Skip to content

GHSA-3p8m-j85q-pgmj cve fixes for akhq, celeborn and kserve#65719

Merged
dnegreira merged 3 commits into
wolfi-dev:mainfrom
jamie-albert:kserve-celeborna-akhq
Sep 10, 2025
Merged

GHSA-3p8m-j85q-pgmj cve fixes for akhq, celeborn and kserve#65719
dnegreira merged 3 commits into
wolfi-dev:mainfrom
jamie-albert:kserve-celeborna-akhq

Update cves-20250714.patch with missing netty bump

878326f
Select commit
Loading
Failed to load commit list.
Octo STS / ci-cve-scan completed Sep 10, 2025 in 53s

CVE scan report (mode: observe-and-report)

CVE scan report (mode: observe-and-report)

Details

CVE Scan Results (mode: observe-and-report)

aarch64/akhq-0.26.0-r2.apk

└── 📄 /usr/share/java/akhq/akhq.jar
        📦 netty-codec-compression 4.2.4.Final (java-archive)
            Medium CVE-2025-58057 GHSA-3p8m-j85q-pgmj fixed in 4.2.5.Final

aarch64/celeborn-0.5-0.5.4-r7.apk

└── 📄 /usr/share/java/celeborn/jars/ratis-thirdparty-misc-1.0.8.jar
        📦 netty-codec 4.1.115.Final (java-archive)
            Medium CVE-2025-58057 GHSA-3p8m-j85q-pgmj fixed in 4.1.125.Final
        📦 netty-codec-http 4.1.115.Final (java-archive)
            Low CVE-2025-58056 GHSA-fghv-69vj-qj49 fixed in 4.1.125.Final

aarch64/celeborn-0.5-compat-0.5.4-r7.apk

✅ No vulnerabilities found

aarch64/kserve-modelmesh-0.12.0-r16.apk

✅ No vulnerabilities found

aarch64/kserve-modelmesh-compat-0.12.0-r16.apk

✅ No vulnerabilities found

x86_64/akhq-0.26.0-r2.apk

└── 📄 /usr/share/java/akhq/akhq.jar
        📦 netty-codec-compression 4.2.4.Final (java-archive)
            Medium CVE-2025-58057 GHSA-3p8m-j85q-pgmj fixed in 4.2.5.Final

x86_64/celeborn-0.5-0.5.4-r7.apk

└── 📄 /usr/share/java/celeborn/jars/ratis-thirdparty-misc-1.0.8.jar
        📦 netty-codec 4.1.115.Final (java-archive)
            Medium CVE-2025-58057 GHSA-3p8m-j85q-pgmj fixed in 4.1.125.Final
        📦 netty-codec-http 4.1.115.Final (java-archive)
            Low CVE-2025-58056 GHSA-fghv-69vj-qj49 fixed in 4.1.125.Final

x86_64/celeborn-0.5-compat-0.5.4-r7.apk

✅ No vulnerabilities found

x86_64/kserve-modelmesh-0.12.0-r16.apk

✅ No vulnerabilities found

x86_64/kserve-modelmesh-compat-0.12.0-r16.apk

✅ No vulnerabilities found