Skip to content

chore(master): release 2.8.18 #107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jun 17, 2025
Merged

chore(master): release 2.8.18 #107

merged 1 commit into from
Jun 17, 2025

Conversation

@lotyp
Copy link
Member

@lotyp lotyp commented Jun 17, 2025

🤖 I have created a release beep boop

2.8.18 (2025-06-17)

Dependencies

  • deps: update ansible/ansible-lint action to v25.6.0 (#106) (38d8642)

This PR was generated with Release Please. See documentation.

@lotyp lotyp enabled auto-merge June 17, 2025 19:27
@github-actions
Copy link

github-actions bot commented Jun 17, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:1fa50ec4a02aa201709c08f44db8d689efacfe3884e6297a62eeaf4b3328c6df
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
platformlinux/amd64
size106 MB
packages248
📦 Base Image php:42e8584bcaac5cccda08e770cb32513710f12eb6f8d76dd829150e72ac2bedf0
also known as
  • 8.1-fpm-alpine
  • 8.1-fpm-alpine3.21
  • 8.1.32-fpm-alpine
  • 8.1.32-fpm-alpine3.21
digestsha256:e726fe8db6397574e12eb4f7be34f508443217f6396d7573b60e0b84db78c64e
vulnerabilitiescritical: 0 high: 2 medium: 1 low: 1
critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score35.144%
EPSS Percentile97th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

high : CVE--2025--22869

Affected range<0.35.0
Fixed version0.35.0
EPSS Score0.058%
EPSS Percentile18th percentile
Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

@github-actions
Copy link

github-actions bot commented Jun 17, 2025 •
edited
Loading

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest
digestsha256:73a7fe8fe4fbfe4687aa443e9800299209d970c2e15b179ae7b719df28484029
vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
platformlinux/amd64
size107 MB
packages250
📦 Base Image php:8.2-fpm-alpine
also known as
  • 8.2-fpm-alpine3.22
  • 8.2.28-fpm-alpine
  • 8.2.28-fpm-alpine3.22
digestsha256:1a30bfabe4c99f09227f38c8821d19f6e16702a81ceda26c0d8c929086ed4fb7
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

pkg:golang/golang.org/x/crypto@0.17.0

critical 9.1: CVE--2024--45337 Improper Authorization

Affected range<0.31.0
Fixed version0.31.0
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score35.144%
EPSS Percentile97th percentile
Description

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

high : CVE--2025--22869

Affected range<0.35.0
Fixed version0.35.0
EPSS Score0.058%
EPSS Percentile18th percentile
Description

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

critical: 0 high: 1 medium: 0 low: 0 stdlib 1.24.3 (golang)

pkg:golang/stdlib@1.24.3

high : CVE--2025--22874

Affected range>=1.24.0-0
<1.24.4
Fixed version1.24.4
EPSS Score0.017%
EPSS Percentile2nd percentile
Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

@github-actions
Copy link

github-actions bot commented Jun 17, 2025 •
edited
Loading

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-fpm-alpine

Name8.1.32-fpm-alpine3.21
Digestsha256:e726fe8db6397574e12eb4f7be34f508443217f6396d7573b60e0b84db78c64e
Vulnerabilitiescritical: 0 high: 2 medium: 1 low: 1
Pushed3 months ago
Size32 MB
Packages53
Flavoralpine
OS3.21
Runtime8.1.32
The base image is also available under the supported tag(s): 8.1-fpm-alpine3.21, 8.1.32-fpm-alpine, 8.1.32-fpm-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
8.4-fpm-alpine3.21
Minor runtime version update
Also known as:
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 2
    • Image contains equal number of packages
    Image details:
    • Size: 36 MB
    • Flavor: alpine
    • OS: 3.21
    • Runtime: 8.4
    		 1 month ago



    8.3-fpm-alpine3.21
    Minor runtime version update
    Also known as:
    • 8.3.22-fpm-alpine3.21
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    • Image contains equal number of packages
    Image details:
    • Size: 33 MB
    • Flavor: alpine
    • OS: 3.21
    • Runtime: 8.3.22
    		 1 week ago



    8.2-fpm-alpine3.21
    Minor runtime version update
    Also known as:
    • 8.2.28-fpm-alpine3.21
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 32 MB
    • Flavor: alpine
    • OS: 3.21
    • Runtime: 8.2.28
    		 3 months ago



    8.1-fpm-alpine3.22
    Patch runtime version update
    Also known as:
    • 8.1.32-fpm-alpine3.22
    		 Benefits:
    • Patch runtime version update
    • Same OS detected
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    Image details:
    • Size: 32 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.1.32
    		 1 week ago



    8.3-fpm-alpine
    Minor runtime version update
    Also known as:
    • 8.3.22-fpm-alpine
    • 8.3.22-fpm-alpine3.22
    • 8.3-fpm-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    Image details:
    • Size: 33 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.3.22
    		 1 week ago



    8.2-fpm-alpine
    Minor runtime version update
    Also known as:
    • 8.2.28-fpm-alpine
    • 8.2.28-fpm-alpine3.22
    • 8.2-fpm-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    • 8.2-fpm-alpine was pulled 4.1K times last month
    Image details:
    • Size: 32 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.2.28
    		 1 week ago



    8.4.8-fpm-alpine3.21
    Image introduces no new vulnerability but removes 4
    Also known as:
    • 8-fpm-alpine3.21
    • fpm-alpine3.21
    		 Benefits:
    • Same OS detected
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    • Image contains equal number of packages
    Image details:
    • Size: 36 MB
    • Flavor: alpine
    • OS: 3.21
    		 1 week ago



    8.4-fpm-alpine
    Image introduces no new vulnerability but removes 4
    Also known as:
    • 8.4.8-fpm-alpine
    • 8.4.8-fpm-alpine3.22
    • 8.4-fpm-alpine3.22
    • 8-fpm-alpine
    • 8-fpm-alpine3.22
    • fpm-alpine
    • fpm-alpine3.22
    		 Benefits:
    • Same OS detected
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    Image details:
    • Size: 37 MB
    • Flavor: alpine
    • OS: 3.22
    		 1 week ago



    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8.2-fpm-alpine

    Name8.2.28-fpm-alpine3.22
    Digestsha256:1a30bfabe4c99f09227f38c8821d19f6e16702a81ceda26c0d8c929086ed4fb7
    Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    Pushed1 week ago
    Size32 MB
    Packages61
    Flavoralpine
    OS3.22
    Runtime8.2.28
    The base image is also available under the supported tag(s): 8.2-fpm-alpine3.22, 8.2.28-fpm-alpine, 8.2.28-fpm-alpine3.22

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    TagDetailsPushedVulnerabilities
    8.3-fpm-alpine
    Minor runtime version update
    Also known as:
    • 8.3.22-fpm-alpine
    • 8.3.22-fpm-alpine3.22
    • 8.3-fpm-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 33 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.3.22
    		 1 week ago



    8.4-fpm-alpine
    Image has same number of vulnerabilities
    Also known as:
    • 8.4.8-fpm-alpine
    • 8.4.8-fpm-alpine3.22
    • 8.4-fpm-alpine3.22
    • 8-fpm-alpine
    • 8-fpm-alpine3.22
    • fpm-alpine
    • fpm-alpine3.22
    		 Benefits:
    • Same OS detected
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 37 MB
    • Flavor: alpine
    • OS: 3.22
    		 1 week ago



    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:880e159a2ff2bec46336c92880f449394517fb0c73c847a55ca8677c3268b0d0
    vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
    platformlinux/amd64
    size131 MB
    packages284
    📦 Base Image php:8.2-alpine
    also known as
    • 8.2-alpine3.22
    • 8.2-cli-alpine
    • 8.2-cli-alpine3.22
    • 8.2.28-alpine
    • 8.2.28-alpine3.22
    • 8.2.28-cli-alpine
    • 8.2.28-cli-alpine3.22
    digestsha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
    vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    critical: 0 high: 1 medium: 0 low: 0 stdlib 1.24.3 (golang)

    pkg:golang/stdlib@1.24.3

    high : CVE--2025--22874

    Affected range>=1.24.0-0
    <1.24.4
    Fixed version1.24.4
    EPSS Score0.017%
    EPSS Percentile2nd percentile
    Description

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8.2-alpine

    Name8.2.28-alpine3.22
    Digestsha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
    Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    Pushed1 week ago
    Size36 MB
    Packages60
    Flavoralpine
    OS3.22
    Runtime8.2.28
    The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.28-alpine, 8.2.28-alpine3.22, 8.2.28-cli-alpine, 8.2.28-cli-alpine3.22

