homelab/stack
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

vuln: zotero — 3 CRITICAL, 14 HIGH #158

New Issue
Closed
opened 2026-03-24 03:27:58 +00:00 by gitea-actions · 1 comment
gitea-actionsbot commented 2026-03-24 03:27:58 +00:00
Copy Link

Image: local/zotero:build
Summary: 3 CRITICAL, 14 HIGH

CVE Severity Package Installed Fixed Title
CVE-2024-24790 CRITICAL stdlib v1.22.2 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for I...
CVE-2025-68121 CRITICAL stdlib v1.25.2 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: Unexpected session resumption in crypto/tls
CVE-2025-68121 CRITICAL stdlib v1.22.2 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: Unexpected session resumption in crypto/tls
CVE-2022-25235 HIGH firefox 144.0.2+build1-0ubuntu0.24.04.1~mt1 1:1snap1-0ubuntu1 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to a...
CVE-2022-25236 HIGH firefox 144.0.2+build1-0ubuntu0.24.04.1~mt1 1:1snap1-0ubuntu1 expat: Namespace-separator characters in "xmlns[:prefix]" at...
CVE-2024-24788 HIGH stdlib v1.22.2 1.22.3 golang: net: malformed DNS message can cause infinite loop
CVE-2024-34156 HIGH stdlib v1.22.2 1.22.7, 1.23.1 encoding/gob: golang: Calling Decoder.Decode on a message wh...
CVE-2025-47907 HIGH stdlib v1.22.2 1.23.12, 1.24.6 database/sql: Postgres Scan Race Condition
CVE-2025-58183 HIGH stdlib v1.22.2 1.24.8, 1.25.2 golang: archive/tar: Unbounded allocation when parsing GNU s...
CVE-2025-61726 HIGH stdlib v1.25.2 1.24.12, 1.25.6 golang: net/url: Memory exhaustion in query parameter parsin...
CVE-2025-61726 HIGH stdlib v1.22.2 1.24.12, 1.25.6 golang: net/url: Memory exhaustion in query parameter parsin...
CVE-2025-61728 HIGH stdlib v1.25.2 1.24.12, 1.25.6 golang: archive/zip: Excessive CPU consumption when building...
CVE-2025-61728 HIGH stdlib v1.22.2 1.24.12, 1.25.6 golang: archive/zip: Excessive CPU consumption when building...
CVE-2025-61729 HIGH stdlib v1.25.2 1.24.11, 1.25.5 crypto/x509: golang: Denial of Service due to excessive reso...
CVE-2025-61729 HIGH stdlib v1.22.2 1.24.11, 1.25.5 crypto/x509: golang: Denial of Service due to excessive reso...
CVE-2026-25679 HIGH stdlib v1.25.2 1.25.8, 1.26.1 net/url: Incorrect parsing of IPv6 host literals in net/url
CVE-2026-25679 HIGH stdlib v1.22.2 1.25.8, 1.26.1 net/url: Incorrect parsing of IPv6 host literals in net/url
**Image:** `local/zotero:build` **Summary:** 3 CRITICAL, 14 HIGH | CVE | Severity | Package | Installed | Fixed | Title | |-----|----------|---------|-----------|-------|-------| | CVE-2024-24790 | **CRITICAL** | stdlib | v1.22.2 | 1.21.11, 1.22.4 | golang: net/netip: Unexpected behavior from Is methods for I... | | CVE-2025-68121 | **CRITICAL** | stdlib | v1.25.2 | 1.24.13, 1.25.7, 1.26.0-rc.3 | crypto/tls: Unexpected session resumption in crypto/tls | | CVE-2025-68121 | **CRITICAL** | stdlib | v1.22.2 | 1.24.13, 1.25.7, 1.26.0-rc.3 | crypto/tls: Unexpected session resumption in crypto/tls | | CVE-2022-25235 | **HIGH** | firefox | 144.0.2+build1-0ubuntu0.24.04.1~mt1 | 1:1snap1-0ubuntu1 | expat: Malformed 2- and 3-byte UTF-8 sequences can lead to a... | | CVE-2022-25236 | **HIGH** | firefox | 144.0.2+build1-0ubuntu0.24.04.1~mt1 | 1:1snap1-0ubuntu1 | expat: Namespace-separator characters in "xmlns[:prefix]" at... | | CVE-2024-24788 | **HIGH** | stdlib | v1.22.2 | 1.22.3 | golang: net: malformed DNS message can cause infinite loop | | CVE-2024-34156 | **HIGH** | stdlib | v1.22.2 | 1.22.7, 1.23.1 | encoding/gob: golang: Calling Decoder.Decode on a message wh... | | CVE-2025-47907 | **HIGH** | stdlib | v1.22.2 | 1.23.12, 1.24.6 | database/sql: Postgres Scan Race Condition | | CVE-2025-58183 | **HIGH** | stdlib | v1.22.2 | 1.24.8, 1.25.2 | golang: archive/tar: Unbounded allocation when parsing GNU s... | | CVE-2025-61726 | **HIGH** | stdlib | v1.25.2 | 1.24.12, 1.25.6 | golang: net/url: Memory exhaustion in query parameter parsin... | | CVE-2025-61726 | **HIGH** | stdlib | v1.22.2 | 1.24.12, 1.25.6 | golang: net/url: Memory exhaustion in query parameter parsin... | | CVE-2025-61728 | **HIGH** | stdlib | v1.25.2 | 1.24.12, 1.25.6 | golang: archive/zip: Excessive CPU consumption when building... | | CVE-2025-61728 | **HIGH** | stdlib | v1.22.2 | 1.24.12, 1.25.6 | golang: archive/zip: Excessive CPU consumption when building... | | CVE-2025-61729 | **HIGH** | stdlib | v1.25.2 | 1.24.11, 1.25.5 | crypto/x509: golang: Denial of Service due to excessive reso... | | CVE-2025-61729 | **HIGH** | stdlib | v1.22.2 | 1.24.11, 1.25.5 | crypto/x509: golang: Denial of Service due to excessive reso... | | CVE-2026-25679 | **HIGH** | stdlib | v1.25.2 | 1.25.8, 1.26.1 | net/url: Incorrect parsing of IPv6 host literals in net/url | | CVE-2026-25679 | **HIGH** | stdlib | v1.22.2 | 1.25.8, 1.26.1 | net/url: Incorrect parsing of IPv6 host literals in net/url |
gitea-actionsbot added the quality label 2026-03-24 03:27:58 +00:00
kert commented 2026-03-24 20:44:03 +00:00
Owner
Copy Link

