ubi-micro-dev

ID	Age	Component	Trivy Severity	Grype Severity	Red Hat Severity	ubi-micro-dev Opinion
CVE-2023-38552	740	nodejs npm	Medium	Medium	Moderate
CVE-2025-9230	27	openssl openssl-libs	Medium	Medium	Moderate
CVE-2022-27943	1311	libgcc libstdc++	Low	Low	Low	False Positive
CVE-2022-41409	832	pcre2 pcre2-syntax	Low	Low	Low	False Positive
CVE-2023-45143	746	nodejs npm	Low	Low	Low
CVE-2023-50495	685	ncurses-libs	Low	Low	Low	False Positive
CVE-2024-13176	280	openssl openssl-libs	Low	Low	Low
CVE-2024-21538	353	cross-spawn nodejs npm	Low	High	Low
CVE-2024-41996	427	openssl openssl-libs	Low	Low	Low
CVE-2025-9232	27	openssl openssl-libs	Low	Low	Low
CVE-2025-5889	139	brace-expansion nodejs npm		Low	Low

Security Advisory: CVE-2023-38552

Description:

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check.
Impacts:
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Locations:

nodejs-1:20.19.2-1.module+el9.6.0+23146+be9976bd
npm-1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd

References:

Security Advisory: CVE-2025-9232

Description:

Issue summary: An application using the OpenSSL HTTP client API functions may
trigger an out-of-bounds read if the 'no_proxy' environment variable is set and
the host portion of the authority component of the HTTP URL is an IPv6 address.
Impact summary: An out-of-bounds read can trigger a crash which leads to
Denial of Service for an application.
The OpenSSL HTTP client API functions can be used directly by applications
but they are also used by the OCSP client functions and CMP (Certificate
Management Protocol) client implementation in OpenSSL. However the URLs used
by these implementations are unlikely to be controlled by an attacker.
In this vulnerable code the out of bounds read can only trigger a crash.
Furthermore the vulnerability requires an attacker-controlled URL to be
passed from an application to the OpenSSL function and the user has to have
a 'no_proxy' environment variable set. For the aforementioned reasons the
issue was assessed as Low severity.
The vulnerable code was introduced in the following patch releases:
3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as the HTTP client implementation is outside the OpenSSL FIPS module
boundary.

Locations:

openssl-1:3.2.2-6.el9_5.1
openssl-libs-1:3.2.2-6.el9_5.1

ghcr.io/ubi-micro-dev/ubi9-micro-dev-nodejs-20:latest

With RPM updates as of