chore(deps): update github actions

[renovate]

Motivation

Automated dependency update by Renovate bot.

Description

This PR contains the following updates:

Package	Type	Update	Change
aws-actions/configure-aws-credentials (changelog)	action	digest	cbe3b39 → e125382
taiki-e/install-action (changelog)	action	digest	e67fa11 → 3f74d7c

Testing

This is an automated dependency update. No functional changes are expected.

Impact

Additional Information

---

• If you want to rebase/retry this PR, check this box

This PR was generated automatically by Renovate.

[github-actions]

🔍 Vulnerabilities of dockerhubaneo/armonik_core_stream_test_client:0.41.1-renovategithubactions.1.sha.a60aba0c

📦 Image Reference dockerhubaneo/armonik_core_stream_test_client:0.41.1-renovategithubactions.1.sha.a60aba0c

digest	sha256:f1d2db4b46dbc197f8cdebe03a602a29a05588a3c702989222d9f521fb9e6306
vulnerabilities
platform	linux/amd64
size	365 MB
packages	913

libexpat1 2.6.1-2ubuntu0.4 (deb) pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.4?arch=amd64&distro=ubuntu-24.04&upstream=expat # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed CVSS Score 7.8 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H EPSS Score 0.107% EPSS Percentile 1st percentile Description libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412. Affected range >=0 Fixed version Not Fixed CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.460% EPSS Percentile 39th percentile Description In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. Affected range >=0 Fixed version Not Fixed CVSS Score 6.9 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L EPSS Score 0.140% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in getAttributeId. Affected range >=0 Fixed version Not Fixed CVSS Score 6.9 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L EPSS Score 0.140% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in addBinding. Affected range >=0 Fixed version Not Fixed CVSS Score 6.9 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L EPSS Score 0.140% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in storeAtts. Affected range >=0 Fixed version Not Fixed CVSS Score 6.9 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L EPSS Score 0.103% EPSS Percentile 1st percentile Description In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. Affected range >=0 Fixed version Not Fixed CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L EPSS Score 0.186% EPSS Percentile 8th percentile Description libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. Affected range >=0 Fixed version Not Fixed CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L EPSS Score 0.181% EPSS Percentile 8th percentile Description libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.171% EPSS Percentile 7th percentile Description libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.216% EPSS Percentile 12th percentile Description libexpat before 2.7.5 allows an infinite loop while parsing DTD content. Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.164% EPSS Percentile 6th percentile Description libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.203% EPSS Percentile 10th percentile Description In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. Affected range >=0 Fixed version Not Fixed EPSS Score 0.353% EPSS Percentile 29th percentile Description Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046. Affected range >=0 Fixed version Not Fixed EPSS Score 0.194% EPSS Percentile 9th percentile Description libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions. Affected range >=0 Fixed version Not Fixed EPSS Score 0.586% EPSS Percentile 46th percentile Description Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. Affected range >=0 Fixed version Not Fixed EPSS Score 0.139% EPSS Percentile 4th percentile Description xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. Affected range >=0 Fixed version Not Fixed EPSS Score 0.139% EPSS Percentile 4th percentile Description xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. Affected range >=0 Fixed version Not Fixed EPSS Score 0.134% EPSS Percentile 3rd percentile Description xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. Affected range >=0 Fixed version Not Fixed EPSS Score 0.140% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in copyString. Affected range >=0 Fixed version Not Fixed EPSS Score 0.139% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. Affected range >=0 Fixed version Not Fixed EPSS Score 0.139% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. Affected range >=0 Fixed version Not Fixed EPSS Score 0.182% EPSS Percentile 8th percentile Description libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). Affected range >=0 Fixed version Not Fixed EPSS Score 0.398% EPSS Percentile 33rd percentile Description libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. Affected range >=0 Fixed version Not Fixed EPSS Score 1.315% EPSS Percentile 69th percentile Description libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

libcurl4t64 8.5.0-2ubuntu10.13 (deb) pkg:deb/ubuntu/libcurl4t64@8.5.0-2ubuntu10.13?arch=amd64&distro=ubuntu-24.04&upstream=curl # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.540% EPSS Percentile 44th percentile Description When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk). Affected range >=0 Fixed version Not Fixed EPSS Score 0.566% EPSS Percentile 45th percentile Description When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected. Affected range >=0 Fixed version Not Fixed EPSS Score 1.162% EPSS Percentile 65th percentile Description A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection. Affected range >=0 Fixed version Not Fixed EPSS Score 0.897% EPSS Percentile 58th percentile Description A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process. Affected range >=0 Fixed version Not Fixed EPSS Score 0.644% EPSS Percentile 49th percentile Description A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

tar 1.35+dfsg-3ubuntu0.4 (deb) pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.141% EPSS Percentile 4th percentile Description A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction. Affected range >=0 Fixed version Not Fixed EPSS Score 0.080% EPSS Percentile 0th percentile Description A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

perl 5.38.2-3.2ubuntu0.4 (deb) pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.4?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.418% EPSS Percentile 35th percentile Description Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong. Affected range >=0 Fixed version Not Fixed EPSS Score 0.167% EPSS Percentile 6th percentile Description Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

git 1:2.43.0-1ubuntu7.3 (deb) pkg:deb/ubuntu/git@1%3A2.43.0-1ubuntu7.3?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H EPSS Score 0.513% EPSS Percentile 42nd percentile Description Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.

zlib1g 1:1.3.dfsg-3.1ubuntu2.2 (deb) pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=amd64&distro=ubuntu-24.04&upstream=zlib # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.442% EPSS Percentile 37th percentile Description zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

wget 1.21.4-1ubuntu4.5 (deb) pkg:deb/ubuntu/wget@1.21.4-1ubuntu4.5?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 1.104% EPSS Percentile 64th percentile Description GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

dpkg 1.22.6ubuntu6.6 (deb) pkg:deb/ubuntu/dpkg@1.22.6ubuntu6.6?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.418% EPSS Percentile 35th percentile Description It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

libc6 2.39-0ubuntu8.9 (deb) pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.150% EPSS Percentile 4th percentile Description Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.

libudev1 255.4-1ubuntu8.17 (deb) pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=amd64&distro=ubuntu-24.04&upstream=systemd # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed CVSS Score 3.3 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N EPSS Score 0.173% EPSS Percentile 7th percentile Description In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.

passwd 1:4.13+dfsg1-4ubuntu3.2 (deb) pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.423% EPSS Percentile 36th percentile Description shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

libicu74 74.2-1ubuntu3.1 (deb) pkg:deb/ubuntu/libicu74@74.2-1ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=icu # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.425% EPSS Percentile 36th percentile Description A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud