deps(deps): update actions/checkout action to v4.3.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v4.2.2 → v4.3.1

---

Release Notes

actions/checkout (actions/checkout)

v4.3.1

Compare Source

What's Changed

• Port v6 cleanup to v4 by @​ericsciple in #​2305

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

Compare Source

What's Changed

• docs: update README.md by @​motss in #​1971
• Add internal repos for checking out multiple repositories by @​mouismail in #​1977
• Documentation update - add recommended permissions to Readme by @​benwells in #​2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in #​2044
• Update README.md by @​nebuk89 in #​2194
• Update CODEOWNERS for actions by @​TingluoHuang in #​2224
• Update package dependencies by @​salmanmkc in #​2236
• Prepare release v4.3.0 by @​salmanmkc in #​2237

New Contributors

• @​motss made their first contribution in #​1971
• @​mouismail made their first contribution in #​1977
• @​benwells made their first contribution in #​2043
• @​nebuk89 made their first contribution in #​2194
• @​salmanmkc made their first contribution in #​2236

Full Changelog: actions/checkout@v4...v4.3.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:bb94104c5771d55499801c594c7ecdb81fb8badae786d732259b74ea11baafc5
vulnerabilities
platform	linux/amd64
size	108 MB
packages	250

📦 Base Image php:3effc26a4a8524994f6fd9e3c99f564bfdee610687d2d1d455996608118a910f

also known as	8.2-fpm-alpine 8.2-fpm-alpine3.22 8.2.29-fpm-alpine 8.2.29-fpm-alpine3.22
digest	sha256:a992b4453c7ffe21584867dced3a8b82c896603a10bfe3f7ec734729e26fcda5
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/stdlib@1.24.3 Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.012% EPSS Percentile 1st percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:113899fa3f2f256ea43f0ea51af53cadda6ad5945f9af8c808b1b5c53de336ef
vulnerabilities
platform	linux/amd64
size	109 MB
packages	247

📦 Base Image php:8.1-alpine

also known as	8.1-alpine3.21 8.1-cli-alpine 8.1-cli-alpine3.21 8.1.33-alpine 8.1.33-alpine3.21 8.1.33-cli-alpine 8.1.33-cli-alpine3.21 84499e7665570bbef8ca20d15c642d8d9485a887d6be7a8b335ca33b5d3126f0
digest	sha256:6ed5103426b2c742dcc4721afa9864e7faaedcbb84c92410762d0c5162a8bdb2
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-fpm-alpine

Name	8.2.29-fpm-alpine3.22
Digest	sha256:a992b4453c7ffe21584867dced3a8b82c896603a10bfe3f7ec734729e26fcda5
Vulnerabilities
Pushed	1 week ago
Size	32 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.2.29

The base image is also available under the supported tag(s): 8.2-fpm-alpine3.22, 8.2.29-fpm-alpine, 8.2.29-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.3-fpm-alpine Minor runtime version update Also known as: 8.3.24-fpm-alpine 8.3.24-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.24	1 week ago
8.4-fpm-alpine Image has same number of vulnerabilities Also known as: 8.4.11-fpm-alpine 8.4.11-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22	1 week ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:f2d324e199f81839308f929527d0303cb34421d9506fd1c8c6dfcb99a119febd
vulnerabilities
platform	linux/amd64
size	112 MB
packages	249

📦 Base Image php:8.2-alpine

also known as	8.2-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 d8f4974194fb8fae35528e5ff3f03ca3566ee2e502f953b7817e0cbefebf8a0d
digest	sha256:cdee2ae021443a0806843448eb174a188d6e6d85377a2e5a9bcd44161001fb8d
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/stdlib@1.24.3 Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.012% EPSS Percentile 1st percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:2387dd53507721ddc1a02cf30e1c7ebef6609f19475b24a009a7e4f720544509
vulnerabilities
platform	linux/amd64
size	131 MB
packages	284

📦 Base Image php:8.2-alpine

also known as	8.2-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 d8f4974194fb8fae35528e5ff3f03ca3566ee2e502f953b7817e0cbefebf8a0d
digest	sha256:cdee2ae021443a0806843448eb174a188d6e6d85377a2e5a9bcd44161001fb8d
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/stdlib@1.24.3 Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.012% EPSS Percentile 1st percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-alpine

Name	8.1.33-alpine3.21
Digest	sha256:6ed5103426b2c742dcc4721afa9864e7faaedcbb84c92410762d0c5162a8bdb2
Vulnerabilities
Pushed	1 week ago
Size	36 MB
Packages	59
Flavor	alpine
OS	3.21
Runtime	8.1.33

