Security Vulnerabilities

[amitjattan]

Hello @DCMattyG

We have recently executed the scanning on the images created from ipam and it looks like there are some critical vulnerabilities occurs in the code. Here is the attached screenshot of same. I have tried to create the issue in Security category, but that was going to different route. I just wanted to let you know this. Not sure if there are fixes available or you might have come across some fixes.

Severity	CVSS	ID	Summary	Recommended action	Show details
Critical	9.8	CVE-2023-45853	zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6	No fix available
Critical	9.8	CVE-2025-6965	sqlite: Integer Truncation in SQLite	No fix available
Critical	9.8	CVE-2025-57807	imagemagick: ImageMagick BlobStream Forward-Seek Under-Allocation	Update to 8:6.9.11.60+dfsg-1.3+deb11u6
Critical	9.8	CVE-2025-53014	ImageMagick: ImageMagick Heap Buffer Overflow	Update to 8:6.9.11.60+dfsg-1.3+deb11u6
Critical	9.8	CVE-2019-8457	sqlite: heap out-of-bound read in function rtreenode()	No fix available
Critical	9.1	CVE-2023-23914	curl: HSTS ignored on multiple requests	No fix available
Critical	9.8	CVE-2023-6879	aom: heap-buffer-overflow on frame size change	No fix available
Critical	No data–	CVE-2025-7783	form-data: Unsafe random function in form-data	Update to fixed version
Critical	No data–	CVE-2024-24790	golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses	Update to fixed version

I can share more details if needed. Please let me know if you have any inputs

[DCMattyG]

Hey @amitjattan, as you pointed out these come from the underlying Docker image that I do not own and as such it would be up to the owners of the Debian docker images to patch these, as I'm sure they do one a regular basis.

Additionally, just because there is a CVE doesn't necessarily mean that it can be exploited. For example, we're not using SQLite at all nor Golang here. Are there any of these which you've specifically reviewed for which you have concerns, or is this just a list of findings from a scanner?

As you and I have spoken often, I believe you compile your own images and you can absolutely select a different base images with less vulnerabilities if you so choose. The Alpine images tend to work best for this as they are minimal and have almost nothing installed by default.

Hopefully I'm making sense here, but happy to continue this discussion to make sure you're getting what you need.

[amitjattan]

Thanks Matt.. No, I am just exploring my options. The main driver of this is our new Cloudsmith product onboarding where most of our images will be pushed in this new cloud base artefact management tool and there are policies which we will configure to quarantine any package which comes with vulnerabilities. So I am just trying to be proactive and figuring out where we stand on this platform from a security perspective. Good news is we are going to own Cloudsmith, bad news is we need to keep our house clean before asking others :-)... As you mentioned, yes, we are building these images in our environment, so I can play a bit on the baseline packages and see if it works on fixing some of these. Will let you know. As always thanks for prompt response...

…

On Fri, Oct 3, 2025 at 12:44 PM DCMattyG ***@***.***> wrote: *DCMattyG* left a comment (Azure/ipam#369) <#369 (comment)> Hey @amitjattan <https://github.com/amitjattan>, as you pointed out these come from the underlying Docker image that I do not own and as such it would be up to the owners of the Debian docker images to patch these, as I'm sure they do one a regular basis. Additionally, just because there is a CVE doesn't necessarily mean that it can be exploited. For example, we're not using SQLite at all no golang here. Are there any of these which you've specifically review for which you have concerns, or is this just a list of findings from a scanner? As you and I have spoken often, I believe you compile your own images and you can absolutely select a different base images with less vulnerabilities if you so choose. The Alpine images tend to work best for this as they are minimal and have almost nothing installed by default. Hopefully I'm making sense here, but happy to continue this discussion to make sure you're getting what you need. — Reply to this email directly, view it on GitHub <#369 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGL3UQQVUCHKVIEUJ67ASDL3V3G3DAVCNFSM6AAAAACIHR26TKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGNRXGAYDCNZSGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- Thanks & Regards Amit Kumar 971-264-4425

[DCMattyG]

Happy to help however I can my friend, please let me know if there's anything you need from me!