Skip to content

Commit

Permalink
Automatic vulnerability report update
Browse files Browse the repository at this point in the history
  • Loading branch information
@henrirosten @github-actions
henrirosten authored and github-actions[bot] committed Feb 19, 2024
1 parent 3944204 commit 93a0ab9
Show file tree
Hide file tree
Showing 7 changed files with 206 additions and 229 deletions.
6 changes: 3 additions & 3 deletions reports/ghaf-23.09/data.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -265,11 +265,11 @@ https://github.com/NixOS/nixpkgs/pull/284984"
https://github.com/NixOS/nixpkgs/pull/265619"
"packages.x86_64-linux.generic-x86_64-release","github:tiiuae/ghaf?ref=ghaf-23.09","current","CVE-2023-5344","https://nvd.nist.gov/vuln/detail/CVE-2023-5344","vim","7.5","9.0.1441","9.1.0004","9.1.0113","vim","2023A0000005344","False","","fix_update_to_version_nixpkgs","https://github.com/NixOS/nixpkgs/pull/276595
https://github.com/NixOS/nixpkgs/pull/284984"
"packages.x86_64-linux.generic-x86_64-release","github:tiiuae/ghaf?ref=ghaf-23.09","current","CVE-2023-5217","https://nvd.nist.gov/vuln/detail/CVE-2023-5217","libvpx","8.8","1.13.0","1.14.0","1.14.0","libvpx","2023A0000005217","False","","err_not_vulnerable_based_on_repology","https://github.com/NixOS/nixpkgs/pull/257886
https://github.com/NixOS/nixpkgs/pull/259881
"packages.x86_64-linux.generic-x86_64-release","github:tiiuae/ghaf?ref=ghaf-23.09","current","CVE-2023-5217","https://nvd.nist.gov/vuln/detail/CVE-2023-5217","libvpx","8.8","1.13.0","1.14.0","1.14.0","libvpx","2023A0000005217","False","","err_not_vulnerable_based_on_repology","https://github.com/NixOS/nixpkgs/pull/259881
https://github.com/NixOS/nixpkgs/pull/260189
https://github.com/NixOS/nixpkgs/pull/261404
https://github.com/NixOS/nixpkgs/pull/262808"
https://github.com/NixOS/nixpkgs/pull/262808
https://github.com/NixOS/nixpkgs/pull/268612"
"packages.x86_64-linux.generic-x86_64-release","github:tiiuae/ghaf?ref=ghaf-23.09","current","CVE-2023-5156","https://nvd.nist.gov/vuln/detail/CVE-2023-5156","glibc","7.5","2.37-8","2.38-44","2.39","glibc","2023A0000005156","False","","fix_update_to_version_upstream","https://github.com/NixOS/nixpkgs/pull/287594"
"packages.x86_64-linux.generic-x86_64-release","github:tiiuae/ghaf?ref=ghaf-23.09","current","CVE-2023-5088","https://nvd.nist.gov/vuln/detail/CVE-2023-5088","qemu","7.0","8.0.4","8.2.1","8.2.1","qemu","2023A0000005088","False","","err_not_vulnerable_based_on_repology",""
"packages.x86_64-linux.generic-x86_64-release","github:tiiuae/ghaf?ref=ghaf-23.09","current","CVE-2023-4863","https://nvd.nist.gov/vuln/detail/CVE-2023-4863","libwebp","8.8","1.3.1","1.3.2","1.3.2","libwebp","2023A0000004863","False","","fix_update_to_version_nixpkgs","https://github.com/NixOS/nixpkgs/pull/255786
Expand Down
4 changes: 2 additions & 2 deletions reports/ghaf-23.09/packages.x86_64-linux.generic-x86_64-release.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ Update the target Ghaf [flake.lock](https://github.com/tiiuae/ghaf/blob/main/fla
| vuln_id | package | severity | version_local | nix_unstable | upstream | comment |
|-------------------------------------------------------------------|-----------|------------|------------------|----------------|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [CVE-2023-40359](https://nvd.nist.gov/vuln/detail/CVE-2023-40359) | xterm | 9.8 | 379 | 388 | 389 | Backport to 23.05 ongoing in PR: [link](https://github.com/NixOS/nixpkgs/pull/254541). *[[PR](https://github.com/NixOS/nixpkgs/pull/244141), [PR](https://github.com/NixOS/nixpkgs/pull/254541), [PR](https://github.com/NixOS/nixpkgs/pull/258619), [PR](https://github.com/NixOS/nixpkgs/pull/278267)]* |
