cyber-dojo
flows
nginx-archived-at-1707630884
artifacts
7981a8ddc00cdc7505dc08fbb80cc79a33b02d6692a59cbe77ca6f491c5432ba
By signing up, you agree to the
Terms of Service.
For more information about Kosli’s privacy practices, see the Kosli’s
Privacy Policy.
We’ll occasionally send you account-related emails.
We’ll occasionally send you account-related emails.
nginx-archived-at-1707630884
Reverse proxy
cyberdojo/nginx:161d74a
Non-compliant
Download Evidence Package
JSON
{
"created_at": 1707051104.6189764,
"fingerprint": "7981a8ddc00cdc7505dc08fbb80cc79a33b02d6692a59cbe77ca6f491c5432ba",
"filename": "cyberdojo/nginx:161d74a",
"git_commit": "161d74a23f1a2321b9138e8ce0054c3fa4785877",
"build_url": "https://github.com/cyber-dojo/nginx/actions/runs/7774180887",
"commit_url": "https://github.com/cyber-dojo/nginx/commit/161d74a23f1a2321b9138e8ce0054c3fa4785877",
"evidence": {
"snyk-scan": {
"evidence_type": "snyk",
"is_compliant": false,
"build_url": "https://github.com/cyber-dojo/snyk_scans/actions/runs/7853942406",
"evidence_archive_fingerprint": "55d18aad48223e5034756a7c97700f746cf76cee17d82593ab28b5f20404c892",
"user_data": {},
"snyk_results": {
"dependencyCount": 65,
"docker": {
"baseImage": "nginx:1.24.0-alpine3.17",
"baseImageRemediation": {
"advice": [
{
"bold": true,
"message": "According to our scan, you are currently using the most secure version of the selected base image"
}
],
"code": "NO_REMEDIATION_AVAILABLE"
}
},
"filesystemPolicy": true,
"filtered": {
"ignore": [],
"patch": []
},
"hasUnknownVersions": false,
"ignoreSettings": {
"adminOnly": false,
"disregardFilesystemIgnores": false,
"reasonRequired": false
},
"isPrivate": true,
"licensesPolicy": {
"orgLicenseRules": {
"AGPL-1.0": {
"instructions": "",
"licenseType": "AGPL-1.0",
"severity": "high"
},
"AGPL-3.0": {
"instructions": "",
"licenseType": "AGPL-3.0",
"severity": "high"
},
"Artistic-1.0": {
"instructions": "",
"licenseType": "Artistic-1.0",
"severity": "medium"
},
"Artistic-2.0": {
"instructions": "",
"licenseType": "Artistic-2.0",
"severity": "medium"
},
"CDDL-1.0": {
"instructions": "",
"licenseType": "CDDL-1.0",
"severity": "medium"
},
"CPOL-1.02": {
"instructions": "",
"licenseType": "CPOL-1.02",
"severity": "high"
},
"EPL-1.0": {
"instructions": "",
"licenseType": "EPL-1.0",
"severity": "medium"
},
"GPL-2.0": {
"instructions": "",
"licenseType": "GPL-2.0",
"severity": "high"
},
"GPL-3.0": {
"instructions": "",
"licenseType": "GPL-3.0",
"severity": "high"
},
"LGPL-2.0": {
"instructions": "",
"licenseType": "LGPL-2.0",
"severity": "medium"
},
"LGPL-2.1": {
"instructions": "",
"licenseType": "LGPL-2.1",
"severity": "medium"
},
"LGPL-3.0": {
"instructions": "",
"licenseType": "LGPL-3.0",
"severity": "medium"
},
"MPL-1.1": {
"instructions": "",
"licenseType": "MPL-1.1",
"severity": "medium"
},
"MPL-2.0": {
"instructions": "",
"licenseType": "MPL-2.0",
"severity": "medium"
},
"MS-RL": {
"instructions": "",
"licenseType": "MS-RL",
"severity": "medium"
},
"SimPL-2.0": {
"instructions": "",
"licenseType": "SimPL-2.0",
"severity": "high"
}
},
"severities": {}
},
"ok": false,
"org": "jonjagger",
"packageManager": "apk",
"path": "274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@sha256:7981a8ddc00cdc7505dc08fbb80cc79a33b02d6692a59cbe77ca6f491c5432ba/nginx:161d74a",
"platform": "linux/amd64",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"projectName": "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a",
"severityThreshold": "medium",
"summary": "4 medium or high or critical severity vulnerable dependency paths",
"uniqueCount": 2,
"vulnerabilities": [
