homelab/stack
1
0
Fork 0
Code Issues 247 Pull Requests 2 Actions Packages Projects 1 Releases Wiki Activity

vuln: zotero — 3 CRITICAL, 39 HIGH #115

New Issue
Closed
opened 2026-03-22 17:44:59 +00:00 by kert · 1 comment
kert commented 2026-03-22 17:44:59 +00:00
Owner
Copy Link

Image: gitea.homelab.fhirworx.io/homelab/zotero:sha-a9ca814b
Pipeline: #127
Summary: 3 CRITICAL, 39 HIGH

CVE Severity Package Installed Fixed Title
CVE-2024-24790 CRITICAL stdlib v1.22.2 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for I...
CVE-2025-68121 CRITICAL stdlib v1.25.2 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: Unexpected session resumption in crypto/tls
CVE-2025-68121 CRITICAL stdlib v1.22.2 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: Unexpected session resumption in crypto/tls
CVE-2022-25235 HIGH firefox 144.0.2+build1-0ubuntu0.24.04.1~mt1 1:1snap1-0ubuntu1 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to a...
CVE-2022-25236 HIGH firefox 144.0.2+build1-0ubuntu0.24.04.1~mt1 1:1snap1-0ubuntu1 expat: Namespace-separator characters in "xmlns[:prefix]" at...
CVE-2024-24788 HIGH stdlib v1.22.2 1.22.3 golang: net: malformed DNS message can cause infinite loop
CVE-2024-34156 HIGH stdlib v1.22.2 1.22.7, 1.23.1 encoding/gob: golang: Calling Decoder.Decode on a message wh...
CVE-2025-14174 HIGH gir1.2-javascriptcoregtk-4.1 2.48.7-0ubuntu0.24.04.2 2.50.4-0ubuntu0.24.04.1 Google Chrome: chromium: webkitgtk: Out of bounds memory acc...
CVE-2025-14174 HIGH gir1.2-webkit2-4.1 2.48.7-0ubuntu0.24.04.2 2.50.4-0ubuntu0.24.04.1 Google Chrome: chromium: webkitgtk: Out of bounds memory acc...
CVE-2025-14174 HIGH libjavascriptcoregtk-4.1-0 2.48.7-0ubuntu0.24.04.2 2.50.4-0ubuntu0.24.04.1 Google Chrome: chromium: webkitgtk: Out of bounds memory acc...
CVE-2025-14174 HIGH libwebkit2gtk-4.1-0 2.48.7-0ubuntu0.24.04.2 2.50.4-0ubuntu0.24.04.1 Google Chrome: chromium: webkitgtk: Out of bounds memory acc...
CVE-2025-37849 HIGH linux-libc-dev 6.8.0-87.88 6.8.0-100.100 kernel: KVM: arm64: Tear down vGIC on failed vCPU creation
CVE-2025-37899 HIGH linux-libc-dev 6.8.0-87.88 6.8.0-101.101 kernel: ksmbd: fix use-after-free in session logoff
CVE-2025-38561 HIGH linux-libc-dev 6.8.0-87.88 6.8.0-94.96 kernel: ksmbd: fix Preauh_HashValue race condition
CVE-2025-38666 HIGH linux-libc-dev 6.8.0-87.88 6.8.0-90.91 kernel: net: appletalk: Fix use-after-free in AARP proxy pro...
CVE-2025-39698 HIGH linux-libc-dev 6.8.0-87.88 6.8.0-94.96 kernel: io_uring/futex: ensure io_futex_wait() cleans up pro...
CVE-2025-43529 HIGH gir1.2-javascriptcoregtk-4.1 2.48.7-0ubuntu0.24.04.2 2.50.4-0ubuntu0.24.04.1 webkitgtk: webkitgtk: Use-after-free due to improper memory ...
CVE-2025-43529 HIGH gir1.2-webkit2-4.1 2.48.7-0ubuntu0.24.04.2 2.50.4-0ubuntu0.24.04.1 webkitgtk: webkitgtk: Use-after-free due to improper memory ...
CVE-2025-43529 HIGH libjavascriptcoregtk-4.1-0 2.48.7-0ubuntu0.24.04.2 2.50.4-0ubuntu0.24.04.1 webkitgtk: webkitgtk: Use-after-free due to improper memory ...
