffected[0m | [0m> 3 months[0m | [0m< 1 hour[0m | [0mWhen asked to both use a `.netrc` file for[0m | [0m[0m |
| | | | | | | | | credentials and to follow HTTP redirects, curl | |
| | | | | | | | | could leak the password used for the first host to | |
| | | | | | | | | the follo... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2020-12413[0m | [93;1mlow[0m | [0m5.90[0m | [0mnss[0m | [0m3.101.0-10.el9_2[0m | [0mwill not fix[0m | [0m> 2 years[0m | [0m< 1 hour[0m | [0mThe Raccoon attack is a timing attack on DHE[0m | [0m[0m |
| | | | | | | | | ciphersuites inherit in the TLS specification. | |
| | | | | | | | | To mitigate this vulnerability, Firefox disabled | |
| | | | | | | | | support f... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-34459[0m | [93;1mlow[0m | [0m5.50[0m | [0mlibxml2[0m | [0m2.9.13-6.el9_5.2[0m | [0maffected[0m | [0m> 10 months[0m | [0m< 1 hour[0m | [0mAn issue was discovered in xmllint (from libxml2)[0m | [0m[0m |
| | | | | | | | | before 2.11.8 and 2.12.x before 2.12.7. Formatting | |
| | | | | | | | | error messages with xmllint --htmlout can result | |
| | | | | | | | | ... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-47011[0m | [93;1mlow[0m | [0m5.50[0m | [0mgdb[0m | [0m14.2-3.el9[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mAn issue was discovered function[0m | [0m[0m |
| | | | | | | | | parse_stab_struct_fields in stabs.c in Binutils | |
| | | | | | | | | 2.34 thru 2.38, allows attackers to cause a denial | |
| | | | | | | | | of service due to ... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-47010[0m | [93;1mlow[0m | [0m5.50[0m | [0mgdb[0m | [0m14.2-3.el9[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mAn issue was discovered function pr_function_type[0m | [0m[0m |
| | | | | | | | | in prdbg.c in Binutils 2.34 thru 2.38, allows | |
| | | | | | | | | attackers to cause a denial of service due to | |
| | | | | | | | | memory l... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-47007[0m | [93;1mlow[0m | [0m5.50[0m | [0mgdb[0m | [0m14.2-3.el9[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mAn issue was discovered function[0m | [0m[0m |
| | | | | | | | | stab_demangle_v3_arg in stabs.c in Binutils 2.34 | |
| | | | | | | | | thru 2.38, allows attackers to cause a denial of | |
| | | | | | | | | service due to memo... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-27943[0m | [93;1mlow[0m | [0m5.50[0m | [0mgcc[0m | [0m11.5.0-5.el9_5[0m | [0maffected[0m | [0m> 3 years[0m | [0m< 1 hour[0m | [0mlibiberty/rust-demangle.c in GNU GCC 11.2[0m | [0m[0m |
| | | | | | | | | allows stack consumption in demangle_const, as | |
| | | | | | | | | demonstrated by nm-new. | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-7264[0m | [93;1mlow[0m | [0m5.30[0m | [0mcurl[0m | [0m7.76.1-31.el9[0m | [0maffected[0m | [0m> 8 months[0m | [0m< 1 hour[0m | [0mlibcurl\'s ASN1 parser code has the `GTime2str()`[0m | [0m[0m |
| | | | | | | | | function, used for parsing an ASN.1 Generalized | |
| | | | | | | | | Time field. If given an syntactically incorrect | |
| | | | | | | | | fiel... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-41409[0m | [93;1mlow[0m | [0m5.30[0m | [0mpcre2[0m | [0m10.40-6.el9[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mInteger overflow vulnerability in pcre2test[0m | [0m[0m |
| | | | | | | | | before 10.41 allows attackers to cause a denial of | |
| | | | | | | | | service or other unspecified impacts via negative | |
| | | | | | | | | input... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-57360[0m | [93;1mlow[0m | [0m5.00[0m | [0mgdb[0m | [0m14.2-3.el9[0m | [0maffected[0m | [0m73 days[0m | [0m< 1 hour[0m | [0mhttps://www.gnu.org/software/binutils/ nm >=2.43[0m | [0m[0m |
