Skip to content

Deps: Bump the python-packages group with 5 updates #294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
greenbonebot merged 1 commit into from
Aug 25, 2025
Merged

Deps: Bump the python-packages group with 5 updates #294

greenbonebot merged 1 commit into from
Aug 25, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 25, 2025

Bumps the python-packages group with 5 updates:

Package From To
pontos 25.8.0 25.8.1
coverage 7.10.4 7.10.5
h2 4.2.0 4.3.0
lxml 6.0.0 6.0.1
ruff 0.12.9 0.12.10

Updates pontos from 25.8.0 to 25.8.1

Release notes

Sourced from pontos's releases.

pontos 25.8.1

25.8.1 - 2025-08-20

Changed

  • Rust support for workspace.package.version 83e17f1a

Dependencies

  • Bump actions/checkout from 4.2.2 to 4.3.0 in the actions group c2656f8e
  • Bump coverage from 7.10.3 to 7.10.4 in the python-packages group 18e2dee7
Commits
  • 7189a16 Automatic release to 25.8.1
  • 83e17f1 Change: Rust support for workspace.package.version
  • c2656f8 Deps: Bump actions/checkout from 4.2.2 to 4.3.0 in the actions group
  • 18e2dee Deps: Bump coverage from 7.10.3 to 7.10.4 in the python-packages group
  • 69db3f9 Automatic adjustments after release [skip ci]
  • See full diff in compare view

Updates coverage from 7.10.4 to 7.10.5

Changelog

Sourced from coverage's changelog.

Version 7.10.5 — 2025-08-23

  • Big speed improvements for coverage combine: it's now about twice as fast! Huge thanks to Alex Gaynor for pull requests 2032 <pull 2032_>, 2033 <pull 2033_>, and 2034 <pull 2034_>_.

.. _pull 2032: nedbat/coveragepy#2032 .. _pull 2033: nedbat/coveragepy#2033 .. _pull 2034: nedbat/coveragepy#2034

.. _changes_7-10-4:

Commits
  • 810abeb chore: make upgrade
  • 3c8f1b5 build: use --universal to keep platform conditions in .pip files
  • 107ae05 docs: sample HTML for 7.10.5
  • b5bc6d4 docs: prep for 7.10.5
  • a5c18cc style: auto-generated changes shouldn't trigger ruff re-formatting
  • 1f9f840 build: tooling for ruff formatting
  • 9ee5b3e chore: make upgrade
  • bfeb2ae style: fix things so pylint is happy with ruff
  • 82467f7 chore: ruff format .
  • 0a7b733 refactor: remove unused things from lab/
  • Additional commits viewable in compare view

Updates h2 from 4.2.0 to 4.3.0

Changelog

Sourced from h2's changelog.

4.3.0 (2025-08-23)

API Changes (Backward Incompatible)

  • Reject header names and values containing illegal characters, based on RFC 9113, section 8.2.1. The main Python API is compatible, but some previously valid requests/response headers might now be blocked. Use the validate_inbound_headers config option if needed. Thanks to Sebastiano Sartor (sebsrt) for the report.

API Changes (Backward Compatible)

  • h2 events now have tighter type bounds, e.g. stream_id is guaranteed to not be None for most events now. This simplifies downstream type checking.
  • Various typing-related improvements.

Bugfixes

  • Fix error value when opening a new stream on too many open streams.
Commits
  • 1aae569 v4.3.0
  • 9e4bbed merge surrounding whitespace and uppercase validators into illegal character ...
  • 035e989 be stricter about which characters to accept for headers
  • 883ed37 reject header names and values containing unpermitted characters \r, \n, ...
  • 0583911 lint: fix TC006
  • bbd3d90 fix(packaging): bump twine to pass meta check wildcard bugs
  • ea3140f cleanup
  • 9ce83ff exclude RDT from sdist
  • 492d3db Update .readthedocs.yaml
  • 243461d Create RTD config
  • Additional commits viewable in compare view

Updates lxml from 6.0.0 to 6.0.1

Changelog

Sourced from lxml's changelog.

6.0.1 (2025-08-22)

Bugs fixed

  • LP#2116333: lxml.sax._getNsTag() could fail with an exception on malformed input.

  • GH#467: Some test adaptations were made for libxml2 2.15. Patch by Nick Wellnhofer.

  • LP2119510, GH#473: A Python compatibility test was fixed for Python 3.14+. Patch by Lumír Balhar.

  • GH#471: Wheels for "riscv64" on recent Python versions were added. Patch by ffgan.