CVE-2025-43529 HIGH libwebkit2gtk-4.1-0 2.48.7-0ubuntu0.24.04.2 2.50.4-0ubuntu0.24.04.1 webkitgtk: webkitgtk: Use-after-free due to improper memory ...
CVE-2025-47907 HIGH stdlib v1.22.2 1.23.12, 1.24.6 database/sql: Postgres Scan Race Condition
CVE-2025-58183 HIGH stdlib v1.22.2 1.24.8, 1.25.2 golang: archive/tar: Unbounded allocation when parsing GNU s...
CVE-2025-61726 HIGH stdlib v1.25.2 1.24.12, 1.25.6 golang: net/url: Memory exhaustion in query parameter parsin...
CVE-2025-61726 HIGH stdlib v1.22.2 1.24.12, 1.25.6 golang: net/url: Memory exhaustion in query parameter parsin...
CVE-2025-61728 HIGH stdlib v1.25.2 1.24.12, 1.25.6 golang: archive/zip: Excessive CPU consumption when building...
CVE-2025-61728 HIGH stdlib v1.22.2 1.24.12, 1.25.6 golang: archive/zip: Excessive CPU consumption when building...
CVE-2025-61729 HIGH stdlib v1.25.2 1.24.11, 1.25.5 crypto/x509: golang: Denial of Service due to excessive reso...
CVE-2025-61729 HIGH stdlib v1.22.2 1.24.11, 1.25.5 crypto/x509: golang: Denial of Service due to excessive reso...
CVE-2025-68973 HIGH dirmngr 2.4.4-2ubuntu17.3 2.4.4-2ubuntu17.4 GnuPG: GnuPG: Information disclosure and potential arbitrary...
CVE-2025-68973 HIGH gnupg 2.4.4-2ubuntu17.3 2.4.4-2ubuntu17.4 GnuPG: GnuPG: Information disclosure and potential arbitrary...
CVE-2025-68973 HIGH gnupg-utils 2.4.4-2ubuntu17.3 2.4.4-2ubuntu17.4 GnuPG: GnuPG: Information disclosure and potential arbitrary...
CVE-2025-68973 HIGH gpg 2.4.4-2ubuntu17.3 2.4.4-2ubuntu17.4 GnuPG: GnuPG: Information disclosure and potential arbitrary...
CVE-2025-68973 HIGH gpg-agent 2.4.4-2ubuntu17.3 2.4.4-2ubuntu17.4 GnuPG: GnuPG: Information disclosure and potential arbitrary...
CVE-2025-68973 HIGH gpgconf 2.4.4-2ubuntu17.3 2.4.4-2ubuntu17.4 GnuPG: GnuPG: Information disclosure and potential arbitrary...
CVE-2025-68973 HIGH gpgsm 2.4.4-2ubuntu17.3 2.4.4-2ubuntu17.4 GnuPG: GnuPG: Information disclosure and potential arbitrary...
CVE-2025-68973 HIGH gpgv 2.4.4-2ubuntu17.3 2.4.4-2ubuntu17.4 GnuPG: GnuPG: Information disclosure and potential arbitrary...
CVE-2025-68973 HIGH keyboxd 2.4.4-2ubuntu17.3 2.4.4-2ubuntu17.4 GnuPG: GnuPG: Information disclosure and potential arbitrary...
CVE-2026-24061 HIGH inetutils-telnet 2:2.5-3ubuntu4 2:2.5-3ubuntu4.1 telnetd in GNU Inetutils through 2.7 allows remote authentic...
CVE-2026-24061 HIGH telnet 0.17+2.5-3ubuntu4 2:2.5-3ubuntu4.1 telnetd in GNU Inetutils through 2.7 allows remote authentic...
CVE-2026-25679 HIGH stdlib v1.25.2 1.25.8, 1.26.1 net/url: Incorrect parsing of IPv6 host literals in net/url
CVE-2026-25679 HIGH stdlib v1.22.2 1.25.8, 1.26.1 net/url: Incorrect parsing of IPv6 host literals in net/url
CVE-2026-25990 HIGH pillow 12.0.0 12.1.1 pillow: Pillow: Out-of-bounds Write via Specially Crafted PS...