| | | | | | | | | is affected by: Incorrect Access Control. The type | |
| | | | | | | | | of exploitation is: local. The component is: `nm | |
| | | | | | | | | -... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-0397[0m | [93;1mlow[0m | [0m5.00[0m | [0mpython3.9[0m | [0m3.9.21-1.el9_5[0m | [0maffected[0m | [0m> 9 months[0m | [0m< 1 hour[0m | [0mA defect was discovered in the Python “ssl” module[0m | [0m[0m |
| | | | | | | | | where there is a memory race condition with the | |
| | | | | | | | | ssl.SSLContext methods “cert_store_stats()”... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-7592[0m | [93;1mlow[0m | [0m4.80[0m | [0mpython3.9[0m | [0m3.9.21-1.el9_5[0m | [0maffected[0m | [0m> 7 months[0m | [0m< 1 hour[0m | [0mThere is a LOW severity vulnerability affecting[0m | [0m[0m |
| | | | | | | | | CPython, specifically the \'http.cookies\' | |
| | | | | | | | | standard library module. When parsing cookies | |
| | | | | | | | | that contai... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-43168[0m | [93;1mlow[0m | [0m4.80[0m | [0munbound[0m | [0m1.16.2-8.el9_5.1[0m | [0maffected[0m | [0m> 7 months[0m | [0m< 1 hour[0m | [0mDISPUTE NOTE: this issue does not pose a security[0m | [0m[0m |
| | | | | | | | | risk as it (according to analysis by the original | |
| | | | | | | | | software developer, NLnet Labs) falls within the | |
| | | | | | | | | e... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-13176[0m | [93;1mlow[0m | [0m4.70[0m | [0mopenssl[0m | [0m3.2.2-6.el9_5.1[0m | [0maffected[0m | [0m74 days[0m | [0m< 1 hour[0m | [0mIssue summary: A timing side-channel which could[0m | [0m[0m |
| | | | | | | | | potentially allow recovering the private key | |
| | | | | | | | | exists in the ECDSA signature computation. Impact | |
| | | | | | | | | summa... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-0232[0m | [93;1mlow[0m | [0m4.70[0m | [0msqlite[0m | [0m3.34.1-7.el9_3[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mA heap use-after-free issue has been identified[0m | [0m[0m |
| | | | | | | | | in SQLite in the jsonParseAddNodeArray() function | |
| | | | | | | | | in sqlite3.c. This flaw allows a local attacker to | |
| | | | | | | | | l... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2021-3572[0m | [93;1mlow[0m | [0m4.50[0m | [0mpython-pip[0m | [0m21.3.1-1.el9[0m | [0maffected[0m | [0m> 3 years[0m | [0m< 1 hour[0m | [0mA flaw was found in python-pip in the way it[0m | [0m[0m |
| | | | | | | | | handled Unicode separators in git references. A | |
| | | | | | | | | remote attacker could possibly use this issue to | |
| | | | | | | | | install ... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-3606[0m | [93;1mlow[0m | [0m4.40[0m | [0mlibbpf[0m | [0m1.4.0-1.el9[0m | [0mwill not fix[0m | [0m> 2 years[0m | [0m< 1 hour[0m | [0mA vulnerability was found in Linux Kernel. It[0m | [0m[0m |
| | | | | | | | | has been classified as problematic. This affects | |
| | | | | | | | | the function find_prog_by_sec_insn of the file | |
| | | | | | | | | tools/li... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-0725[0m | [93;1mlow[0m | [0m4.00[0m | [0mcurl[0m | [0m7.76.1-31.el9[0m | [0maffected[0m | [0m58 days[0m | [0m< 1 hour[0m | [0mWhen libcurl is asked to perform automatic gzip[0m | [0m[0m |
| | | | | | | | | decompression of content-encoded HTTP responses | |
| | | | | | | | | with the `CURLOPT_ACCEPT_ENCODING` option, **using | |
| | | | | | | | | zli... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-25260[0m | [93;1mlow[0m | [0m4.00[0m | [0melfutils[0m | [0m0.191-4.el9[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0melfutils v0.189 was discovered to contain a[0m | [0m[0m |
| | | | | | | | | NULL pointer dereference via the handle_verdef() | |