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    TagDetailsPushedVulnerabilities
    8.4-alpine
    Minor runtime version update
    Also known as:
    • 8.4.8-cli-alpine
    • 8.4.8-cli-alpine3.22
    • 8.4-cli-alpine
    • 8.4-cli-alpine3.22
    • 8-cli-alpine
    • 8-cli-alpine3.22
    • cli-alpine
    • cli-alpine3.22
    • alpine
    • alpine3.22
    • 8.4.8-alpine
    • 8.4.8-alpine3.22
    • 8.4-alpine3.22
    • 8-alpine
    • 8-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 42 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.4.8
    		 1 week ago



    8.3-alpine
    Minor runtime version update
    Also known as:
    • 8.3.22-cli-alpine
    • 8.3.22-cli-alpine3.22
    • 8.3-cli-alpine
    • 8.3-cli-alpine3.22
    • 8.3.22-alpine
    • 8.3.22-alpine3.22
    • 8.3-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 37 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.3.22
    		 1 week ago



    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:1995c5e198e0bb37ada1064dd86ebf38bad6f8c08b39cd145ebcf3eb2c2f0c19
    vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
    platformlinux/amd64
    size132 MB
    packages284
    📦 Base Image php:8.3-alpine
    also known as
    • 8.3-alpine3.22
    • 8.3-cli-alpine
    • 8.3-cli-alpine3.22
    • 8.3.22-alpine
    • 8.3.22-alpine3.22
    • 8.3.22-cli-alpine
    • 8.3.22-cli-alpine3.22
    digestsha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
    vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    critical: 0 high: 1 medium: 0 low: 0 stdlib 1.24.3 (golang)

    pkg:golang/stdlib@1.24.3

    high : CVE--2025--22874

    Affected range>=1.24.0-0
    <1.24.4
    Fixed version1.24.4
    EPSS Score0.017%
    EPSS Percentile2nd percentile
    Description

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:554da93f5598e02e096365812b14b32c909331011dda60ce5daa259bbefa82eb
    vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
    platformlinux/amd64
    size113 MB
    packages249
    📦 Base Image php:8.3-alpine
    also known as
    • 8.3-alpine3.22
    • 8.3-cli-alpine
    • 8.3-cli-alpine3.22
    • 8.3.22-alpine
    • 8.3.22-alpine3.22
    • 8.3.22-cli-alpine
    • 8.3.22-cli-alpine3.22
    digestsha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
    vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    critical: 0 high: 1 medium: 0 low: 0 stdlib 1.24.3 (golang)

    pkg:golang/stdlib@1.24.3

    high : CVE--2025--22874

    Affected range>=1.24.0-0
    <1.24.4
    Fixed version1.24.4
    EPSS Score0.017%
    EPSS Percentile2nd percentile
    Description

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:b72a0f29704b30d687e6ccff725fe57a0c48b5da8cbc8b67dc81622c070a4a80
    vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
    platformlinux/amd64
    size129 MB
    packages265
    📦 Base Image php:53a4f6c5bdf2c0213cb7293bc9da263feaa0ea41955f71bc1de2465f801efff9
    also known as
    • 8.1-alpine
    • 8.1-alpine3.21
    • 8.1-cli-alpine
    • 8.1-cli-alpine3.21
    • 8.1.32-alpine
    • 8.1.32-alpine3.21
    • 8.1.32-cli-alpine
    • 8.1.32-cli-alpine3.21
    digestsha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
    vulnerabilitiescritical: 0 high: 2 medium: 1 low: 1
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    critical: 0 high: 1 medium: 0 low: 0 setuptools 70.3.0 (pypi)

    pkg:pypi/setuptools@70.3.0

    high 7.7: CVE--2025--47273 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    Affected range<78.1.1
    Fixed version78.1.1
    CVSS Score7.7
    CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
    EPSS Score0.104%
    EPSS Percentile29th percentile
    Description

    Summary

    A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1

    Details

        def _download_url(self, url, tmpdir):
        # Determine download filename
        #
        name, _fragment = egg_info_for_url(url)
        if name:
            while '..' in name:
                name = name.replace('..', '.').replace('\\', '_')
        else:
            name = "__downloaded__"  # default if URL has no path contents

        if name.endswith('.[egg.zip](http://egg.zip/)'):
            name = name[:-4]  # strip the extra .zip before download

 -->       filename = os.path.join(tmpdir, name)

    Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88

    os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter.
    name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.

    Risk Assessment

    As easy_install and package_index are deprecated, the exploitation surface is reduced.
    However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.