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2024-02-10T02:30:53.123369Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2024-02-06T13:57:34.460600Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2024-02-09T13:11:37.934083Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.17` relevant fixed versions and status._\n\nlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.\n## Remediation\nUpgrade `Alpine:3.17` `expat` to version 2.6.0-r0 or higher.\n## References\n- [cve@mitre.org](https://cwe.mitre.org/data/definitions/776.html)\n- [cve@mitre.org](https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404)\n- [cve@mitre.org](https://github.com/libexpat/libexpat/pull/777)\n",
"disclosureTime": "2024-02-04T20:15:46.120000Z",
"dockerBaseImage": "nginx:1.24.0-alpine3.17",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16953",
"probability": "0.00051"
},
"exploit": "Not Defined",
"fixedIn": [
"2.6.0-r0"
],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@*",
"expat/libexpat@2.5.0-r0"
],
"id": "SNYK-ALPINE317-EXPAT-6241041",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-52426"
],
"CWE": [
"CWE-776"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": true,
"language": "linux",
"malicious": false,
"modificationTime": "2024-02-10T02:30:53.130218Z",
"name": "expat/libexpat",
"nearestFixedInVersion": "2.6.0-r0",
"nvdSeverity": "medium",
"packageManager": "alpine:3.17",
"packageName": "expat",
"patches": [],
"publicationTime": "2024-02-10T02:30:53.130097Z",
"references": [
{
"title": "https://cwe.mitre.org/data/definitions/776.html",
"url": "https://cwe.mitre.org/data/definitions/776.html"
},
{
"title": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404",
"url": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404"
},
{
"title": "https://github.com/libexpat/libexpat/pull/777",
"url": "https://github.com/libexpat/libexpat/pull/777"
}
],
"relativeImportance": null,
"semver": {
"vulnerable": [
"<2.6.0-r0"
]
},
"severity": "medium",
"severityWithCritical": "medium",
"socialTrendAlert": false,
"title": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')",
"upgradePath": [
false,
"expat/libexpat@2.6.0-r0"
],
"version": "2.5.0-r0"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2024-02-10T02:31:08.639014Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2024-02-06T13:57:33.167998Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2024-02-09T13:11:36.880020Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.17` relevant fixed versions and status._\n\nlibexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.\n## Remediation\nUpgrade `Alpine:3.17` `expat` to version 2.6.0-r0 or higher.\n## References\n- [cve@mitre.org](https://github.com/libexpat/libexpat/pull/789)\n",
"disclosureTime": "2024-02-04T20:15:46.063000Z",
"dockerBaseImage": "nginx:1.24.0-alpine3.17",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.10104",
"probability": "0.00044"
},
"exploit": "Not Defined",
"fixedIn": [
"2.6.0-r0"
],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@*",
"expat/libexpat@2.5.0-r0"
],
"id": "SNYK-ALPINE317-EXPAT-6241042",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-52425"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": true,
"language": "linux",
"malicious": false,
"modificationTime": "2024-02-10T02:31:08.643457Z",
"name": "expat/libexpat",
"nearestFixedInVersion": "2.6.0-r0",
"nvdSeverity": "high",
"packageManager": "alpine:3.17",
"packageName": "expat",
"patches": [],
"publicationTime": "2024-02-10T02:31:08.643334Z",
"references": [
{
"title": "https://github.com/libexpat/libexpat/pull/789",
"url": "https://github.com/libexpat/libexpat/pull/789"
}
],
"relativeImportance": null,
"semver": {
"vulnerable": [
"<2.6.0-r0"
]
},
"severity": "high",
"severityWithCritical": "high",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [
false,
"expat/libexpat@2.6.0-r0"
],