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.33-alpine, 8.1.33-alpine3.21, 8.1.33-cli-alpine, 8.1.33-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.1-alpine3.22 Patch runtime version update Also known as: 8.1.33-cli-alpine3.22 8.1-cli-alpine3.22 8.1.33-alpine3.22	Benefits: Patch runtime version update Same OS detected Image has similar size Image has same number of vulnerabilities Image contains similar number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.33	1 week ago
8.4-alpine Minor runtime version update Also known as: 8.4.11-cli-alpine 8.4.11-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.11-alpine 8.4.11-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains similar number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.11	1 week ago
8.4-alpine3.21 Minor runtime version update Also known as: 8.4.11-cli-alpine3.21 8.4-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8.4.11-alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.21 Runtime: 8.4.11	1 week ago
8.3-alpine Minor runtime version update Also known as: 8.3.24-cli-alpine 8.3.24-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.24-alpine 8.3.24-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains similar number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.24	1 week ago
8.3-alpine3.21 Minor runtime version update Also known as: 8.3.24-cli-alpine3.21 8.3-cli-alpine3.21 8.3.24-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.24	1 week ago
8.2-alpine Minor runtime version update Also known as: 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains similar number of packages 8.2-alpine was pulled 1.8K times last month Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.2.29	1 week ago
8.2-alpine3.21 Minor runtime version update Also known as: 8.2.29-cli-alpine3.21 8.2-cli-alpine3.21 8.2.29-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.29	1 week ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:10a35af533156eb102ff040a9193ac3be11955a3386a5bd69d3e5a828479c486
vulnerabilities
platform	linux/amd64
size	113 MB
packages	249

📦 Base Image php:8.3-alpine

also known as	8.3-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.24-alpine 8.3.24-alpine3.22 8.3.24-cli-alpine 8.3.24-cli-alpine3.22 b026e7d2fc6d7801e1af55dc42c7409b2f38d6b42c32494e9276b6ef40a28ee3
digest	sha256:f43a903b3e7fb97ce6ecdc8ab54c4beeebc913c38697740c6e9dd0d69fc37322
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/stdlib@1.24.3 Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.012% EPSS Percentile 1st percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:377709bfb98a9ed15df716d1456641245b487bf3a125cb9012214bf0c3534034
vulnerabilities
platform	linux/amd64
size	132 MB
packages	284

📦 Base Image php:8.3-alpine

also known as	8.3-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.24-alpine 8.3.24-alpine3.22 8.3.24-cli-alpine 8.3.24-cli-alpine3.22 b026e7d2fc6d7801e1af55dc42c7409b2f38d6b42c32494e9276b6ef40a28ee3
digest	sha256:f43a903b3e7fb97ce6ecdc8ab54c4beeebc913c38697740c6e9dd0d69fc37322
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/stdlib@1.24.3 Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.012% EPSS Percentile 1st percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:ad682d7e0f5a8288be2ad04643f2d60fa39dfcf068a99ab110e266899ecb27c2
vulnerabilities
platform	linux/amd64
size	127 MB
packages	265

📦 Base Image php:8.1-alpine

also known as	8.1-alpine3.21 8.1-cli-alpine 8.1-cli-alpine3.21 8.1.33-alpine 8.1.33-alpine3.21 8.1.33-cli-alpine 8.1.33-cli-alpine3.21 84499e7665570bbef8ca20d15c642d8d9485a887d6be7a8b335ca33b5d3126f0
digest	sha256:6ed5103426b2c742dcc4721afa9864e7faaedcbb84c92410762d0c5162a8bdb2
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

setuptools 70.3.0 (pypi) pkg:pypi/setuptools@70.3.0 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <78.1.1 Fixed version 78.1.1 CVSS Score 7.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P EPSS Score 0.139% EPSS Percentile 35th percentile Description Summary A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1 Details def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while '..' in name: name = name.replace('..', '.').replace('\\', '_') else: name = "__downloaded__" # default if URL has no path contents if name.endswith('.[egg.zip](http://egg.zip/)'): name = name[:-4] # strip the extra .zip before download --> filename = os.path.join(tmpdir, name) Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88 os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter. name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient. Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index. Impact An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context. References https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 pypa/setuptools#4946

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-alpine

Name	8.2.29-alpine3.22
Digest	sha256:cdee2ae021443a0806843448eb174a188d6e6d85377a2e5a9bcd44161001fb8d
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.2.29