    Impact

    An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

    References

    https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
    pypa/setuptools#4946

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8.3-alpine

    Name8.3.22-alpine3.22
    Digestsha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
    Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    Pushed1 week ago
    Size37 MB
    Packages60
    Flavoralpine
    OS3.22
    Runtime8.3.22
    The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.22-alpine, 8.3.22-alpine3.22, 8.3.22-cli-alpine, 8.3.22-cli-alpine3.22

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    TagDetailsPushedVulnerabilities
    8.4-alpine
    Minor runtime version update
    Also known as:
    • 8.4.8-cli-alpine
    • 8.4.8-cli-alpine3.22
    • 8.4-cli-alpine
    • 8.4-cli-alpine3.22
    • 8-cli-alpine
    • 8-cli-alpine3.22
    • cli-alpine
    • cli-alpine3.22
    • alpine
    • alpine3.22
    • 8.4.8-alpine
    • 8.4.8-alpine3.22
    • 8.4-alpine3.22
    • 8-alpine
    • 8-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 42 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.4.8
    		 1 week ago



    1 similar comment
    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8.3-alpine

    Name8.3.22-alpine3.22
    Digestsha256:2891010783a71c4e3fe6af0dbf08e5d7e3eabe1055c69d6006d9bb0363ab7961
    Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    Pushed1 week ago
    Size37 MB
    Packages60
    Flavoralpine
    OS3.22
    Runtime8.3.22
    The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.22-alpine, 8.3.22-alpine3.22, 8.3.22-cli-alpine, 8.3.22-cli-alpine3.22

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    TagDetailsPushedVulnerabilities
    8.4-alpine
    Minor runtime version update
    Also known as:
    • 8.4.8-cli-alpine
    • 8.4.8-cli-alpine3.22
    • 8.4-cli-alpine
    • 8.4-cli-alpine3.22
    • 8-cli-alpine
    • 8-cli-alpine3.22
    • cli-alpine
    • cli-alpine3.22
    • alpine
    • alpine3.22
    • 8.4.8-alpine
    • 8.4.8-alpine3.22
    • 8.4-alpine3.22
    • 8-alpine
    • 8-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 42 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.4.8
    		 1 week ago



    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8.1-alpine

    Name8.1.32-alpine3.21
    Digestsha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
    Vulnerabilitiescritical: 0 high: 2 medium: 1 low: 1
    Pushed3 months ago
    Size36 MB
    Packages52
    Flavoralpine
    OS3.21
    Runtime8.1.32
    The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.32-alpine, 8.1.32-alpine3.21, 8.1.32-cli-alpine, 8.1.32-cli-alpine3.21

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    TagDetailsPushedVulnerabilities
    8.4-alpine3.21
    Minor runtime version update
    Also known as:
    • 8.4.8-cli-alpine3.21
    • 8-cli-alpine3.21
    • cli-alpine3.21
    • alpine3.21
    • 8-alpine3.21
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    • Image contains equal number of packages
    Image details:
    • Size: 42 MB
    • Flavor: alpine
    • OS: 3.21
    • Runtime: 8.4
    		 1 week ago



    8.3-alpine3.21
    Minor runtime version update
    Also known as:
    • 8.3.22-cli-alpine3.21
    • 8.3-cli-alpine3.21
    • 8.3.22-alpine3.21
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    • Image contains equal number of packages
    Image details:
    • Size: 37 MB
    • Flavor: alpine
    • OS: 3.21
    • Runtime: 8.3.22
    		 1 week ago



    8.2-alpine3.21
    Minor runtime version update
    Also known as:
    • 8.2.28-cli-alpine3.21
    • 8.2-cli-alpine3.21
    • 8.2.28-alpine3.21
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 36 MB
    • Flavor: alpine
    • OS: 3.21
    • Runtime: 8.2.28
    		 3 months ago



    8.1-alpine3.22
    Patch runtime version update
    Also known as:
    • 8.1.32-cli-alpine3.22
    • 8.1-cli-alpine3.22
    • 8.1.32-alpine3.22
    		 Benefits:
    • Patch runtime version update
    • Same OS detected
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    Image details:
    • Size: 36 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.1.32
    		 1 week ago