"version": "2.5.0-r0"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2024-02-10T02:30:53.123369Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2024-02-06T13:57:34.460600Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2024-02-09T13:11:37.934083Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.17` relevant fixed versions and status._\n\nlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.\n## Remediation\nUpgrade `Alpine:3.17` `expat` to version 2.6.0-r0 or higher.\n## References\n- [cve@mitre.org](https://cwe.mitre.org/data/definitions/776.html)\n- [cve@mitre.org](https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404)\n- [cve@mitre.org](https://github.com/libexpat/libexpat/pull/777)\n",
"disclosureTime": "2024-02-04T20:15:46.120000Z",
"dockerBaseImage": "nginx:1.24.0-alpine3.17",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16953",
"probability": "0.00051"
},
"exploit": "Not Defined",
"fixedIn": [
"2.6.0-r0"
],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@*",
"fontconfig/fontconfig@2.14.1-r0",
"expat/libexpat@2.5.0-r0"
],
"id": "SNYK-ALPINE317-EXPAT-6241041",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-52426"
],
"CWE": [
"CWE-776"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2024-02-10T02:30:53.130218Z",
"name": "expat/libexpat",
"nearestFixedInVersion": "2.6.0-r0",
"nvdSeverity": "medium",
"packageManager": "alpine:3.17",
"packageName": "expat",
"patches": [],
"publicationTime": "2024-02-10T02:30:53.130097Z",
"references": [
{
"title": "https://cwe.mitre.org/data/definitions/776.html",
"url": "https://cwe.mitre.org/data/definitions/776.html"
},
{
"title": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404",
"url": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404"
},
{
"title": "https://github.com/libexpat/libexpat/pull/777",
"url": "https://github.com/libexpat/libexpat/pull/777"
}
],
"relativeImportance": null,
"semver": {
"vulnerable": [
"<2.6.0-r0"
]
},
"severity": "medium",
"severityWithCritical": "medium",
"socialTrendAlert": false,
"title": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')",
"upgradePath": [],
"version": "2.5.0-r0"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2024-02-10T02:31:08.639014Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2024-02-06T13:57:33.167998Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2024-02-09T13:11:36.880020Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.17` relevant fixed versions and status._\n\nlibexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.\n## Remediation\nUpgrade `Alpine:3.17` `expat` to version 2.6.0-r0 or higher.\n## References\n- [cve@mitre.org](https://github.com/libexpat/libexpat/pull/789)\n",
"disclosureTime": "2024-02-04T20:15:46.063000Z",
"dockerBaseImage": "nginx:1.24.0-alpine3.17",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.10104",
"probability": "0.00044"
},
"exploit": "Not Defined",
"fixedIn": [
"2.6.0-r0"
],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@*",
"fontconfig/fontconfig@2.14.1-r0",
"expat/libexpat@2.5.0-r0"
],
"id": "SNYK-ALPINE317-EXPAT-6241042",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-52425"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2024-02-10T02:31:08.643457Z",
"name": "expat/libexpat",
"nearestFixedInVersion": "2.6.0-r0",
"nvdSeverity": "high",
"packageManager": "alpine:3.17",
"packageName": "expat",
"patches": [],
"publicationTime": "2024-02-10T02:31:08.643334Z",
"references": [
{
"title": "https://github.com/libexpat/libexpat/pull/789",
"url": "https://github.com/libexpat/libexpat/pull/789"
}
],
"relativeImportance": null,
"semver": {
"vulnerable": [
"<2.6.0-r0"
]
},
"severity": "high",
"severityWithCritical": "high",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "2.5.0-r0"
}
]
},
"created_at": 1707556534.9300506,
"has_audit_package": true
}
},
"reported_by": "ci-pipelines",
"git_commit_info": {
"sha1": "161d74a23f1a2321b9138e8ce0054c3fa4785877",
"message": "Remove unneeded apk upgrade in Dockerfile",
"author": "JonJagger <jon@kosli.com>",
