René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CVE-2025-31115 \"xz: XZ has a heap-use-after-free bug in threaded .xz decoder\" in -alpine images","articleBody":"The -alpine images have [CVE-2025-31115](https://nvd.nist.gov/vuln/detail/CVE-2025-31115) \"xz: XZ has a heap-use-after-free bug in threaded .xz decoder\" reported against them.\n\nAlpine released xz-5.6.3-r1 that fixes this vulnerability.\n\n```\n$ docker run -it aquasec/trivy image python:3.13-alpine\n2025-04-08T17:42:50Z\tINFO\t[vulndb] Need to update DB\n2025-04-08T17:42:50Z\tINFO\t[vulndb] Downloading vulnerability DB...\n2025-04-08T17:42:50Z\tINFO\t[vulndb] Downloading artifact...\trepo=\"ghcr.io/aquasecurity/trivy-db:2\"\n62.04 MiB / 62.04 MiB [-----------------------------------------------------------] 100.00% 10.33 MiB p/s 6.2s\n2025-04-08T17:42:56Z\tINFO\t[vulndb] Artifact successfully downloaded\trepo=\"ghcr.io/aquasecurity/trivy-db:2\"\n2025-04-08T17:42:56Z\tINFO\t[vuln] Vulnerability scanning is enabled\n2025-04-08T17:42:56Z\tINFO\t[secret] Secret scanning is enabled\n2025-04-08T17:42:56Z\tINFO\t[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning\n2025-04-08T17:42:56Z\tINFO\t[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection\n2025-04-08T17:42:58Z\tINFO\t[python] License acquired from METADATA classifiers may be subject to additional terms\tname=\"pip\" version=\"24.3.1\"\n2025-04-08T17:42:58Z\tINFO\tDetected OS\tfamily=\"alpine\" version=\"3.21.3\"\n2025-04-08T17:42:58Z\tWARN\tThis OS version is not on the EOL list\tfamily=\"alpine\" version=\"3.21\"\n2025-04-08T17:42:58Z\tINFO\t[alpine] Detecting vulnerabilities...\tos_version=\"3.21\" repository=\"3.21\" pkg_num=28\n2025-04-08T17:42:58Z\tINFO\tNumber of language-specific files\tnum=1\n2025-04-08T17:42:58Z\tINFO\t[python-pkg] Detecting vulnerabilities...\n2025-04-08T17:42:58Z\tWARN\tUsing severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/v0.56/docs/scanner/vulnerability#severity-selection for details.\n\npython:3.13-alpine (alpine 3.21.3)\n\nTotal: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)\n\n┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │\n├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤\n│ xz-libs │ CVE-2025-31115 │ HIGH     │ fixed  │ 5.6.3-r0          │ 5.6.3-r1      │ xz: XZ has a heap-use-after-free bug in threaded .xz decoder │\n│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-31115                   │\n└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘\n```","author":{"url":"https://github.com/candrews","@type":"Person","name":"candrews"},"datePublished":"2025-04-08T17:45:05.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/1017/python/issues/1017"}