    8.4-alpine
    Minor runtime version update
    Also known as:
    • 8.4.8-cli-alpine
    • 8.4.8-cli-alpine3.22
    • 8.4-cli-alpine
    • 8.4-cli-alpine3.22
    • 8-cli-alpine
    • 8-cli-alpine3.22
    • cli-alpine
    • cli-alpine3.22
    • alpine
    • alpine3.22
    • 8.4.8-alpine
    • 8.4.8-alpine3.22
    • 8.4-alpine3.22
    • 8-alpine
    • 8-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    Image details:
    • Size: 42 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.4.8
    		 1 week ago



    8.3-alpine
    Minor runtime version update
    Also known as:
    • 8.3.22-cli-alpine
    • 8.3.22-cli-alpine3.22
    • 8.3-cli-alpine
    • 8.3-cli-alpine3.22
    • 8.3.22-alpine
    • 8.3.22-alpine3.22
    • 8.3-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    Image details:
    • Size: 37 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.3.22
    		 1 week ago



    8.2-alpine
    Minor runtime version update
    Also known as:
    • 8.2.28-cli-alpine
    • 8.2.28-cli-alpine3.22
    • 8.2-cli-alpine
    • 8.2-cli-alpine3.22
    • 8.2.28-alpine
    • 8.2.28-alpine3.22
    • 8.2-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    • 8.2-alpine was pulled 1.8K times last month
    Image details:
    • Size: 36 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.2.28
    		 1 week ago



    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:3f0a895c5ae3f534ad361a0f13020f16b4dc24ddd1568de6e75cba30c0ac8863
    vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
    platformlinux/amd64
    size112 MB
    packages250
    📦 Base Image php:8-fpm-alpine
    also known as
    • 8-fpm-alpine3.22
    • 8.4-fpm-alpine
    • 8.4-fpm-alpine3.22
    • 8.4.8-fpm-alpine
    • 8.4.8-fpm-alpine3.22
    • fpm-alpine
    • fpm-alpine3.22
    digestsha256:bc12bbfaf3d00edcc78c086423804b91071d64ee3c34511f0d8f5cea778f7daf
    vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    critical: 0 high: 1 medium: 0 low: 0 stdlib 1.24.3 (golang)

    pkg:golang/stdlib@1.24.3

    high : CVE--2025--22874

    Affected range>=1.24.0-0
    <1.24.4
    Fixed version1.24.4
    EPSS Score0.017%
    EPSS Percentile2nd percentile
    Description

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:ee92ea2235007f9e1b57d2b7b57d7e4a46961f813138158b42684b861c6c4214
    vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
    platformlinux/amd64
    size111 MB
    packages247
    📦 Base Image php:53a4f6c5bdf2c0213cb7293bc9da263feaa0ea41955f71bc1de2465f801efff9
    also known as
    • 8.1-alpine
    • 8.1-alpine3.21
    • 8.1-cli-alpine
    • 8.1-cli-alpine3.21
    • 8.1.32-alpine
    • 8.1.32-alpine3.21
    • 8.1.32-cli-alpine
    • 8.1.32-cli-alpine3.21
    digestsha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
    vulnerabilitiescritical: 0 high: 2 medium: 1 low: 1
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8-fpm-alpine

    Namefpm-alpine3.22
    Digestsha256:bc12bbfaf3d00edcc78c086423804b91071d64ee3c34511f0d8f5cea778f7daf
    Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    Pushed1 week ago
    Size37 MB
    Packages61
    Flavoralpine
    OS3.22
    The base image is also available under the supported tag(s): 8-fpm-alpine3.22, 8.4-fpm-alpine, 8.4-fpm-alpine3.22, 8.4.8-fpm-alpine, 8.4.8-fpm-alpine3.22, fpm-alpine, fpm-alpine3.22

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    TagDetailsPushedVulnerabilities
    8.3-fpm-alpine
    Minor runtime version update
    Also known as:
    • 8.3.22-fpm-alpine
    • 8.3.22-fpm-alpine3.22
    • 8.3-fpm-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image is smaller by 3.3 MB
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 33 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.3.22
    		 1 week ago



    8.2-fpm-alpine
    Minor runtime version update
    Also known as:
    • 8.2.28-fpm-alpine
    • 8.2.28-fpm-alpine3.22
    • 8.2-fpm-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image is smaller by 4.0 MB
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    • 8.2-fpm-alpine was pulled 4.1K times last month
    Image details:
    • Size: 32 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.2.28
    		 1 week ago



    8.1-fpm-alpine3.22
    Minor runtime version update
    Also known as:
    • 8.1.32-fpm-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image is smaller by 4.5 MB
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 32 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.1.32
    		 1 week ago



