Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
GavCo 1 hours ago [-]
These are CVEs in the base image and in standard lib dependencies. For example, just scanned an unhardened image I built today:
Unhardened: docker.io/nanoco/nanoclaw:agent-alpha
71 packages, 344 unique CVEs, linux/arm64
PACKAGE VERSION TYP C H M L N TOT
-----------------------------------------------------------
expat 2.5.0 deb 0 4 18 1 2 25
curl 7.88.1 deb 4 4 6 0 7 21
hono 4.12.14 npm 0 1 18 2 0 21
libtiff 4.5.0 deb 0 2 1 1 15 20
perl 5.36.0 deb 5 6 3 0 3 17
pnpm 10.33.0 npm 0 8 7 0 0 15
glibc 2.36 deb 1 2 2 1 7 13
openjpeg 2.5.0 deb 0 0 3 1 9 13
cups 2.4.2 deb 0 2 8 0 1 11
glib2 2.74.6 deb 1 7 1 0 1 10
tar 1.34(+2) deb 1 1 7 0 1 10
llvm 15.0.6 deb 0 0 0 1 9 10
sqlite3 3.40.1 deb 1 2 3 0 3 9
nss 3.87.1 deb 1 0 3 0 4 8
avahi 0.8 deb 0 0 8 0 0 8
util-linux 2.38.1 deb 0 0 3 0 2 7
elf 0.188 deb 0 0 0 0 7 7
libssh2 1.10.0 deb 1 4 1 0 0 6
openldap 2.5.13 deb 0 1 0 0 5 6
chromium 151.0.7922.108 deb 0 5 0 0 0 5
-----------------------------------------------------------
UNIQUE CVEs 16 68 121 17 119 344
(+51 more packages, 102 findings)
C/H/M/L/N = critical/high/medium/low/negligible.
Counts are unique CVEs: binaries from one source package are
grouped (libcurl4 + libcurl3-gnutls + curl = curl), so a CVE
hitting three of them counts once, not three times.
devin 1 hours ago [-]
If the thing measuring whether there are CVEs is also the thing creating said CVEs, are we sure they are even CVEs? Deduped? Etc.
1 hours ago [-]
1 hours ago [-]
random3 23 minutes ago [-]
It’s like it’s made of CVEs. First 50-100 should be a good sign if it’s cleaner to start over.
evanjrowley 17 minutes ago [-]
Why is the Node ecosystem like this? Why do people continue to choose it for popular projects vs. anything else?
aliasxneo 51 minutes ago [-]
I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
nathancahill 48 minutes ago [-]
This is how Vanta et al. make millions.
iandanforth 1 hours ago [-]
I don't understand the 'custom patch' strategy over 'fix the app with a major version change' strategy.
KaiserPro 2 hours ago [-]
so s/bookworm/trixie/g didn't work then?
Yes, this is mostly a joke, I am able to understand the difference between base distros.
iririririr 13 minutes ago [-]
a spot on "joke". deb12 is gone for a month now.
Rendered at 16:40:26 GMT+0000 (Coordinated Universal Time) with Vercel.
Yes, this is mostly a joke, I am able to understand the difference between base distros.