ubi-micro-dev

ID	Age	Component	Trivy Severity	Grype Severity	Red Hat Severity	ubi-micro-dev Opinion
CVE-2025-6176	46	libbrotli	High	High	Important
CVE-2022-27943	1360	libgcc libstdc++	Low	Low	Low	False Positive
CVE-2022-41409	881	pcre2 pcre2-syntax	Low	Low	Low	False Positive
CVE-2023-50495	734	ncurses-libs	Low	Low	Low	False Positive
CVE-2024-13176	329	openssl openssl-libs	Low	Low	Low
CVE-2024-41996	477	openssl openssl-libs	Low	Low	Low
CVE-2025-9232	76	openssl openssl-libs	Low	Low	Low
CVE-2024-21538	403	cross-spawn		High	Low
CVE-2025-64756	28	glob		High	Important
CVE-2025-5889	189	brace-expansion		Low	Low

Security Advisory: CVE-2025-6176

Description:

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

Locations:

libbrotli-1.0.9-7.el9_5

References:

Security Advisory: CVE-2025-9232

Description:

Issue summary: An application using the OpenSSL HTTP client API functions may
trigger an out-of-bounds read if the 'no_proxy' environment variable is set and
the host portion of the authority component of the HTTP URL is an IPv6 address.
Impact summary: An out-of-bounds read can trigger a crash which leads to
Denial of Service for an application.
The OpenSSL HTTP client API functions can be used directly by applications
but they are also used by the OCSP client functions and CMP (Certificate
Management Protocol) client implementation in OpenSSL. However the URLs used
by these implementations are unlikely to be controlled by an attacker.
In this vulnerable code the out of bounds read can only trigger a crash.
Furthermore the vulnerability requires an attacker-controlled URL to be
passed from an application to the OpenSSL function and the user has to have
a 'no_proxy' environment variable set. For the aforementioned reasons the
issue was assessed as Low severity.
The vulnerable code was introduced in the following patch releases:
3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the HTTP client implementation is outside the OpenSSL FIPS module
boundary.

Locations:

openssl-1:3.5.1-4.el9_7
openssl-libs-1:3.5.1-4.el9_7

ghcr.io/ubi-micro-dev/ubi9-micro-dev-nodejs-18:latest

With RPM updates as of