    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:9af7b45cf707c9c5e047fb8df4b702ba24ece581e5cb5b0ebebe405eabdab01f
    vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
    platformlinux/amd64
    size118 MB
    packages249
    📦 Base Image php:8-alpine
    also known as
    • 8-alpine3.22
    • 8-cli-alpine
    • 8-cli-alpine3.22
    • 8.4-alpine
    • 8.4-alpine3.22
    • 8.4-cli-alpine
    • 8.4-cli-alpine3.22
    • 8.4.8-alpine
    • 8.4.8-alpine3.22
    • 8.4.8-cli-alpine
    • 8.4.8-cli-alpine3.22
    • alpine
    • alpine3.22
    • cli-alpine
    • cli-alpine3.22
    digestsha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
    vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    critical: 0 high: 1 medium: 0 low: 0 stdlib 1.24.3 (golang)

    pkg:golang/stdlib@1.24.3

    high : CVE--2025--22874

    Affected range>=1.24.0-0
    <1.24.4
    Fixed version1.24.4
    EPSS Score0.017%
    EPSS Percentile2nd percentile
    Description

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8.1-alpine

    Name8.1.32-alpine3.21
    Digestsha256:05dee9cd87b825cb096751fef4d1d017e3a1eb069af80cf63ea97c0923ecab4b
    Vulnerabilitiescritical: 0 high: 2 medium: 1 low: 1
    Pushed3 months ago
    Size36 MB
    Packages52
    Flavoralpine
    OS3.21
    Runtime8.1.32
    The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.32-alpine, 8.1.32-alpine3.21, 8.1.32-cli-alpine, 8.1.32-cli-alpine3.21

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    TagDetailsPushedVulnerabilities
    8.4-alpine3.21
    Minor runtime version update
    Also known as:
    • 8.4.8-cli-alpine3.21
    • 8-cli-alpine3.21
    • cli-alpine3.21
    • alpine3.21
    • 8-alpine3.21
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    • Image contains equal number of packages
    Image details:
    • Size: 42 MB
    • Flavor: alpine
    • OS: 3.21
    • Runtime: 8.4
    		 1 week ago



    8.3-alpine3.21
    Minor runtime version update
    Also known as:
    • 8.3.22-cli-alpine3.21
    • 8.3-cli-alpine3.21
    • 8.3.22-alpine3.21
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    • Image contains equal number of packages
    Image details:
    • Size: 37 MB
    • Flavor: alpine
    • OS: 3.21
    • Runtime: 8.3.22
    		 1 week ago



    8.2-alpine3.21
    Minor runtime version update
    Also known as:
    • 8.2.28-cli-alpine3.21
    • 8.2-cli-alpine3.21
    • 8.2.28-alpine3.21
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 36 MB
    • Flavor: alpine
    • OS: 3.21
    • Runtime: 8.2.28
    		 3 months ago



    8.1-alpine3.22
    Patch runtime version update
    Also known as:
    • 8.1.32-cli-alpine3.22
    • 8.1-cli-alpine3.22
    • 8.1.32-alpine3.22
    		 Benefits:
    • Patch runtime version update
    • Same OS detected
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    Image details:
    • Size: 36 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.1.32
    		 1 week ago



    8.4-alpine
    Minor runtime version update
    Also known as:
    • 8.4.8-cli-alpine
    • 8.4.8-cli-alpine3.22
    • 8.4-cli-alpine
    • 8.4-cli-alpine3.22
    • 8-cli-alpine
    • 8-cli-alpine3.22
    • cli-alpine
    • cli-alpine3.22
    • alpine
    • alpine3.22
    • 8.4.8-alpine
    • 8.4.8-alpine3.22
    • 8.4-alpine3.22
    • 8-alpine
    • 8-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    Image details:
    • Size: 42 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.4.8
    		 1 week ago



    8.3-alpine
    Minor runtime version update
    Also known as:
    • 8.3.22-cli-alpine
    • 8.3.22-cli-alpine3.22
    • 8.3-cli-alpine
    • 8.3-cli-alpine3.22
    • 8.3.22-alpine
    • 8.3.22-alpine3.22
    • 8.3-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    Image details:
    • Size: 37 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.3.22
    		 1 week ago