  • GH#469: The wheel build no longer requires the wheel package unconditionally. Patch by Miro Hrončok.

  • Binary wheels use the library version libxml2 2.14.5.

  • Windows binary wheels continue to use a security patched library version libxml2 2.11.9.

Commits
  • 5aca07d Prepare release of lxml 6.0.1.
  • f0e555a Build: Add Py3.14 also to tox.ini.
  • afc745a Update changelog.
  • 25242c6 Build: Add "riscv64" wheels for Py3.12+.
  • 457c564 Build: Mark Py3.14 as officially supported.
  • 66a3cc3 Remove Py2 test code.
  • 6e88838 CI: Fix version usage in cache keys.
  • fe5df46 Build: bump the github-actions group across 1 directory with 3 updates (#476)
  • 9177121 CI: Configure library versions centrally in pyproject.toml to prevent build t...
  • 525c6b9 Build: Separate libs cache by CPU architecture.
  • Additional commits viewable in compare view

Updates ruff from 0.12.9 to 0.12.10

Release notes

Sourced from ruff's releases.

0.12.10

Release Notes

Preview features

  • [flake8-simplify] Implement fix for maxsplit without separator (SIM905) (#19851)
  • [flake8-use-pathlib] Add fixes for PTH102 and PTH103 (#19514)

Bug fixes

  • [isort] Handle multiple continuation lines after module docstring (I002) (#19818)
  • [pyupgrade] Avoid reporting __future__ features as unnecessary when they are used (UP010) (#19769)
  • [pyupgrade] Handle nested Optionals (UP045) (#19770)

Rule changes

  • [pycodestyle] Make E731 fix unsafe instead of display-only for class assignments (#19700)
  • [pyflakes] Add secondary annotation showing previous definition (F811) (#19900)

Documentation

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.12.10

Preview features

  • [flake8-simplify] Implement fix for maxsplit without separator (SIM905) (#19851)
  • [flake8-use-pathlib] Add fixes for PTH102 and PTH103 (#19514)

Bug fixes

  • [isort] Handle multiple continuation lines after module docstring (I002) (#19818)
  • [pyupgrade] Avoid reporting __future__ features as unnecessary when they are used (UP010) (#19769)
  • [pyupgrade] Handle nested Optionals (UP045) (#19770)

Rule changes

  • [pycodestyle] Make E731 fix unsafe instead of display-only for class assignments (#19700)
  • [pyflakes] Add secondary annotation showing previous definition (F811) (#19900)

Documentation

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Deps: Bump the python-packages group with 5 updates
9ae08bc 
Bumps the python-packages group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [pontos](https://github.com/greenbone/pontos) | `25.8.0` | `25.8.1` |
| [coverage](https://github.com/nedbat/coveragepy) | `7.10.4` | `7.10.5` |
| [h2](https://github.com/python-hyper/h2) | `4.2.0` | `4.3.0` |
| [lxml](https://github.com/lxml/lxml) | `6.0.0` | `6.0.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.12.9` | `0.12.10` |


Updates `pontos` from 25.8.0 to 25.8.1
- [Release notes](https://github.com/greenbone/pontos/releases)
- [Commits](greenbone/pontos@v25.8.0...v25.8.1)

Updates `coverage` from 7.10.4 to 7.10.5
- [Release notes](https://github.com/nedbat/coveragepy/releases)
- [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.10.4...7.10.5)

Updates `h2` from 4.2.0 to 4.3.0
- [Changelog](https://github.com/python-hyper/h2/blob/master/CHANGELOG.rst)
- [Commits](python-hyper/h2@v4.2.0...v4.3.0)

Updates `lxml` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.0.0...lxml-6.0.1)

Updates `ruff` from 0.12.9 to 0.12.10
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.12.9...0.12.10)

---
updated-dependencies:
- dependency-name: pontos
  dependency-version: 25.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: coverage
  dependency-version: 7.10.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: h2
  dependency-version: 4.3.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: lxml
  dependency-version: 6.0.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: ruff
  dependency-version: 0.12.10
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 25, 2025
@dependabot dependabot bot requested review from a team as code owners August 25, 2025 06:50
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 25, 2025
@greenbonebot greenbonebot enabled auto-merge (rebase) August 25, 2025 06:50
@github-actions
Copy link

github-actions bot commented Aug 25, 2025

Conventional Commits Report

Type Number
Dependencies 1

🚀 Conventional commits found.