The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.29-alpine, 8.2.29-alpine3.22, 8.2.29-cli-alpine, 8.2.29-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.11-cli-alpine 8.4.11-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.11-alpine 8.4.11-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.11	1 week ago
8.3-alpine Minor runtime version update Also known as: 8.3.24-cli-alpine 8.3.24-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.24-alpine 8.3.24-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.24	1 week ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-alpine

Name	8.2.29-alpine3.22
Digest	sha256:cdee2ae021443a0806843448eb174a188d6e6d85377a2e5a9bcd44161001fb8d
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.2.29

The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.29-alpine, 8.2.29-alpine3.22, 8.2.29-cli-alpine, 8.2.29-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.11-cli-alpine 8.4.11-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.11-alpine 8.4.11-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.11	1 week ago
8.3-alpine Minor runtime version update Also known as: 8.3.24-cli-alpine 8.3.24-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.24-alpine 8.3.24-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.24	1 week ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:e822c879a01397e34ac22e1482e3154c9dabb77b918a2be0cd82d019d128f05c
vulnerabilities
platform	linux/amd64
size	104 MB
packages	248

📦 Base Image oisupport/staging-amd64:8.1-fpm-alpine

also known as	8.1-fpm-alpine3.21 8.1.33-fpm-alpine 8.1.33-fpm-alpine3.21 da3eabe89d0c6c833838e3480d063d65f38577bc37dc976948b9352f3fb3d2fb
digest	sha256:4268ab6c629f48d1f77ff76b70355c1f384d95028c301d7a9d07a5f1644d4072
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-alpine

Name	8.3.24-alpine3.22
Digest	sha256:f43a903b3e7fb97ce6ecdc8ab54c4beeebc913c38697740c6e9dd0d69fc37322
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.3.24

The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.24-alpine, 8.3.24-alpine3.22, 8.3.24-cli-alpine, 8.3.24-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.11-cli-alpine 8.4.11-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.11-alpine 8.4.11-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.11	1 week ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-alpine

Name	8.1.33-alpine3.21
Digest	sha256:6ed5103426b2c742dcc4721afa9864e7faaedcbb84c92410762d0c5162a8bdb2
Vulnerabilities
Pushed	1 week ago
Size	36 MB
Packages	59
Flavor	alpine
OS	3.21
Runtime	8.1.33

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.33-alpine, 8.1.33-alpine3.21, 8.1.33-cli-alpine, 8.1.33-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.1-alpine3.22 Patch runtime version update Also known as: 8.1.33-cli-alpine3.22 8.1-cli-alpine3.22 8.1.33-alpine3.22	Benefits: Patch runtime version update Same OS detected Image has similar size Image has same number of vulnerabilities Image contains similar number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.33	1 week ago
8.4-alpine Minor runtime version update Also known as: 8.4.11-cli-alpine 8.4.11-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.11-alpine 8.4.11-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains similar number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.11	1 week ago
8.4-alpine3.21 Minor runtime version update Also known as: 8.4.11-cli-alpine3.21 8.4-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8.4.11-alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.21 Runtime: 8.4.11	1 week ago
8.3-alpine Minor runtime version update Also known as: 8.3.24-cli-alpine 8.3.24-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.24-alpine 8.3.24-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains similar number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.24	1 week ago
8.3-alpine3.21 Minor runtime version update Also known as: 8.3.24-cli-alpine3.21 8.3-cli-alpine3.21 8.3.24-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.24	1 week ago
8.2-alpine Minor runtime version update Also known as: 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains similar number of packages 8.2-alpine was pulled 1.8K times last month Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.2.29	1 week ago
8.2-alpine3.21 Minor runtime version update Also known as: 8.2.29-cli-alpine3.21 8.2-cli-alpine3.21 8.2.29-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.29	1 week ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:0b3d1a1823f06e345cba3b7305173f32db2ffbf70c431d841a3c7eb17ebbe412
vulnerabilities
platform	linux/amd64
size	108 MB
packages	250

📦 Base Image php:2bc2a355c610a5ce2f4854d785c740aafe346f652caa7a4960796338a17a0ffe

also known as	8.3-fpm-alpine 8.3-fpm-alpine3.22 8.3.24-fpm-alpine 8.3.24-fpm-alpine3.22
digest	sha256:994a36314a28fed17d2d9d66ff694817dcf51343c7d42e1890ec75b3406a3caf
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/stdlib@1.24.3 Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.012% EPSS Percentile 1st percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-alpine