    8.2-alpine
    Minor runtime version update
    Also known as:
    • 8.2.28-cli-alpine
    • 8.2.28-cli-alpine3.22
    • 8.2-cli-alpine
    • 8.2-cli-alpine3.22
    • 8.2.28-alpine
    • 8.2.28-alpine3.22
    • 8.2-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Tag was pushed more recently
    • Image has similar size
    • Image introduces no new vulnerability but removes 4
    • 8.2-alpine was pulled 1.8K times last month
    Image details:
    • Size: 36 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.2.28
    		 1 week ago



    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:4ac2c65ecb9a957d404109af4749529e75d84de1d0a29eb420cb5b36b704358c
    vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
    platformlinux/amd64
    size108 MB
    packages250
    📦 Base Image php:8.3-fpm-alpine
    also known as
    • 8.3-fpm-alpine3.22
    • 8.3.22-fpm-alpine
    • 8.3.22-fpm-alpine3.22
    digestsha256:2895cabe974eb03fbdb77aa019d52a5b6b18f745ac2837dea33603e8a2c10d88
    vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    critical: 0 high: 1 medium: 0 low: 0 stdlib 1.24.3 (golang)

    pkg:golang/stdlib@1.24.3

    high : CVE--2025--22874

    Affected range>=1.24.0-0
    <1.24.4
    Fixed version1.24.4
    EPSS Score0.017%
    EPSS Percentile2nd percentile
    Description

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8-alpine

    Name8.4.8-alpine3.22
    Digestsha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
    Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    Pushed1 week ago
    Size42 MB
    Packages60
    Flavoralpine
    OS3.22
    Runtime8.4.8
    The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.8-alpine, 8.4.8-alpine3.22, 8.4.8-cli-alpine, 8.4.8-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    ✅ There are no tag recommendations at this time.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:1f210c2e4d70d9e694530e47a4a2ead33a5286fab93a93ebbf6a3746aeb004d4
    vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
    platformlinux/amd64
    size112 MB
    packages249
    📦 Base Image php:8.2-alpine
    also known as
    • 8.2-alpine3.22
    • 8.2-cli-alpine
    • 8.2-cli-alpine3.22
    • 8.2.28-alpine
    • 8.2.28-alpine3.22
    • 8.2.28-cli-alpine
    • 8.2.28-cli-alpine3.22
    digestsha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
    vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    critical: 0 high: 1 medium: 0 low: 0 stdlib 1.24.3 (golang)

    pkg:golang/stdlib@1.24.3

    high : CVE--2025--22874

    Affected range>=1.24.0-0
    <1.24.4
    Fixed version1.24.4
    EPSS Score0.017%
    EPSS Percentile2nd percentile
    Description

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8.3-fpm-alpine

    Name8.3.22-fpm-alpine3.22
    Digestsha256:2895cabe974eb03fbdb77aa019d52a5b6b18f745ac2837dea33603e8a2c10d88
    Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    Pushed1 week ago
    Size33 MB
    Packages61
    Flavoralpine
    OS3.22
    Runtime8.3.22
    The base image is also available under the supported tag(s): 8.3-fpm-alpine3.22, 8.3.22-fpm-alpine, 8.3.22-fpm-alpine3.22

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    TagDetailsPushedVulnerabilities
    8.4-fpm-alpine
    Image has same number of vulnerabilities
    Also known as:
    • 8.4.8-fpm-alpine
    • 8.4.8-fpm-alpine3.22
    • 8.4-fpm-alpine3.22
    • 8-fpm-alpine
    • 8-fpm-alpine3.22
    • fpm-alpine
    • fpm-alpine3.22
    		 Benefits:
    • Same OS detected
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 37 MB
    • Flavor: alpine
    • OS: 3.22
    		 1 week ago



    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025 •
    edited
    Loading

    Outdated

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8.2-alpine

    Name8.2.28-alpine3.22
    Digestsha256:2d7ae327714a2b6ff4041298d473a32b9bcce675db28030df735818ed68b1be7
    Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    Pushed1 week ago
    Size36 MB
    Packages60
    Flavoralpine
    OS3.22
    Runtime8.2.28
    The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.28-alpine, 8.2.28-alpine3.22, 8.2.28-cli-alpine, 8.2.28-cli-alpine3.22

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    TagDetailsPushedVulnerabilities
    8.4-alpine
    Minor runtime version update
    Also known as:
    • 8.4.8-cli-alpine
    • 8.4.8-cli-alpine3.22
    • 8.4-cli-alpine
    • 8.4-cli-alpine3.22
    • 8-cli-alpine
    • 8-cli-alpine3.22
    • cli-alpine
    • cli-alpine3.22
    • alpine
    • alpine3.22
    • 8.4.8-alpine
    • 8.4.8-alpine3.22
    • 8.4-alpine3.22
    • 8-alpine
    • 8-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 42 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.4.8
    		 1 week ago