| | | | | | | | | function at readelf.c. | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-9681[0m | [93;1mlow[0m | [0m3.90[0m | [0mcurl[0m | [0m7.76.1-31.el9[0m | [0maffected[0m | [0m> 4 months[0m | [0m< 1 hour[0m | [0mWhen curl is asked to use HSTS, the expiry time[0m | [0m[0m |
| | | | | | | | | for a subdomain might overwrite a parent domain\'s | |
| | | | | | | | | cache entry, making it end sooner or later than | |
| | | | | | | | | oth... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-33655[0m | [93;1mlow[0m | [0m3.70[0m | [0munbound[0m | [0m1.16.2-8.el9_5.1[0m | [0maffected[0m | [0m> 10 months[0m | [0m< 1 hour[0m | [0mThe DNS protocol in RFC 1035 and updates allows[0m | [0m[0m |
| | | | | | | | | remote attackers to cause a denial of service | |
| | | | | | | | | (resource consumption) by arranging for DNS | |
| | | | | | | | | queries to b... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-3198[0m | [93;1mlow[0m | [0m3.30[0m | [0mgdb[0m | [0m14.2-3.el9[0m | [0maffected[0m | [0m23 hours[0m | [0m< 1 hour[0m | [0mA vulnerability has been found in GNU Binutils[0m | [0m[0m |
| | | | | | | | | 2.43/2.44 and classified as problematic. Affected | |
| | | | | | | | | by this vulnerability is the function display_info | |
| | | | | | | | | of... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-1632[0m | [93;1mlow[0m | [0m3.30[0m | [0mlibarchive[0m | [0m3.5.3-4.el9[0m | [0maffected[0m | [0m39 days[0m | [0m< 1 hour[0m | [0mA vulnerability was found in libarchive up to[0m | [0m[0m |
| | | | | | | | | 3.7.7. It has been classified as problematic. This | |
| | | | | | | | | affects the function list of the file bsdunzip.c. | |
| | | | | | | | | The... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-1377[0m | [93;1mlow[0m | [0m3.30[0m | [0melfutils[0m | [0m0.191-4.el9[0m | [0maffected[0m | [0m46 days[0m | [0m< 1 hour[0m | [0mA vulnerability, which was classified as[0m | [0m[0m |
| | | | | | | | | problematic, has been found in GNU elfutils 0.192. | |
| | | | | | | | | This issue affects the function gelf_getsymshndx | |
| | | | | | | | | of the fi... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-1371[0m | [93;1mlow[0m | [0m3.30[0m | [0melfutils[0m | [0m0.191-4.el9[0m | [0maffected[0m | [0m46 days[0m | [0m< 1 hour[0m | [0mA vulnerability has been found in GNU[0m | [0m[0m |
| | | | | | | | | elfutils 0.192 and classified as problematic. | |
| | | | | | | | | This vulnerability affects the function | |
| | | | | | | | | handle_dynamic_symtab of t... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2023-39804[0m | [93;1mlow[0m | [0m3.30[0m | [0mtar[0m | [0m1.34-7.el9[0m | [0maffected[0m | [0m> 1 years[0m | [0m< 1 hour[0m | [0mIn GNU tar before 1.35, mishandled extension[0m | [0m[0m |
| | | | | | | | | attributes in a PAX archive can lead to an | |
| | | | | | | | | application crash in xheader.c. | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-1795[0m | [93;1mlow[0m | [0m3.10[0m | [0mpython3.9[0m | [0m3.9.21-1.el9_5[0m | [0maffected[0m | [0m35 days[0m | [0m< 1 hour[0m | [0mDuring an address list folding when a separating[0m | [0m[0m |
| | | | | | | | | comma ends up on a folded line and that line is | |
| | | | | | | | | to be unicode-encoded then the separator itself is | |
| | | | | | | | | al... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-1153[0m | [93;1mlow[0m | [0m3.10[0m | [0mgdb[0m | [0m14.2-3.el9[0m | [0maffected[0m | [0m53 days[0m | [0m< 1 hour[0m | [0mA vulnerability classified as problematic was[0m | [0m[0m |
| | | | | | | | | found in GNU Binutils 2.43/2.44. Affected by this | |
| | | | | | | | | vulnerability is the function bfd_set_format of | |
| | | | | | | | | the fi... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-1152[0m | [93;1mlow[0m | [0m3.10[0m | [0mgdb[0m | [0m14.2-3.el9[0m | [0maffected[0m | [0m53 days[0m | [0m< 1 hour[0m | [0mA vulnerability classified as problematic has[0m | [0m[0m |