Name	8.3.24-alpine3.22
Digest	sha256:f43a903b3e7fb97ce6ecdc8ab54c4beeebc913c38697740c6e9dd0d69fc37322
Vulnerabilities
Pushed	1 week ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.3.24

The base image is also available under the supported tag(s): 8.3-alpine3.22, 8.3-cli-alpine, 8.3-cli-alpine3.22, 8.3.24-alpine, 8.3.24-alpine3.22, 8.3.24-cli-alpine, 8.3.24-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.11-cli-alpine 8.4.11-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.11-alpine 8.4.11-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 42 MB Flavor: alpine OS: 3.22 Runtime: 8.4.11	1 week ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:d1d98bfbaab832aba6348a23cf9ed9f3d461cb53df43a700bf2c2cf3a7d8a36a
vulnerabilities
platform	linux/amd64
size	118 MB
packages	249

📦 Base Image php:8-alpine

also known as	8-alpine3.22 8-cli-alpine 8-cli-alpine3.22 8.4-alpine 8.4-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8.4.11-alpine 8.4.11-alpine3.22 8.4.11-cli-alpine 8.4.11-cli-alpine3.22 alpine alpine3.22 cli-alpine cli-alpine3.22 e4f9bb894d0d59558802c50d63685a084b2b4fb7eb77398e783423beab34d48f
digest	sha256:4ff5194e9fa697591425fa74e939879cde8c0d0da6a53b4b247cc47f43eb7d91
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/stdlib@1.24.3 Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.012% EPSS Percentile 1st percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-fpm-alpine

Name	8.3.24-fpm-alpine3.22
Digest	sha256:994a36314a28fed17d2d9d66ff694817dcf51343c7d42e1890ec75b3406a3caf
Vulnerabilities
Pushed	1 week ago
Size	33 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.3.24

The base image is also available under the supported tag(s): 8.3-fpm-alpine3.22, 8.3.24-fpm-alpine, 8.3.24-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-fpm-alpine Image has same number of vulnerabilities Also known as: 8.4.11-fpm-alpine 8.4.11-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22	1 week ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is :8.1-fpm-alpine

Digest
Vulnerabilities
Size	0 B
Packages	0

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-alpine

Name	8.4.11-alpine3.22
Digest	sha256:4ff5194e9fa697591425fa74e939879cde8c0d0da6a53b4b247cc47f43eb7d91
Vulnerabilities
Pushed	1 week ago
Size	42 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4.11

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.11-alpine, 8.4.11-alpine3.22, 8.4.11-cli-alpine, 8.4.11-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:84536902d2fccd2729e595ec49eb5e9bce7bb34ab2de7634961baedb8b4de877
vulnerabilities
platform	linux/amd64
size	112 MB
packages	250

📦 Base Image oisupport/staging-amd64:639b54f0afafe1a50d5dfdf4306b05aa09357ed7292390e3ed242ecfc57cc7e0

also known as	8-fpm-alpine 8-fpm-alpine3.22 8.4-fpm-alpine 8.4-fpm-alpine3.22 8.4.11-fpm-alpine 8.4.11-fpm-alpine3.22 fpm-alpine fpm-alpine3.22
digest	sha256:dd4b38d02d63413f45aea06eaaf1ac2410b7cbe81b017efd3d6feefb142809b2
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/stdlib@1.24.3 Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.012% EPSS Percentile 1st percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is :639b54f0afafe1a50d5dfdf4306b05aa09357ed7292390e3ed242ecfc57cc7e0

Digest
Vulnerabilities
Size	0 B
Packages	0

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:18e8b8a3b086ff7c5a6b84fa21793ac1919c7bd506a9db517b76ecd01057cec4
vulnerabilities
platform	linux/amd64
size	137 MB
packages	284

📦 Base Image php:8-alpine

also known as	8-alpine3.22 8-cli-alpine 8-cli-alpine3.22 8.4-alpine 8.4-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8.4.11-alpine 8.4.11-alpine3.22 8.4.11-cli-alpine 8.4.11-cli-alpine3.22 alpine alpine3.22 cli-alpine cli-alpine3.22 e4f9bb894d0d59558802c50d63685a084b2b4fb7eb77398e783423beab34d48f
digest	sha256:4ff5194e9fa697591425fa74e939879cde8c0d0da6a53b4b247cc47f43eb7d91
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 38.497% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.188% EPSS Percentile 41st percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.3 (golang) pkg:golang/stdlib@1.24.3 Affected range >=1.24.0-0 <1.24.4 Fixed version 1.24.4 EPSS Score 0.012% EPSS Percentile 1st percentile Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-alpine