| [CVE-2023-5217](https://nvd.nist.gov/vuln/detail/CVE-2023-5217) | libvpx | 8.8 | 1.13.0 | 1.14.0 | 1.14.0 | *[[PR](https://github.com/NixOS/nixpkgs/pull/257886), [PR](https://github.com/NixOS/nixpkgs/pull/259881), [PR](https://github.com/NixOS/nixpkgs/pull/260189), [PR](https://github.com/NixOS/nixpkgs/pull/261404), [PR](https://github.com/NixOS/nixpkgs/pull/262808)]* |
| [CVE-2023-5217](https://nvd.nist.gov/vuln/detail/CVE-2023-5217) | libvpx | 8.8 | 1.13.0 | 1.14.0 | 1.14.0 | *[[PR](https://github.com/NixOS/nixpkgs/pull/259881), [PR](https://github.com/NixOS/nixpkgs/pull/260189), [PR](https://github.com/NixOS/nixpkgs/pull/261404), [PR](https://github.com/NixOS/nixpkgs/pull/262808), [PR](https://github.com/NixOS/nixpkgs/pull/268612)]* |
| [CVE-2023-4863](https://nvd.nist.gov/vuln/detail/CVE-2023-4863) | libwebp | 8.8 | 1.3.1 | 1.3.2 | 1.3.2 | *[[PR](https://github.com/NixOS/nixpkgs/pull/255786), [PR](https://github.com/NixOS/nixpkgs/pull/255959), [PR](https://github.com/NixOS/nixpkgs/pull/258217), [PR](https://github.com/NixOS/nixpkgs/pull/258430), [PR](https://github.com/NixOS/nixpkgs/pull/261876)]* |
| [CVE-2023-43887](https://nvd.nist.gov/vuln/detail/CVE-2023-43887) | libde265 | 8.1 | 1.0.12 | 1.0.15 | 1.0.15 | *[[PR](https://github.com/NixOS/nixpkgs/pull/268884), [PR](https://github.com/NixOS/nixpkgs/pull/271642), [PR](https://github.com/NixOS/nixpkgs/pull/271643), [PR](https://github.com/NixOS/nixpkgs/pull/275720), [PR](https://github.com/NixOS/nixpkgs/pull/276799)]* |
| [CVE-2023-43787](https://nvd.nist.gov/vuln/detail/CVE-2023-43787) | libX11 | 7.8 | 1.8.6 | 1.8.7 | 1.8.7 | *[[PR](https://github.com/NixOS/nixpkgs/pull/258841), [PR](https://github.com/NixOS/nixpkgs/pull/258996)]* |
Expand Down Expand Up @@ -116,7 +116,7 @@ Consider [whitelisting](../../manual_analysis.csv) possible false positives base
| [CVE-2023-45234](https://nvd.nist.gov/vuln/detail/CVE-2023-45234) | edk2 | 8.8 | 202211 | 202311 | 202311 | *[[PR](https://github.com/NixOS/nixpkgs/pull/281405)]* |
| [CVE-2023-45230](https://nvd.nist.gov/vuln/detail/CVE-2023-45230) | edk2 | 8.8 | 202211 | 202311 | 202311 | *[[PR](https://github.com/NixOS/nixpkgs/pull/281405)]* |
| [CVE-2023-7216](https://nvd.nist.gov/vuln/detail/CVE-2023-7216) | cpio | 8.8 | 2.14 | 2.15 | 2.15 | |
| [CVE-2023-5217](https://nvd.nist.gov/vuln/detail/CVE-2023-5217) | libvpx | 8.8 | 1.13.0 | 1.14.0 | 1.14.0 | *[[PR](https://github.com/NixOS/nixpkgs/pull/257886), [PR](https://github.com/NixOS/nixpkgs/pull/259881), [PR](https://github.com/NixOS/nixpkgs/pull/260189), [PR](https://github.com/NixOS/nixpkgs/pull/261404), [PR](https://github.com/NixOS/nixpkgs/pull/262808)]* |
| [CVE-2023-5217](https://nvd.nist.gov/vuln/detail/CVE-2023-5217) | libvpx | 8.8 | 1.13.0 | 1.14.0 | 1.14.0 | *[[PR](https://github.com/NixOS/nixpkgs/pull/259881), [PR](https://github.com/NixOS/nixpkgs/pull/260189), [PR](https://github.com/NixOS/nixpkgs/pull/261404), [PR](https://github.com/NixOS/nixpkgs/pull/262808), [PR](https://github.com/NixOS/nixpkgs/pull/268612)]* |
| [CVE-2023-4863](https://nvd.nist.gov/vuln/detail/CVE-2023-4863) | libwebp | 8.8 | 1.3.1 | 1.3.2 | 1.3.2 | *[[PR](https://github.com/NixOS/nixpkgs/pull/255786), [PR](https://github.com/NixOS/nixpkgs/pull/255959), [PR](https://github.com/NixOS/nixpkgs/pull/258217), [PR](https://github.com/NixOS/nixpkgs/pull/258430), [PR](https://github.com/NixOS/nixpkgs/pull/261876)]* |
| [CVE-2023-2680](https://nvd.nist.gov/vuln/detail/CVE-2023-2680) | qemu | 8.2 | 8.0.4 | 8.2.1 | 8.2.1 | |
| [CVE-2023-43887](https://nvd.nist.gov/vuln/detail/CVE-2023-43887) | libde265 | 8.1 | 1.0.12 | 1.0.15 | 1.0.15 | *[[PR](https://github.com/NixOS/nixpkgs/pull/268884), [PR](https://github.com/NixOS/nixpkgs/pull/271642), [PR](https://github.com/NixOS/nixpkgs/pull/271643), [PR](https://github.com/NixOS/nixpkgs/pull/275720), [PR](https://github.com/NixOS/nixpkgs/pull/276799)]* |
Expand Down
Loading

0 comments on commit 93a0ab9

Please sign in to comment.