"timestamp": 1707051040,
"branch": "main"
},
"repo_url": "https://github.com/cyber-dojo/nginx",
"template": [
"artifact",
"snyk-scan"
],
"last_modified_at": 1707556534.9300506,
"deployments": [
112,
111
],
"state": "NON-COMPLIANT",
"html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-archived-at-1707630884/artifacts/7981a8ddc00cdc7505dc08fbb80cc79a33b02d6692a59cbe77ca6f491c5432ba",
"api_url": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/nginx-archived-at-1707630884/fingerprint/7981a8ddc00cdc7505dc08fbb80cc79a33b02d6692a59cbe77ca6f491c5432ba"
}
Artifact Information |
|
| Name | cyberdojo/nginx:161d74a |
| Fingerprint | 7981a8ddc00cdc7505dc08fbb80cc79a33b02d6692a59cbe77ca6f491c5432ba |
| Git commit |
161d74a
JonJagger <jon@kosli.com> (main)
1707051040.0 • 3 months ago
Remove unneeded apk upgrade in Dockerfile
|
| CI Build | https://github.com/cyber-dojo/nginx/actions/runs/7774180887 |
| Running | - |
| Exited | aws-beta#3007 aws-prod#2132 |
| Last modified | 1707556534.9300506 • 2 months ago |
Approvals
| None |
Evidence
Evidence for 'snyk-scan'
{ "evidence_type": "snyk", "name": "snyk-scan", "is_compliant": false, "build_url": "https://github.com/cyber-dojo/snyk_scans/actions/runs/7853942406", "evidence_archive_fingerprint": "55d18aad48223e5034756a7c97700f746cf76cee17d82593ab28b5f20404c892", "user_data": {}, "snyk_results": { "dependencyCount": 65, "docker": { "baseImage": "nginx:1.24.0-alpine3.17", "baseImageRemediation": { "advice": [ { "bold": true, "message": "According to our scan, you are currently using the most secure version of the selected base image" } ], "code": "NO_REMEDIATION_AVAILABLE" } }, "filesystemPolicy": true, "filtered": { "ignore": [], "patch": [] }, "hasUnknownVersions": false, "ignoreSettings": { "adminOnly": false, "disregardFilesystemIgnores": false, "reasonRequired": false }, "isPrivate": true, "licensesPolicy": { "orgLicenseRules": { "AGPL-1.0": { "instructions": "", "licenseType": "AGPL-1.0", "severity": "high" }, "AGPL-3.0": { "instructions": "", "licenseType": "AGPL-3.0", "severity": "high" }, "Artistic-1.0": { "instructions": "", "licenseType": "Artistic-1.0", "severity": "medium" }, "Artistic-2.0": { "instructions": "", "licenseType": "Artistic-2.0", "severity": "medium" }, "CDDL-1.0": { "instructions": "", "licenseType": "CDDL-1.0", "severity": "medium" }, "CPOL-1.02": { "instructions": "", "licenseType": "CPOL-1.02", "severity": "high" }, "EPL-1.0": { "instructions": "", "licenseType": "EPL-1.0", "severity": "medium" }, "GPL-2.0": { "instructions": "", "licenseType": "GPL-2.0", "severity": "high" }, "GPL-3.0": { "instructions": "", "licenseType": "GPL-3.0", "severity": "high" }, "LGPL-2.0": { "instructions": "", "licenseType": "LGPL-2.0", "severity": "medium" }, "LGPL-2.1": { "instructions": "", "licenseType": "LGPL-2.1", "severity": "medium" }, "LGPL-3.0": { "instructions": "", "licenseType": "LGPL-3.0", "severity": "medium" }, "MPL-1.1": { "instructions": "", "licenseType": "MPL-1.1", "severity": "medium" }, "MPL-2.0": { "instructions": "", "licenseType": "MPL-2.0", "severity": "medium" }, "MS-RL": { "instructions": "", "licenseType": "MS-RL", "severity": "medium" }, "SimPL-2.0": { "instructions": "", "licenseType": "SimPL-2.0", "severity": "high" } }, "severities": {} }, "ok": false, "org": "jonjagger", "packageManager": "apk", "path": "274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@sha256:7981a8ddc00cdc7505dc08fbb80cc79a33b02d6692a59cbe77ca6f491c5432ba/nginx:161d74a", "platform": "linux/amd64", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "projectName": "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a", "severityThreshold": "medium", "summary": "4 medium or high or critical severity vulnerable dependency paths", "uniqueCount": 2, "vulnerabilities": [ { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2024-02-10T02:30:53.123369Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2024-02-06T13:57:34.460600Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2024-02-09T13:11:37.934083Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.17` relevant fixed versions and status._\n\nlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.