| | | | | | | | | been found in GNU Binutils 2.43. Affected is the | |
| | | | | | | | | function xstrdup of the file xstrdup.c of the | |
| | | | | | | | | component... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-1151[0m | [93;1mlow[0m | [0m3.10[0m | [0mgdb[0m | [0m14.2-3.el9[0m | [0maffected[0m | [0m53 days[0m | [0m< 1 hour[0m | [0mA vulnerability was found in GNU Binutils 2.43. It[0m | [0m[0m |
| | | | | | | | | has been rated as problematic. This issue affects | |
| | | | | | | | | the function xmemdup of the file xmemdup.c of | |
| | | | | | | | | the... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-1150[0m | [93;1mlow[0m | [0m3.10[0m | [0mgdb[0m | [0m14.2-3.el9[0m | [0maffected[0m | [0m53 days[0m | [0m< 1 hour[0m | [0mA vulnerability was found in GNU Binutils[0m | [0m[0m |
| | | | | | | | | 2.43. It has been declared as problematic. This | |
| | | | | | | | | vulnerability affects the function bfd_malloc of | |
| | | | | | | | | the file li... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-7531[0m | [93;1mlow[0m | [0m3.10[0m | [0mnss[0m | [0m3.101.0-10.el9_2[0m | [0maffected[0m | [0m> 8 months[0m | [0m< 1 hour[0m | [0mCalling `PK11_Encrypt()` in NSS using CKM_CHACHA20[0m | [0m[0m |
| | | | | | | | | and the same buffer for input and output can | |
| | | | | | | | | result in plaintext on an Intel Sandy Bridge | |
| | | | | | | | | processor... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2022-33070[0m | [93;1mlow[0m | [0m3.10[0m | [0mprotobuf-c[0m | [0m1.3.3-13.el9[0m | [0maffected[0m | [0m> 2 years[0m | [0m< 1 hour[0m | [0mProtobuf-c v1.4.0 was discovered to contain[0m | [0m[0m |
| | | | | | | | | an invalid arithmetic shift via the function | |
| | | | | | | | | parse_tag_and_wiretype in protobuf-c/protobuf-c.c. | |
| | | | | | | | | This vulne... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-27113[0m | [93;1mlow[0m | [0m2.90[0m | [0mlibxml2[0m | [0m2.9.13-6.el9_5.2[0m | [0maffected[0m | [0m45 days[0m | [0m< 1 hour[0m | [0mlibxml2 before 2.12.10 and 2.13.x before 2.13.6[0m | [0m[0m |
| | | | | | | | | has a NULL pointer dereference in xmlPatMatch in | |
| | | | | | | | | pattern.c. | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2024-43167[0m | [93;1mlow[0m | [0m2.80[0m | [0munbound[0m | [0m1.16.2-8.el9_5.1[0m | [0maffected[0m | [0m> 7 months[0m | [0m< 1 hour[0m | [0mDISPUTE NOTE: this issue does not pose a security[0m | [0m[0m |
| | | | | | | | | risk as it (according to analysis by the original | |
| | | | | | | | | software developer, NLnet Labs) falls within the | |
| | | | | | | | | e... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-30258[0m | [93;1mlow[0m | [0m2.70[0m | [0mgnupg2[0m | [0m2.3.3-4.el9[0m | [0maffected[0m | [0m16 days[0m | [0m< 1 hour[0m | [0mIn GnuPG before 2.5.5, if a user chooses to import[0m | [0m[0m |
| | | | | | | | | a certificate with certain crafted subkey data | |
| | | | | | | | | that lacks a valid backsig or that has incorrect | |
| | | | | | | | | usa... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
| [0mCVE-2025-1376[0m | [93;1mlow[0m | [0m2.50[0m | [0melfutils[0m | [0m0.191-4.el9[0m | [0maffected[0m | [0m46 days[0m | [0m< 1 hour[0m | [0mA vulnerability classified as problematic was[0m | [0m[0m |
| | | | | | | | | found in GNU elfutils 0.192. This vulnerability | |
| | | | | | | | | affects the function elf_strptr in the library | |
| | | | | | | | | /libelf/e... | |
+----------------+----------+------+-----------------+---------------------+--------------+-------------+------------+----------------------------------------------------+---------------+