**Image:** `gitea.homelab.fhirworx.io/homelab/zotero:sha-a9ca814b` **Pipeline:** #127 **Summary:** 3 CRITICAL, 39 HIGH | CVE | Severity | Package | Installed | Fixed | Title | |-----|----------|---------|-----------|-------|-------| | CVE-2024-24790 | **CRITICAL** | stdlib | v1.22.2 | 1.21.11, 1.22.4 | golang: net/netip: Unexpected behavior from Is methods for I... | | CVE-2025-68121 | **CRITICAL** | stdlib | v1.25.2 | 1.24.13, 1.25.7, 1.26.0-rc.3 | crypto/tls: Unexpected session resumption in crypto/tls | | CVE-2025-68121 | **CRITICAL** | stdlib | v1.22.2 | 1.24.13, 1.25.7, 1.26.0-rc.3 | crypto/tls: Unexpected session resumption in crypto/tls | | CVE-2022-25235 | **HIGH** | firefox | 144.0.2+build1-0ubuntu0.24.04.1~mt1 | 1:1snap1-0ubuntu1 | expat: Malformed 2- and 3-byte UTF-8 sequences can lead to a... | | CVE-2022-25236 | **HIGH** | firefox | 144.0.2+build1-0ubuntu0.24.04.1~mt1 | 1:1snap1-0ubuntu1 | expat: Namespace-separator characters in "xmlns[:prefix]" at... | | CVE-2024-24788 | **HIGH** | stdlib | v1.22.2 | 1.22.3 | golang: net: malformed DNS message can cause infinite loop | | CVE-2024-34156 | **HIGH** | stdlib | v1.22.2 | 1.22.7, 1.23.1 | encoding/gob: golang: Calling Decoder.Decode on a message wh... | | CVE-2025-14174 | **HIGH** | gir1.2-javascriptcoregtk-4.1 | 2.48.7-0ubuntu0.24.04.2 | 2.50.4-0ubuntu0.24.04.1 | Google Chrome: chromium: webkitgtk: Out of bounds memory acc... | | CVE-2025-14174 | **HIGH** | gir1.2-webkit2-4.1 | 2.48.7-0ubuntu0.24.04.2 | 2.50.4-0ubuntu0.24.04.1 | Google Chrome: chromium: webkitgtk: Out of bounds memory acc... | | CVE-2025-14174 | **HIGH** | libjavascriptcoregtk-4.1-0 | 2.48.7-0ubuntu0.24.04.2 | 2.50.4-0ubuntu0.24.04.1 | Google Chrome: chromium: webkitgtk: Out of bounds memory acc... | | CVE-2025-14174 | **HIGH** | libwebkit2gtk-4.1-0 | 2.48.7-0ubuntu0.24.04.2 | 2.50.4-0ubuntu0.24.04.1 | Google Chrome: chromium: webkitgtk: Out of bounds memory acc... | | CVE-2025-37849 | **HIGH** | linux-libc-dev | 6.8.0-87.88 | 6.8.0-100.100 | kernel: KVM: arm64: Tear down vGIC on failed vCPU creation | | CVE-2025-37899 | **HIGH** | linux-libc-dev | 6.8.0-87.88 | 6.8.0-101.101 | kernel: ksmbd: fix use-after-free in session logoff | | CVE-2025-38561 | **HIGH** | linux-libc-dev | 6.8.0-87.88 | 6.8.0-94.96 | kernel: ksmbd: fix Preauh_HashValue race condition | | CVE-2025-38666 | **HIGH** | linux-libc-dev | 6.8.0-87.88 | 6.8.0-90.91 | kernel: net: appletalk: Fix use-after-free in AARP proxy pro... | | CVE-2025-39698 | **HIGH** | linux-libc-dev | 6.8.0-87.88 | 6.8.0-94.96 | kernel: io_uring/futex: ensure io_futex_wait() cleans up pro... | | CVE-2025-43529 | **HIGH** | gir1.2-javascriptcoregtk-4.1 | 2.48.7-0ubuntu0.24.04.2 | 2.50.4-0ubuntu0.24.04.1 | webkitgtk: webkitgtk: Use-after-free due to improper memory ... | | CVE-2025-43529 | **HIGH** | gir1.2-webkit2-4.1 | 2.48.7-0ubuntu0.24.04.2 | 2.50.4-0ubuntu0.24.04.1 | webkitgtk: webkitgtk: Use-after-free due to improper memory ... | | CVE-2025-43529 | **HIGH** | libjavascriptcoregtk-4.1-0 | 2.48.7-0ubuntu0.24.04.2 | 2.50.4-0ubuntu0.24.04.1 | webkitgtk: webkitgtk: Use-after-free due to improper memory ... | | CVE-2025-43529 | **HIGH** | libwebkit2gtk-4.1-0 | 2.48.7-0ubuntu0.24.04.2 | 2.50.4-0ubuntu0.24.04.1 | webkitgtk: webkitgtk: Use-after-free due to improper memory ... | | CVE-2025-47907 | **HIGH** | stdlib | v1.22.2 | 1.23.12, 1.24.6 | database/sql: Postgres Scan Race Condition | | CVE-2025-58183 | **HIGH** | stdlib | v1.22.2 | 1.24.8, 1.25.2 | golang: archive/tar: Unbounded allocation when parsing GNU s... | | CVE-2025-61726 | **HIGH** | stdlib | v1.25.2 | 1.24.12, 1.25.6 | golang: net/url: Memory exhaustion in query parameter parsin... | | CVE-2025-61726 | **HIGH** | stdlib | v1.22.2 | 1.24.12, 1.25.6 | golang: net/url: Memory exhaustion in query parameter parsin... | | CVE-2025-61728 | **HIGH** | stdlib | v1.25.2 | 1.24.12, 1.25.6 | golang: archive/zip: Excessive CPU consumption when building... | | CVE-2025-61728 | **HIGH** | stdlib | v1.22.2 | 1.24.12, 1.25.6 | golang: archive/zip: Excessive CPU consumption when building... | | CVE-2025-61729 | **HIGH** | stdlib | v1.25.2 | 1.24.11, 1.25.5 | crypto/x509: golang: Denial of Service due to excessive reso... | | CVE-2025-61729 | **HIGH** | stdlib | v1.22.2 | 1.24.11, 1.25.5 | crypto/x509: golang: Denial of Service due to excessive reso... | | CVE-2025-68973 | **HIGH** | dirmngr | 2.4.4-2ubuntu17.3 | 2.4.4-2ubuntu17.4 | GnuPG: GnuPG: Information disclosure and potential arbitrary... | | CVE-2025-68973 | **HIGH** | gnupg | 2.4.4-2ubuntu17.3 | 2.4.4-2ubuntu17.4 | GnuPG: GnuPG: Information disclosure and potential arbitrary... | | CVE-2025-68973 | **HIGH** | gnupg-utils | 2.4.4-2ubuntu17.3 | 2.4.4-2ubuntu17.4 | GnuPG: GnuPG: Information disclosure and potential arbitrary... | | CVE-2025-68973 | **HIGH** | gpg | 2.4.4-2ubuntu17.3 | 2.4.4-2ubuntu17.4 | GnuPG: GnuPG: Information disclosure and potential arbitrary... | | CVE-2025-68973 | **HIGH** | gpg-agent | 2.4.4-2ubuntu17.3 | 2.4.4-2ubuntu17.4 | GnuPG: GnuPG: Information disclosure and potential arbitrary... | | CVE-2025-68973 | **HIGH** | gpgconf | 2.4.4-2ubuntu17.3 | 2.4.4-2ubuntu17.4 | GnuPG: GnuPG: Information disclosure and potential arbitrary... | | CVE-2025-68973 | **HIGH** | gpgsm | 2.4.4-2ubuntu17.3 | 2.4.4-2ubuntu17.4 | GnuPG: GnuPG: Information disclosure and potential arbitrary... | | CVE-2025-68973 | **HIGH** | gpgv | 2.4.4-2ubuntu17.3 | 2.4.4-2ubuntu17.4 | GnuPG: GnuPG: Information disclosure and potential arbitrary... | | CVE-2025-68973 | **HIGH** | keyboxd | 2.4.4-2ubuntu17.3 | 2.4.4-2ubuntu17.4 | GnuPG: GnuPG: Information disclosure and potential arbitrary... | | CVE-2026-24061 | **HIGH** | inetutils-telnet | 2:2.5-3ubuntu4 | 2:2.5-3ubuntu4.1 | telnetd in GNU Inetutils through 2.7 allows remote authentic... | | CVE-2026-24061 | **HIGH** | telnet | 0.17+2.5-3ubuntu4 | 2:2.5-3ubuntu4.1 | telnetd in GNU Inetutils through 2.7 allows remote authentic... | | CVE-2026-25679 | **HIGH** | stdlib | v1.25.2 | 1.25.8, 1.26.1 | net/url: Incorrect parsing of IPv6 host literals in net/url | | CVE-2026-25679 | **HIGH** | stdlib | v1.22.2 | 1.25.8, 1.26.1 | net/url: Incorrect parsing of IPv6 host literals in net/url | | CVE-2026-25990 | **HIGH** | pillow | 12.0.0 | 12.1.1 | pillow: Pillow: Out-of-bounds Write via Specially Crafted PS... |
kert added the quality label 2026-03-22 17:44:59 +00:00
kert closed this issue 2026-03-23 22:11:27 +00:00
kert commented 2026-03-23 22:14:20 +00:00
Author
Owner
Copy Link