@github-actions
Copy link

github-actions bot commented Aug 25, 2025

🔍 Vulnerabilities of harbor-os.greenbone.net/community/greenbone-feed-sync:294-merge-amd64

📦 Image Reference harbor-os.greenbone.net/community/greenbone-feed-sync:294-merge-amd64
digestsha256:12d5071e22af07eb4c17b118c324b8d16c18b975048a1febc05d697780056047
vulnerabilitiescritical: 0 high: 1 medium: 2 low: 33
size67 MB
packages190
📦 Base Image debian:stable-20250811-slim
also known as
  • stable-slim
digestsha256:a1c1968fb091b256477e675a99ab3fa6f4c2d047ae7f506f92255cf5f0c2cf5e
vulnerabilitiescritical: 0 high: 0 medium: 1 low: 20
critical: 0 high: 1 medium: 1 low: 0 python3.13 3.13.5-2 (deb)

pkg:deb/debian/python3.13@3.13.5-2?os_distro=trixie&os_name=debian&os_version=13

high : CVE--2025--8194

Affected range>=3.13.5-2
Fixed versionNot Fixed
EPSS Score0.09%
EPSS Percentile26th percentile
Description

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

medium : CVE--2025--6069

Affected range>=3.13.5-2
Fixed versionNot Fixed
EPSS Score0.08%
EPSS Percentile24th percentile
Description

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

critical: 0 high: 0 medium: 1 low: 1 tar 1.35+dfsg-3.1 (deb)

pkg:deb/debian/tar@1.35%2Bdfsg-3.1?os_distro=trixie&os_name=debian&os_version=13

medium : CVE--2025--45582

Affected range>=1.35+dfsg-3.1
Fixed versionNot Fixed
EPSS Score0.04%
EPSS Percentile11th percentile
Description

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages).

Disputed tar issue, works as documented per upstream:
https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html
https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md

low : CVE--2005--2541

Affected range>=1.35+dfsg-3.1
Fixed versionNot Fixed
EPSS Score3.25%
EPSS Percentile87th percentile
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

critical: 0 high: 0 medium: 0 low: 9 openssh 1:10.0p1-7 (deb)

pkg:deb/debian/openssh@1:10.0p1-7?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2023--51767

Affected range>=1:10.0p1-7
Fixed versionNot Fixed
EPSS Score0.01%
EPSS Percentile1st percentile
Description

OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.

low : CVE--2020--15778

Affected range>=1:10.0p1-7
Fixed versionNot Fixed
EPSS Score67.53%
EPSS Percentile99th percentile
Description

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

low : CVE--2020--14145

Affected range>=1:10.0p1-7
Fixed versionNot Fixed
EPSS Score2.06%
EPSS Percentile83rd percentile
Description

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

low : CVE--2019--6110

Affected range>=1:10.0p1-7
Fixed versionNot Fixed
EPSS Score53.11%
EPSS Percentile98th percentile
Description

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

low : CVE--2018--15919

Affected range>=1:10.0p1-7
Fixed versionNot Fixed
EPSS Score0.72%
EPSS Percentile72nd percentile
Description

Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'

low : CVE--2016--20012

Affected range>=1:10.0p1-7
Fixed versionNot Fixed
EPSS Score25.27%
EPSS Percentile96th percentile
Description

OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product

low : CVE--2008--3234

Affected range>=1:10.0p1-7
Fixed versionNot Fixed
EPSS Score2.79%
EPSS Percentile86th percentile
Description

sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by appending a :/ (colon slash) sequence, followed by the role name, to the username.

  • openssh (unimportant)
    this is by design

low : CVE--2007--2768

Affected range>=1:10.0p1-7
Fixed versionNot Fixed
EPSS Score0.66%
EPSS Percentile70th percentile
Description

OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.

low : CVE--2007--2243

Affected range>=1:10.0p1-7
Fixed versionNot Fixed
EPSS Score0.48%
EPSS Percentile64th percentile
Description

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.

critical: 0 high: 0 medium: 0 low: 7 glibc 2.41-12 (deb)

pkg:deb/debian/glibc@2.41-12?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2019--9192

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.16%
EPSS Percentile38th percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

low : CVE--2019--1010025

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.23%
EPSS Percentile46th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.

low : CVE--2019--1010024

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.38%
EPSS Percentile58th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010023

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.70%
EPSS Percentile71st percentile
Description

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010022

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.14%
EPSS Percentile35th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2018--20796

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score2.05%
EPSS Percentile83rd percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

low : CVE--2010--4756

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.37%
EPSS Percentile58th percentile
Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