[1mVulnerabilities found for image [MASKED]/opensource/haproxy/haproxy24@sha256:e6ce7647180b3620b40c9cd7e5a04b2ab5296ef40258ef41361e007b3ee82552: total - 62, critical - 0, high - 1, medium - 17, low - 44[0m
[1mCustom Labels [release:1738643550 version:9.5 architecture:x86_64 mil.dso.ironbank.image.keywords:network,load balancer,proxy mil.dso.ironbank.image.parent:[MASKED]/redhat/ubi/ubi9:9.5@sha256:da82aaf3695997c3a7083268269bfede289bc829290e353834a9aa7d11dbbebe org.opencontainers.image.revision:2f53910d517cdb0b947ee082a9421cd09f5092ac org.opencontainers.image.version:2.4.22 vendor:Red Hat, Inc. description:The Universal Base Image is designed and engineered to be the base layer for all of your containerized applications, middleware and utilities. This base image is freely redistributable, but Red Hat only supports Red Hat technologies through subscriptions for Red Hat products. This image is maintained by Red Hat and updated regularly. io.openshift.tags:base rhel9 mil.dso.ironbank.os-type:ubi9-container org.opencontainers.image.description:HAProxy is a free, open source high availability solution, providing load balancing org.opencontainers.image.vendor:HAProxy Technologies, LLC com.redhat.license_terms:https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI io.openshift.expose-services: maintainer:ironbank@dsop.io build-date:2025-02-04T04:32:30Z io.k8s.description:The Universal Base Image is designed and engineered to be the base layer for all of your containerized applications, middleware and utilities. This base image is freely redistributable, but Red Hat only supports Red Hat technologies through subscriptions for Red Hat products. This image is maintained by Red Hat and updated regularly. org.opencontainers.image.title:haproxy24 url:https://www.redhat.com com.redhat.component:ubi9-container mil.dso.ironbank.ci.id:4081203 org.opencontainers.image.licenses:GPL-2.0-only vcs-ref:f4371344f505f230dd8b447590dba1946ab022b7 org.opencontainers.image.source:https://repo1.dso.mil/dsop/opensource/haproxy/haproxy24 org.opencontainers.image.url:www.haproxy.org summary:Provides the latest release of Red Hat Universal Base Image 9. vcs-type:git io.buildah.version:1.38.1 mil.dso.ironbank.product.name:haproxy mil.dso.ironbank.project.id:11791 name:ubi9 org.opencontainers.image.created:2025-04-05 01:16:58+00:00 distribution-scope:public io.k8s.display-name:Red Hat Universal Base Image 9 mil.dso.ironbank.image.type:opensource][0m
[1mVulnerability threshold check results: PASS[0m
[1mCompliance found for image [MASKED]/opensource/haproxy/haproxy24@sha256:e6ce7647180b3620b40c9cd7e5a04b2ab5296ef40258ef41361e007b3ee82552: total - 0, critical - 0, high - 0, medium - 0, low - 0[0m
[1mCompliance threshold check results: PASS[0m
Link to the results in Console: [MASKED]/#!/monitor/vulnerabilities/images/ci?search=0cd3edbfcb6287befe1a37e929721db5f490137f8bf7306b042f1f831cbe2f27
Wrote scan results to ci-artifacts/scan-results/twistlock/amd64/twistlock_cve.json
ci-artifacts/scan-results/twistlock/amd64/twistlock_cve.json
section_end:1743815876:step_script
[0Ksection_start:1743815876:upload_artifacts_on_success
[0K[0K[36;1mUploading artifacts for successful job[0;m[0;m
[32;1mUploading artifacts...[0;m
ci-artifacts/scan-results/twistlock/amd64/: found 3 matching artifact files and directories[0;m
Uploading artifacts 0 B (0 B/s)
Uploading artifacts 171.60 KB (300.7 KB/s)
Uploading artifacts as "archive" to coordinator... 201 Created[0;m id[0;m=44047146 responseStatus[0;m=201 Created token[0;m=glcbt-64
section_end:1743815877:upload_artifacts_on_success
[0Ksection_start:1743815877:cleanup_file_variables
[0K[0K[36;1mCleaning up project directory and file based variables[0;m[0;m
section_end:1743815878:cleanup_file_variables
[0K[32;1mJob succeeded[0;m