Security Report - ait-mongo-service

🔴 Vulnerabilities (4)
Severity	CVE ID	Package	Installed	Fixed In	Description
HIGH	CVE-2025-4565	protobuf	5.27.2	4.25.8, 5.29.5, 6.31.1	python-protobuf: Unbounded recursion in Python Protobuf
HIGH	CVE-2026-0994	protobuf	5.27.2	6.33.5, 5.29.6	python: protobuf: Protobuf: Denial of Service due to recursion depth bypass
MEDIUM	CVE-2026-28684	python-dotenv	1.1.1	1.2.2	python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following
MEDIUM	CVE-2026-25645	requests	2.32.4	2.33.0	requests: Requests: Security bypass due to predictable temporary file creation
🔑 Secrets (0)
Type	File	Line	Match
✅ No secrets found
⚙️ Misconfigurations (1)
Severity	ID	Check	File	Message
HIGH	DS002	Image user should not be 'root'	Dockerfile	Specify at least 1 USER command in Dockerfile with non-root user as argument
📄 Raw JSON Report (click to expand)
{
  "SchemaVersion": 2,
  "CreatedAt": "2026-06-24T06:50:31.789593598Z",
  "ArtifactName": "/src",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  },
  "Results": [
    {
      "Target": "requirements.txt",
      "Class": "lang-pkgs",
      "Type": "pip",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2025-4565",
          "PkgName": "protobuf",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/protobuf@5.27.2"
          },
          "InstalledVersion": "5.27.2",
          "FixedVersion": "4.25.8, 5.29.5, 6.31.1",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-4565",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "python-protobuf: Unbounded recursion in Python Protobuf",
          "Description": "Any project that uses Protobuf Pure-Python backend\u00a0to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP\u00a0tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit\u00a017838beda2943d08b8a9d4df5b68f5f04f26d901",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-674"
          ],
          "VendorSeverity": {
            "azure": 3,
            "cbl-mariner": 3,
            "ghsa": 3,
            "nvd": 2,
            "redhat": 2,
            "ubuntu": 2
          },
          "CVSS": {
            "ghsa": {},
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "V3Score": 5.3
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "V3Score": 5.3
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2025-4565",
            "https://github.com/protocolbuffers/protobuf",
            "https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98",
            "https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478",
            "https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901",
            "https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8",
            "https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8qvm-5x2c-j2w7",
            "https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends",
            "https://nvd.nist.gov/vuln/detail/CVE-2025-4565",
            "https://ubuntu.com/security/notices/USN-7629-1",
            "https://ubuntu.com/security/notices/USN-7629-2",
            "https://www.cve.org/CVERecord?id=CVE-2025-4565"
          ],
          "PublishedDate": "2025-06-16T15:15:24.99Z",
          "LastModifiedDate": "2026-06-17T09:33:31.963Z"
        },
        {
          "VulnerabilityID": "CVE-2026-0994",
          "PkgName": "protobuf",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/protobuf@5.27.2"
          },
          "InstalledVersion": "5.27.2",
          "FixedVersion": "6.33.5, 5.29.6",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "Description": "A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.\n\nDue to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python\u2019s recursion stack and causing a RecursionError.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-674"
          ],
          "VendorSeverity": {
            "alma": 3,
            "amazon": 3,
            "azure": 3,
            "cbl-mariner": 3,
            "ghsa": 3,
            "nvd": 3,
            "oracle-oval": 3,
            "photon": 3,
            "redhat": 3,
            "rocky": 3,
            "ubuntu": 2
          },
          "CVSS": {
            "ghsa": {},
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            }
          },
          "References": [
            "https://access.redhat.com/errata/RHSA-2026:3095",
            "https://access.redhat.com/security/cve/CVE-2026-0994",
            "https://bugzilla.redhat.com/2432398",
            "https://bugzilla.redhat.com/show_bug.cgi?id=2432398",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0994",
            "https://errata.almalinux.org/9/ALSA-2026-3095.html",
            "https://errata.rockylinux.org/RLSA-2026:3094",
            "https://github.com/protocolbuffers/protobuf",
            "https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf",
