Snyk test report

Scanned the following paths:

dhi.io/mariadb:10-debian/mariadb (deb)
dhi.io/mariadb:10-debian/tianon/gosu//usr/local/sbin/gosu (gomodules)

2 known vulnerabilities

5 vulnerable dependency paths

57 dependencies

Link Following

high severity

Exploit: Not Defined

Package Manager: debian:13
Vulnerable module: attr/libattr1
Introduced through: docker-image|dhi.io/mariadb@10-debian and attr/libattr1@1:2.5.2-3

Detailed paths

Introduced through: docker-image|dhi.io/mariadb@10-debian › attr/libattr1@1:2.5.2-3
Introduced through: docker-image|dhi.io/mariadb@10-debian › coreutils@9.7-3 › attr/libattr1@1:2.5.2-3

NVD Description

Note: Versions mentioned in the description apply only to the upstream attr package and not the attr package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Remediation

There is no fixed version for Debian:13 attr.

References

More about this vulnerability

Link Following

high severity

Exploit: Not Defined

Package Manager: debian:13
Vulnerable module: acl/libacl1
Introduced through: docker-image|dhi.io/mariadb@10-debian and acl/libacl1@2.3.2-2+b1

Detailed paths

Introduced through: docker-image|dhi.io/mariadb@10-debian › acl/libacl1@2.3.2-2+b1
Introduced through: docker-image|dhi.io/mariadb@10-debian › coreutils@9.7-3 › acl/libacl1@2.3.2-2+b1
Introduced through: docker-image|dhi.io/mariadb@10-debian › sed@4.9-2+deb13u1 › acl/libacl1@2.3.2-2+b1

NVD Description

Note: Versions mentioned in the description apply only to the upstream acl package and not the acl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Remediation

There is no fixed version for Debian:13 acl.

References

More about this vulnerability