-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
3a266a7
commit 45c4a3d
Showing
24 changed files
with
2,170 additions
and
270 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,15 @@ | ||
| ## Container scan evidence CVE | ||
| <strong>Image name:</strong> registry.ente.regione.emr.it/parer/okd/verifica-firma-eidas:sast | ||
| <br/><strong>Run date:</strong> Mon Jan 29 12:20:03 CET 2024 | ||
| <br/><strong>Produced by:</strong> <a href="https://gitlab.ente.regione.emr.it/parer/okd/verifica-firma-eidas/-/jobs/156713">Job</a> | ||
| <br/><strong>CVE founded:</strong> 0 | ||
| <br/><strong>Run date:</strong> Mon Jun 24 11:42:47 CEST 2024 | ||
| <br/><strong>Produced by:</strong> <a href="https://gitlab.ente.regione.emr.it/parer/okd/verifica-firma-eidas/-/jobs/274963">Job</a> | ||
| <br/><strong>CVE founded:</strong> 8 | ||
| | CVE | Description | Severity | Solution | | ||
| |:---:|:---|:---:|:---| | ||
| | [CVE-2024-2961](http://www.openwall.com/lists/oss-security/2024/04/17/9)|The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.|High|Upgrade glibc to 2.28-251.el8_10.1| | ||
| | [CVE-2024-33599](https://access.redhat.com/errata/RHSA-2024:3344)|nscd: Stack-based buffer overflow in netgroup cacheIf the Name Service Cache Daemon's (nscd) fixed size cache is exhaustedby client requests then a subsequent client request for netgroup datamay result in a stack-based buffer overflow. This flaw was introducedin glibc 2.15 when the cache was added to nscd.This vulnerability is only present in the nscd binary.|High|Upgrade glibc to 2.28-251.el8_10.2| | ||
| | [CVE-2024-2961](http://www.openwall.com/lists/oss-security/2024/04/17/9)|The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.|High|Upgrade glibc-common to 2.28-251.el8_10.1| | ||
| | [CVE-2024-33599](https://access.redhat.com/errata/RHSA-2024:3344)|nscd: Stack-based buffer overflow in netgroup cacheIf the Name Service Cache Daemon's (nscd) fixed size cache is exhaustedby client requests then a subsequent client request for netgroup datamay result in a stack-based buffer overflow. This flaw was introducedin glibc 2.15 when the cache was added to nscd.This vulnerability is only present in the nscd binary.|High|Upgrade glibc-common to 2.28-251.el8_10.2| | ||
| | [CVE-2024-2961](http://www.openwall.com/lists/oss-security/2024/04/17/9)|The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.|High|Upgrade glibc-minimal-langpack to 2.28-251.el8_10.1| | ||
| | [CVE-2024-33599](https://access.redhat.com/errata/RHSA-2024:3344)|nscd: Stack-based buffer overflow in netgroup cacheIf the Name Service Cache Daemon's (nscd) fixed size cache is exhaustedby client requests then a subsequent client request for netgroup datamay result in a stack-based buffer overflow. This flaw was introducedin glibc 2.15 when the cache was added to nscd.This vulnerability is only present in the nscd binary.|High|Upgrade glibc-minimal-langpack to 2.28-251.el8_10.2| | ||
| | [CVE-2023-6597](http://www.openwall.com/lists/oss-security/2024/03/20/5)|An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.|High|Upgrade platform-python to 3.6.8-62.el8_10| | ||
| | [CVE-2023-6597](http://www.openwall.com/lists/oss-security/2024/03/20/5)|An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.|High|Upgrade python3-libs to 3.6.8-62.el8_10| |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| ## 1.16.0 (14-03-2024) | ||
| ## 1.22.1 (24-06-2024) | ||
|
|
||
| ### Novità: 1 | ||
| - [#31419](https://parermine.regione.emilia-romagna.it/issues/31419) Attivazione statistiche per monitoraggio con prometheus | ||
| ### Bugfix: 1 | ||
| - [#32811](https://parermine.regione.emilia-romagna.it/issues/32811) Correzione gestione "log level error" nei casi di errori "non previsti" da "gestiti in verifica firma digitale" |
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,15 +2,16 @@ | |
| <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
| <artifactId>verifica-firma-eidas</artifactId> | ||
| <version>1.16.1-SNAPSHOT</version> | ||
| <version>1.22.1</version> | ||
| <packaging>${packaging.type}</packaging> | ||
| <name>Verifica Firma EIDAS</name> | ||
| <description>Progetto per effettuare firme e validazioni con librerie DSS (EIDAS)</description> | ||
| <url>https://nexus.ente.regione.emr.it/repository/parer-site/verifica-firma-eidas/${project.version}/</url> | ||
|
|
||
| <parent> | ||
| <groupId>it.eng.parer</groupId> | ||
| <artifactId>parer-pom</artifactId> | ||
| <version>4.2.0</version> | ||
| <version>5.2.1</version> | ||
| </parent> | ||
|
|
||
| <properties> | ||
|
|
@@ -43,24 +44,17 @@ | |
| </properties> | ||
|
|
||
| <scm> | ||
| <developerConnection>scm:git:https://github.com/RegioneER/parer-verifica-firma-eidas.git</developerConnection> | ||
| <tag>HEAD</tag> | ||
| <developerConnection>scm:git:[email protected]:parer/okd/verifica-firma-eidas.git</developerConnection> | ||
| <tag>verifica-firma-eidas-1.22.1</tag> | ||
| </scm> | ||
|
|
||
| <distributionManagement> | ||
| <repository> | ||
| <id>github</id> | ||
| <url>https://maven.pkg.github.com/RegioneER/parer-verifica-firma-eidas</url> | ||
| </repository> | ||
| <site> | ||
| <id>site</id> | ||
| <url>dav:https://nexus.ente.regione.emr.it/repository/parer-site/verifica-firma-eidas/${project.version}</url> | ||
| </site> | ||
| </distributionManagement> | ||
|
|
||
| <repositories> | ||
| <repository> | ||
| <id>github</id> | ||
| <url>https://maven.pkg.github.com/RegioneER/parer-framework-parerpom</url> | ||
| </repository> | ||
| </repositories> | ||
|
|
||
| <dependencyManagement> | ||
| <dependencies> | ||
| <!-- DSS bom --> | ||
|
|
||
Oops, something went wrong.