    8.3-alpine
    Minor runtime version update
    Also known as:
    • 8.3.22-cli-alpine
    • 8.3.22-cli-alpine3.22
    • 8.3-cli-alpine
    • 8.3-cli-alpine3.22
    • 8.3.22-alpine
    • 8.3.22-alpine3.22
    • 8.3-alpine3.22
    		 Benefits:
    • Same OS detected
    • Minor runtime version update
    • Image has similar size
    • Image has same number of vulnerabilities
    • Image contains equal number of packages
    Image details:
    • Size: 37 MB
    • Flavor: alpine
    • OS: 3.22
    • Runtime: 8.3.22
    		 1 week ago



    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025

    🔍 Vulnerabilities of wayofdev/php-dev:latest

    📦 Image Reference wayofdev/php-dev:latest
    digestsha256:13b71d37a50ab779418420b56a23de0607b08e47263d79412482b9b34d30e294
    vulnerabilitiescritical: 1 high: 2 medium: 0 low: 0
    platformlinux/amd64
    size137 MB
    packages284
    📦 Base Image php:8-alpine
    also known as
    • 8-alpine3.22
    • 8-cli-alpine
    • 8-cli-alpine3.22
    • 8.4-alpine
    • 8.4-alpine3.22
    • 8.4-cli-alpine
    • 8.4-cli-alpine3.22
    • 8.4.8-alpine
    • 8.4.8-alpine3.22
    • 8.4.8-cli-alpine
    • 8.4.8-cli-alpine3.22
    • alpine
    • alpine3.22
    • cli-alpine
    • cli-alpine3.22
    digestsha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
    vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    critical: 1 high: 1 medium: 0 low: 0 golang.org/x/crypto 0.17.0 (golang)

    pkg:golang/golang.org/x/crypto@0.17.0

    critical 9.1: CVE--2024--45337 Improper Authorization

    Affected range<0.31.0
    Fixed version0.31.0
    CVSS Score9.1
    CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    EPSS Score35.144%
    EPSS Percentile97th percentile
    Description

    Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

    The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

    For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

    Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

    Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

    high : CVE--2025--22869

    Affected range<0.35.0
    Fixed version0.35.0
    EPSS Score0.058%
    EPSS Percentile18th percentile
    Description

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

    critical: 0 high: 1 medium: 0 low: 0 stdlib 1.24.3 (golang)

    pkg:golang/stdlib@1.24.3

    high : CVE--2025--22874

    Affected range>=1.24.0-0
    <1.24.4
    Fixed version1.24.4
    EPSS Score0.017%
    EPSS Percentile2nd percentile
    Description

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

    @github-actions
    Copy link

    github-actions bot commented Jun 17, 2025

    Recommended fixes for image wayofdev/php-dev:latest

    Base image is php:8-alpine

    Name8.4.8-alpine3.22
    Digestsha256:8ae901385b46443dc59b7dea20c700dbc68e8d1e42d025c335029b09c35c33c2
    Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
    Pushed1 week ago
    Size42 MB
    Packages60
    Flavoralpine
    OS3.22
    Runtime8.4.8
    The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.8-alpine, 8.4.8-alpine3.22, 8.4.8-cli-alpine, 8.4.8-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

    Refresh base image

    Rebuild the image using a newer base image version. Updating this may result in breaking changes.

    ✅ This image version is up to date.

    Change base image

    ✅ There are no tag recommendations at this time.

    @way-finder-bot way-finder-bot self-requested a review June 17, 2025 19:29
    @way-finder-bot way-finder-bot self-assigned this Jun 17, 2025
    @lotyp lotyp merged commit be21328 into master Jun 17, 2025
    19 of 20 checks passed
    @lotyp lotyp deleted the release-please--branches--master--components--docker-php-dev branch June 17, 2025 19:29
    @lotyp
    Copy link
    Member Author

    lotyp commented Jun 17, 2025

    🤖 Created releases:

    🌻

    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    @way-finder-bot way-finder-bot way-finder-bot approved these changes

    Assignees

    @way-finder-bot way-finder-bot

    Labels

    autorelease: tagged

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    3 participants

    @lotyp @way-finder-bot