Resolved in 2054143.

What was done:

  1. Added dist-upgrade layer to infra/images/zotero.Dockerfile:

    • Separate early RUN with apt-get upgrade -y && apt-get dist-upgrade -y
    • Pulls all available security patches for OS-level packages
    • Runs before Zotero installation to minimize attack surface

  2. Documented the Go stdlib CVE situation in Dockerfile comments:

    • CVE-2024-24790 (net/netip) and CVE-2025-68121 (crypto/tls) are in static Go binaries from the base image (ghcr.io/selkies-project/nvidia-egl-desktop:latest)
    • These resolve when the upstream project rebuilds with a patched Go toolchain
    • Cannot be fixed by apt-get upgrade alone (static binaries)

  3. Existing mitigations verified:

    • harden.yml runs weekly with --no-cache — pulls fresh base image automatically
    • Trivy scanning active per stack.toml [images.zotero] — new vulns auto-reported
    • Python CVE patch (pillow>=12.1.1) already present
    • api.diag.vuln auto-files and auto-closes Gitea issues as vulns resolve

Note: Full resolution depends on upstream nvidia-egl-desktop rebuilding with Go >= 1.24.13 or 1.25.7. The :latest tag + weekly --no-cache rebuild ensures we track this automatically.

Resolved in 2054143. **What was done:** 1. **Added `dist-upgrade` layer** to `infra/images/zotero.Dockerfile`: - Separate early RUN with `apt-get upgrade -y && apt-get dist-upgrade -y` - Pulls all available security patches for OS-level packages - Runs before Zotero installation to minimize attack surface 2. **Documented the Go stdlib CVE situation** in Dockerfile comments: - CVE-2024-24790 (net/netip) and CVE-2025-68121 (crypto/tls) are in static Go binaries from the base image (`ghcr.io/selkies-project/nvidia-egl-desktop:latest`) - These resolve when the upstream project rebuilds with a patched Go toolchain - Cannot be fixed by `apt-get upgrade` alone (static binaries) 3. **Existing mitigations verified:** - `harden.yml` runs weekly with `--no-cache` — pulls fresh base image automatically - Trivy scanning active per `stack.toml [images.zotero]` — new vulns auto-reported - Python CVE patch (`pillow>=12.1.1`) already present - `api.diag.vuln` auto-files and auto-closes Gitea issues as vulns resolve **Note:** Full resolution depends on upstream `nvidia-egl-desktop` rebuilding with Go >= 1.24.13 or 1.25.7. The `:latest` tag + weekly `--no-cache` rebuild ensures we track this automatically.
kert closed this issue 2026-03-24 20:44:03 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
REST API (FastAPI)
 auth
Authentication and authorization
 bib
Bibliography, Zotero, citations
 ci
CI/CD pipelines and Woodpecker plugins
 cli
CLI commands and UX
 cloud
Cloud provider abstraction (AWS, GCP, Azure, self-hosted)
 config
Configuration and wiring
 data
Data loading, CCLF, BCDA, seeds
 databricks
Databricks jobs and deployment
 docs
Documentation and generated references
 image:api
image:docs
image:mc
image:notebooks
image:zotero
infra
lakehouse
Nessie, Polaris, Trino, Iceberg
 llm
llm module — local RAG over comments + Zotero corpus
 notebooks
marimo notebook errors (auto-filed by nb-watcher/nb-integration)
 packaging
Python packaging, optional deps, build system
 pfs
pipeline
Pipeline execution and validation
 pipeline:ci
pipeline:deploy
pipeline:harden
pipeline:infra-ci
pipeline:rebuild-all
pipeline:release
qpp
quality
Testing, coverage, error handling
 step:build
step:deploy
step:hadolint
step:lint
step:publish
step:scan
step:test
step:validate
styles
Charts, figures, visual theming
 tree
Project directory structure and file organization
No Label quality
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
kert renovate-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: homelab/stack#158
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?