            "https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b",
            "https://github.com/protocolbuffers/protobuf/issues/25070",
            "https://github.com/protocolbuffers/protobuf/pull/25239",
            "https://github.com/protocolbuffers/protobuf/pull/25586 (33.x)",
            "https://github.com/protocolbuffers/protobuf/pull/25587 (29.x)",
            "https://linux.oracle.com/cve/CVE-2026-0994.html",
            "https://linux.oracle.com/errata/ELSA-2026-3095.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-0994",
            "https://ubuntu.com/security/notices/USN-8063-1",
            "https://ubuntu.com/security/notices/USN-8063-2",
            "https://www.cve.org/CVERecord?id=CVE-2026-0994"
          ],
          "PublishedDate": "2026-01-23T15:16:06.84Z",
          "LastModifiedDate": "2026-06-17T10:11:44.34Z"
        },
        {
          "VulnerabilityID": "CVE-2026-28684",
          "PkgName": "python-dotenv",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/python-dotenv@1.1.1"
          },
          "InstalledVersion": "1.1.1",
          "FixedVersion": "1.2.2",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28684",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following",
          "Description": "python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-59",
            "CWE-61"
          ],
          "VendorSeverity": {
            "ghsa": 2,
            "redhat": 2
          },
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
              "V3Score": 6.6
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "V3Score": 7.1
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-28684",
            "https://github.com/theskumar/python-dotenv",
            "https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311",
            "https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311.patch",
            "https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2",
            "https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-28684",
            "https://www.cve.org/CVERecord?id=CVE-2026-28684"
          ],
          "PublishedDate": "2026-04-20T17:16:33.087Z",
          "LastModifiedDate": "2026-06-17T10:28:54.243Z"
        },
        {
          "VulnerabilityID": "CVE-2026-25645",
          "PkgName": "requests",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/requests@2.32.4"
          },
          "InstalledVersion": "2.32.4",
          "FixedVersion": "2.33.0",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "Description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-377"
          ],
          "VendorSeverity": {
            "azure": 2,
            "ghsa": 2,
            "nvd": 2,
            "photon": 2,
            "redhat": 2
          },
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
              "V3Score": 4.4
            },
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "V3Score": 5.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "V3Score": 4.7
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-25645",
            "https://github.com/psf/requests",
            "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7",
            "https://github.com/psf/requests/releases/tag/v2.33.0",
            "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-25645",
            "https://www.cve.org/CVERecord?id=CVE-2026-25645"
          ],
          "PublishedDate": "2026-03-25T17:16:52.97Z",
          "LastModifiedDate": "2026-06-17T10:25:00.443Z"
        }
      ]
    },
    {
      "Target": "Dockerfile",
      "Class": "config",
      "Type": "dockerfile",
      "MisconfSummary": {
        "Successes": 23,
        "Failures": 1,
        "Exceptions": 0
      },
      "Misconfigurations": [
        {
          "Type": "Dockerfile Security Check",
          "ID": "DS002",
          "AVDID": "AVD-DS-0002",
          "Title": "Image user should not be 'root'",
          "Description": "Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.",
          "Message": "Specify at least 1 USER command in Dockerfile with non-root user as argument",
          "Namespace": "builtin.dockerfile.DS002",
          "Query": "data.builtin.dockerfile.DS002.deny",
          "Resolution": "Add 'USER <non root user name>' line to the Dockerfile",
          "Severity": "HIGH",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ds002",
          "References": [
            "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
            "https://avd.aquasec.com/misconfig/ds002"
          ],
          "Status": "FAIL",
          "Layer": {},
          "CauseMetadata": {
            "Provider": "Dockerfile",
            "Service": "general",
            "Code": {
              "Lines": null
            }
          }
        }
      ]
    }
  ]
}
🛡️ Security Scan Report

0

3

2

0

0

1