Rebuild results (a10cab2):

Fixed 25 of 42 original vulns:

  • GnuPG (CVE-2025-68973): all 9 packages patched via apt-get upgrade
  • WebKit (CVE-2025-14174, CVE-2025-43529): all 8 packages patched
  • linux-libc-dev (5 CVEs): patched
  • telnet/inetutils (CVE-2026-24061): both packages patched
  • pillow (CVE-2026-25990): upgraded to >=12.1.1 in Dockerfile

Remaining 17 are upstream base image issues (selkies-project/nvidia-egl-desktop:latest):

  • Go stdlib v1.22.2 / v1.25.2 (15 vulns) — needs upstream Go update
  • Firefox deb (2 vulns) — fix requires snap package, not available in base image

These cannot be fixed from our Dockerfile. Leaving open until upstream updates.

**Rebuild results (a10cab2):** Fixed 25 of 42 original vulns: - GnuPG (CVE-2025-68973): all 9 packages patched via `apt-get upgrade` - WebKit (CVE-2025-14174, CVE-2025-43529): all 8 packages patched - linux-libc-dev (5 CVEs): patched - telnet/inetutils (CVE-2026-24061): both packages patched - pillow (CVE-2026-25990): upgraded to >=12.1.1 in Dockerfile **Remaining 17 are upstream base image issues** (`selkies-project/nvidia-egl-desktop:latest`): - Go stdlib v1.22.2 / v1.25.2 (15 vulns) — needs upstream Go update - Firefox deb (2 vulns) — fix requires snap package, not available in base image These cannot be fixed from our Dockerfile. Leaving open until upstream updates.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
REST API (FastAPI)
 auth
Authentication and authorization
 bib
Bibliography, Zotero, citations
 ci
CI/CD pipelines and Woodpecker plugins
 cli
CLI commands and UX
 cloud
Cloud provider abstraction (AWS, GCP, Azure, self-hosted)
 config
Configuration and wiring
 data
Data loading, CCLF, BCDA, seeds
 databricks
Databricks jobs and deployment
 docs
Documentation and generated references
 image:api
image:docs
image:mc
image:notebooks
image:zotero
infra
lakehouse
Nessie, Polaris, Trino, Iceberg
 llm
llm module — local RAG over comments + Zotero corpus
 notebooks
marimo notebook errors (auto-filed by nb-watcher/nb-integration)
 packaging
Python packaging, optional deps, build system
 pfs
pipeline
Pipeline execution and validation
 pipeline:ci
pipeline:deploy
pipeline:harden
pipeline:infra-ci
pipeline:rebuild-all
pipeline:release
qpp
quality
Testing, coverage, error handling
 step:build
step:deploy
step:hadolint
step:lint
step:publish
step:scan
step:test
step:validate
styles
Charts, figures, visual theming
 tree
Project directory structure and file organization
No Label quality
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
kert renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: homelab/stack#115
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?