Skip to content

Commit 877e93f

Browse files
authored
Merge branch 'master' into dependabot/go_modules/golang.org/x/mod-0.31.0
2 parents cc7f828 + 0f05103 commit 877e93f

File tree

7 files changed

+435
-392
lines changed

7 files changed

+435
-392
lines changed

.circleci/config.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ orbs:
77
references:
88
install_trivy_and_download_dbs: &install_trivy_and_download_dbs
99
persist_to_workspace: true
10-
# https://aquasecurity.github.io/trivy/v0.65/getting-started/installation/#install-script
10+
# https://trivy.dev/docs/v0.68/getting-started/installation/#installing-trivy
1111
cmd: |
12-
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b . v0.66.0
12+
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b . v0.68.2
1313
mkdir cache
1414
./trivy --cache-dir ./cache image --download-db-only
1515

docs/multiple-tests/all-patterns/results.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,12 @@
2121
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2021-44832: log4j-core: remote code execution via JDBC Appender) (update to 2.17.1)"
2222
severity="warning"
2323
/>
24+
<error
25+
source="vulnerability_medium"
26+
line="1"
27+
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2. ...) (update to 2.25.3)"
28+
severity="warning"
29+
/>
2430
<error
2531
source="vulnerability_critical"
2632
line="2"

docs/multiple-tests/pattern-vulnerability-critical/results.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@
77
message="Insecure dependency golang/[email protected] (CVE-2024-24790: golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses) (update to 1.21.11)"
88
severity="error"
99
/>
10+
<error
11+
source="vulnerability_critical"
12+
line="8"
13+
message="Insecure dependency golang/github.com/ollama/[email protected] (CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operations) (no fix available)"
14+
severity="error"
15+
/>
1016
</file>
1117

1218
<file name="gradle/gradle.lockfile">

docs/multiple-tests/pattern-vulnerability-high/results.xml

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -85,19 +85,13 @@
8585
<error
8686
source="vulnerability_high"
8787
line="5"
88-
message="Insecure dependency golang/[email protected] (CVE-2025-58186: Despite HTTP headers having a default limit of 1MB, the number of cook ...) (update to 1.24.8)"
89-
severity="high"
90-
/>
91-
<error
92-
source="vulnerability_high"
93-
line="5"
94-
message="Insecure dependency golang/[email protected] (CVE-2025-58187: Due to the design of the name constraint checking algorithm, the proce ...) (update to 1.24.9)"
88+
message="Insecure dependency golang/[email protected] (CVE-2025-58183: golang: archive/tar: Unbounded allocation when parsing GNU sparse map) (update to 1.24.8)"
9589
severity="high"
9690
/>
9791
<error
9892
source="vulnerability_high"
9993
line="5"
100-
message="Insecure dependency golang/[email protected] (CVE-2025-58183: golang: archive/tar: Unbounded allocation when parsing GNU sparse map) (update to 1.24.8)"
94+
message="Insecure dependency golang/[email protected] (CVE-2025-61729: crypto/x509: Excessive resource consumption when printing error string for host certificate validation in crypto/x509) (update to 1.24.11)"
10195
severity="high"
10296
/>
10397
</file>

docs/multiple-tests/pattern-vulnerability-medium/results.xml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,9 +170,33 @@
170170
message="Insecure dependency golang/[email protected] (CVE-2025-58188: crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509) (update to 1.24.8)"
171171
severity="warning"
172172
/>
173+
<error
174+
source="vulnerability_medium"
175+
line="3"
176+
message="Insecure dependency golang/[email protected] (CVE-2025-58186: golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http) (update to 1.24.8)"
177+
severity="warning"
178+
/>
179+
<error
180+
source="vulnerability_medium"
181+
line="3"
182+
message="Insecure dependency golang/[email protected] (CVE-2025-58187: crypto/x509: Quadratic complexity when checking name constraints in crypto/x509) (update to 1.24.9)"
183+
severity="warning"
184+
/>
185+
<error
186+
source="vulnerability_medium"
187+
line="3"
188+
message="Insecure dependency golang/[email protected] (CVE-2025-61727: golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs) (update to 1.24.11)"
189+
severity="warning"
190+
/>
173191
</file>
174192

175193
<file name="gradle/gradle.lockfile">
194+
<error
195+
source="vulnerability_medium"
196+
line="1"
197+
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2. ...) (update to 2.25.3)"
198+
severity="warning"
199+
/>
176200
<error
177201
source="vulnerability_medium"
178202
line="1"
@@ -188,6 +212,12 @@
188212
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2021-44832: log4j-core: remote code execution via JDBC Appender) (update to 2.17.1)"
189213
severity="warning"
190214
/>
215+
<error
216+
source="vulnerability_medium"
217+
line="14"
218+
message="Insecure dependency maven/org.apache.logging.log4j/[email protected] (CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2. ...) (update to 2.25.3)"
219+
severity="warning"
220+
/>
191221
</file>
192222

193223
<file name="javascript/package-lock.json">

0 commit comments

Comments
 (0)