  • glibc (unimportant)
  • eglibc (unimportant)
    That's standard POSIX behaviour implemented by (e)glibc. Applications using
    glob need to impose limits for themselves
critical: 0 high: 0 medium: 0 low: 4 systemd 257.7-1 (deb)

pkg:deb/debian/systemd@257.7-1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2023--31439

Affected range>=257.7-1
Fixed versionNot Fixed
EPSS Score0.09%
EPSS Percentile27th percentile
Description

An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2023--31438

Affected range>=257.7-1
Fixed versionNot Fixed
EPSS Score0.10%
EPSS Percentile28th percentile
Description

An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2023--31437

Affected range>=257.7-1
Fixed versionNot Fixed
EPSS Score0.13%
EPSS Percentile33rd percentile
Description

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2013--4392

Affected range>=257.7-1
Fixed versionNot Fixed
EPSS Score0.07%
EPSS Percentile21st percentile
Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

critical: 0 high: 0 medium: 0 low: 3 krb5 1.21.3-5 (deb)

pkg:deb/debian/krb5@1.21.3-5?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2024--26461

Affected range>=1.21.3-5
Fixed versionNot Fixed
EPSS Score0.08%
EPSS Percentile25th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

low : CVE--2024--26458

Affected range>=1.21.3-5
Fixed versionNot Fixed
EPSS Score0.21%
EPSS Percentile43rd percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

low : CVE--2018--5709

Affected range>=1.21.3-5
Fixed versionNot Fixed
EPSS Score0.46%
EPSS Percentile63rd percentile
Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

critical: 0 high: 0 medium: 0 low: 2 coreutils 9.7-3 (deb)

pkg:deb/debian/coreutils@9.7-3?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--5278

Affected range>=9.7-3
Fixed versionNot Fixed
EPSS Score0.02%
EPSS Percentile3rd percentile
Description

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

low : CVE--2017--18018

Affected range>=9.7-3
Fixed versionNot Fixed
EPSS Score0.06%
EPSS Percentile17th percentile
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

critical: 0 high: 0 medium: 0 low: 1 sqlite3 3.46.1-7 (deb)

pkg:deb/debian/sqlite3@3.46.1-7?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2021--45346

Affected range>=3.46.1-7
Fixed versionNot Fixed
EPSS Score0.21%
EPSS Percentile44th percentile
Description

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

critical: 0 high: 0 medium: 0 low: 1 apt 3.0.3 (deb)

pkg:deb/debian/apt@3.0.3?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2011--3374

Affected range>=3.0.3
Fixed versionNot Fixed
EPSS Score1.51%
EPSS Percentile80th percentile
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

critical: 0 high: 0 medium: 0 low: 1 shadow 1:4.17.4-2 (deb)

pkg:deb/debian/shadow@1:4.17.4-2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2007--5686

Affected range>=1:4.17.4-2
Fixed versionNot Fixed
EPSS Score0.33%
EPSS Percentile55th percentile
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

  • shadow (unimportant)
    See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so
    unknown usernames are not recorded on login failures
critical: 0 high: 0 medium: 0 low: 1 openssl 3.5.1-1 (deb)

pkg:deb/debian/openssl@3.5.1-1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2010--0928

Affected range>=3.2.1-3
Fixed versionNot Fixed
EPSS Score0.11%
EPSS Percentile30th percentile
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
openssl/openssl#24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.41-5 (deb)

pkg:deb/debian/util-linux@2.41-5?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2022--0563

Affected range>=2.41-5
Fixed versionNot Fixed
EPSS Score0.03%
EPSS Percentile5th percentile
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 python-pip 25.1.1+dfsg-1 (deb)

pkg:deb/debian/python-pip@25.1.1%2Bdfsg-1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2018--20225

Affected range>=25.1.1+dfsg-1
Fixed versionNot Fixed
EPSS Score2.54%
EPSS Percentile85th percentile
Description

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

critical: 0 high: 0 medium: 0 low: 1 perl 5.40.1-6 (deb)

pkg:deb/debian/perl@5.40.1-6?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2011--4116

Affected range>=5.40.1-6
Fixed versionNot Fixed
EPSS Score0.16%
EPSS Percentile38th percentile
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

@greenbonebot greenbonebot merged commit db84459 into main Aug 25, 2025
24 checks passed
@greenbonebot greenbonebot deleted the dependabot/pip/python-packages-1e67c31029 branch August 25, 2025 09:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@easamoah7 easamoah7 easamoah7 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@easamoah7 @greenbonebot