\n## Remediation\nUpgrade `Alpine:3.17` `expat` to version 2.6.0-r0 or higher.\n## References\n- [cve@mitre.org](https://cwe.mitre.org/data/definitions/776.html)\n- [cve@mitre.org](https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404)\n- [cve@mitre.org](https://github.com/libexpat/libexpat/pull/777)\n", "disclosureTime": "2024-02-04T20:15:46.120000Z", "dockerBaseImage": "nginx:1.24.0-alpine3.17", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16953", "probability": "0.00051" }, "exploit": "Not Defined", "fixedIn": [ "2.6.0-r0" ], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@*", "expat/libexpat@2.5.0-r0" ], "id": "SNYK-ALPINE317-EXPAT-6241041", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-52426" ], "CWE": [ "CWE-776" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": true, "language": "linux", "malicious": false, "modificationTime": "2024-02-10T02:30:53.130218Z", "name": "expat/libexpat", "nearestFixedInVersion": "2.6.0-r0", "nvdSeverity": "medium", "packageManager": "alpine:3.17", "packageName": "expat", "patches": [], "publicationTime": "2024-02-10T02:30:53.130097Z", "references": [ { "title": "https://cwe.mitre.org/data/definitions/776.html", "url": "https://cwe.mitre.org/data/definitions/776.html" }, { "title": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404", "url": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404" }, { "title": "https://github.com/libexpat/libexpat/pull/777", "url": "https://github.com/libexpat/libexpat/pull/777" } ], "relativeImportance": null, "semver": { "vulnerable": [ "<2.6.0-r0" ] }, "severity": "medium", "severityWithCritical": "medium", "socialTrendAlert": false, "title": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')", "upgradePath": [ false, "expat/libexpat@2.6.0-r0" ], "version": "2.5.0-r0" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2024-02-10T02:31:08.639014Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2024-02-06T13:57:33.167998Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2024-02-09T13:11:36.880020Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.17` relevant fixed versions and status._\n\nlibexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.\n## Remediation\nUpgrade `Alpine:3.17` `expat` to version 2.6.0-r0 or higher.\n## References\n- [cve@mitre.org](https://github.com/libexpat/libexpat/pull/789)\n", "disclosureTime": "2024-02-04T20:15:46.063000Z", "dockerBaseImage": "nginx:1.24.0-alpine3.17", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.10104", "probability": "0.00044" }, "exploit": "Not Defined", "fixedIn": [ "2.6.0-r0" ], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@*", "expat/libexpat@2.5.0-r0" ], "id": "SNYK-ALPINE317-EXPAT-6241042", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-52425" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": true, "language": "linux", "malicious": false, "modificationTime": "2024-02-10T02:31:08.643457Z", "name": "expat/libexpat", "nearestFixedInVersion": "2.6.0-r0", "nvdSeverity": "high", "packageManager": "alpine:3.17", "packageName": "expat", "patches": [], "publicationTime": "2024-02-10T02:31:08.643334Z", "references": [ { "title": "https://github.com/libexpat/libexpat/pull/789", "url": "https://github.com/libexpat/libexpat/pull/789" } ], "relativeImportance": null, "semver": { "vulnerable": [ "<2.6.0-r0" ] }, "severity": "high", "severityWithCritical": "high", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [ false, "expat/libexpat@2.6.0-r0" ], "version": "2.5.0-r0" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2024-02-10T02:30:53.123369Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2024-02-06T13:57:34.460600Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2024-02-09T13:11:37.934083Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.17` relevant fixed versions and status._\n\nlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.\n## Remediation\nUpgrade `Alpine:3.17` `expat` to version 2.6.0-r0 or higher.\n## References\n- [cve@mitre.org](https://cwe.mitre.org/data/definitions/776.html)\n- [cve@mitre.org](https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404)\n- [cve@mitre.org](https://github.com/libexpat/libexpat/pull/777)\n", "disclosureTime": "2024-02-04T20:15:46.120000Z", "dockerBaseImage": "nginx:1.24.0-alpine3.17", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16953", "probability": "0.00051" }, "exploit": "Not Defined", "fixedIn": [ "2.6.0-r0" ], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@*", "fontconfig/fontconfig@2.14.1-r0", "expat/libexpat@2.5.0-r0" ], "id": "SNYK-ALPINE317-EXPAT-6241041", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-52426" ], "CWE": [ "CWE-776" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2024-02-10T02:30:53.130218Z", "name": "expat/libexpat", "nearestFixedInVersion": "2.6.0-r0", "nvdSeverity": "medium", "packageManager": "alpine:3.17", "packageName": "expat", "patches": [], "publicationTime": "2024-02-10T02:30:53.130097Z", "references": [ { "title": "https://cwe.mitre.org/data/definitions/776.html", "url": "https://cwe.mitre.org/data/definitions/776.html" }, { "title": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404", "url": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404" }, { "title": "https://github.com/libexpat/libexpat/pull/777", "url": "https://github.com/libexpat/libexpat/pull/777" } ], "relativeImportance": null, "semver": { "vulnerable": [ "<2.6.0-r0" ] }, "severity": "medium", "severityWithCritical": "medium", "socialTrendAlert": false, "title": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')", "upgradePath": [], "version": "2.5.0-r0" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2024-02-10T02:31:08.639014Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2024-02-06T13:57:33.167998Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2024-02-09T13:11:36.880020Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.17` relevant fixed versions and status._\n\nlibexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.\n## Remediation\nUpgrade `Alpine:3.17` `expat` to version 2.6.0-r0 or higher.\n## References\n- [cve@mitre.org](https://github.com/libexpat/libexpat/pull/789)\n", "disclosureTime": "2024-02-04T20:15:46.063000Z", "dockerBaseImage": "nginx:1.24.0-alpine3.17", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.10104", "probability": "0.00044" }, "exploit": "Not Defined", "fixedIn": [ "2.6.0-r0" ], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:161d74a@*", "fontconfig/fontconfig@2.14.1-r0", "expat/libexpat@2.5.0-r0" ], "id": "SNYK-ALPINE317-EXPAT-6241042", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-52425" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2024-02-10T02:31:08.643457Z", "name": "expat/libexpat", "nearestFixedInVersion": "2.6.0-r0", "nvdSeverity": "high", "packageManager": "alpine:3.17", "packageName": "expat", "patches": [], "publicationTime": "2024-02-10T02:31:08.643334Z", "references": [ { "title": "https://github.com/libexpat/libexpat/pull/789", "url": "https://github.com/libexpat/libexpat/pull/789" } ], "relativeImportance": null, "semver": { "vulnerable": [ "<2.6.0-r0" ] }, "severity": "high", "severityWithCritical": "high", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "2.5.0-r0" } ] }, "created_at": 1707556534.9300506, "has_audit_package": true }