Name	8.4.11-alpine3.22
Digest	sha256:4ff5194e9fa697591425fa74e939879cde8c0d0da6a53b4b247cc47f43eb7d91
Vulnerabilities
Pushed	1 week ago
Size	42 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4.11

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.11-alpine, 8.4.11-alpine3.22, 8.4.11-cli-alpine, 8.4.11-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:e36c7217468cdecdda9cd65e4e73c8bf598d9a132336cc93f062caaedae7b74a
vulnerabilities
platform	linux/amd64
size	105 MB
packages	248

📦 Base Image php:8.1-fpm-alpine

also known as	8.1-fpm-alpine3.21 8.1.33-fpm-alpine 8.1.33-fpm-alpine3.21 a5705c7e8a9637ec417dc448b6afb91982a252f2f08a056af3166d3e0b36cc0e
digest	sha256:3f6d33709f6648a334f44757f43bc6c9e4c4390b4ff555199f28377601455de9
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.23.9 (golang) pkg:golang/stdlib@1.23.9 Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.033% EPSS Percentile 9th percentile Description Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-fpm-alpine

Name	8.1.33-fpm-alpine3.21
Digest	sha256:3f6d33709f6648a334f44757f43bc6c9e4c4390b4ff555199f28377601455de9
Vulnerabilities
Pushed	3 months ago
Size	32 MB
Packages	60
Flavor	alpine
OS	3.21
Runtime	8.1.33

The base image is also available under the supported tag(s): 8.1-fpm-alpine3.21, 8.1.33-fpm-alpine, 8.1.33-fpm-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.1-fpm-alpine3.22 Patch runtime version update Also known as: 8.1.33-fpm-alpine3.22	Benefits: Patch runtime version update Same OS detected Image has similar size Image has same number of vulnerabilities Image contains similar number of packages Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.1.33	3 months ago
8.3-fpm-alpine Minor runtime version update Also known as: 8.3.27-fpm-alpine 8.3.27-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains similar number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.27	3 weeks ago
8.3-fpm-alpine3.21 Minor runtime version update Also known as: 8.3.27-fpm-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.21 Runtime: 8.3.27	3 weeks ago
8.2-fpm-alpine Minor runtime version update Also known as: 8.2.29-fpm-alpine 8.2.29-fpm-alpine3.22 8.2-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains similar number of packages 8.2-fpm-alpine was pulled 4.1K times last month Image details: Size: 32 MB Flavor: alpine OS: 3.22 Runtime: 8.2.29	3 months ago
8.2-fpm-alpine3.21 Minor runtime version update Also known as: 8.2.29-fpm-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 32 MB Flavor: alpine OS: 3.21 Runtime: 8.2.29	3 months ago
8.4-fpm-alpine Image introduces no new vulnerability but removes 5 Also known as: 8.4.14-fpm-alpine 8.4.14-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains similar number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.22	3 weeks ago
8.4-fpm-alpine3.21 Image introduces no new vulnerability but removes 5 Also known as: 8.4.14-fpm-alpine3.21 8-fpm-alpine3.21 fpm-alpine3.21	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21	3 weeks ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:cebac1af578f588395c42628f7ef370f7b584eb4d9d31fbfe1e0869798f4ae55
vulnerabilities
platform	linux/amd64
size	117 MB
packages	249

📦 Base Image php:8-alpine

also known as	8-alpine3.22 8-cli-alpine 8-cli-alpine3.22 8.4-alpine 8.4-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8.4.14-alpine 8.4.14-alpine3.22 8.4.14-cli-alpine 8.4.14-cli-alpine3.22 aea9a2da6d41c26d48544950937d654f556bffe773f82fd3924823903f67b4f5 alpine alpine3.22 cli-alpine cli-alpine3.22
digest	sha256:2c844e231b50b8f1b61669ca1406ab784ba1e8f48c4d6535576dfd588d3eabab
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.8 (golang) pkg:golang/stdlib@1.24.8 Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:853ef04cd2f4f30c0115315861057b94d6a80107b4ead2aa66db3228e45fea34
vulnerabilities
platform	linux/amd64
size	132 MB
packages	284

📦 Base Image php:8.2-alpine

also known as	8.2-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 df7d2aca7d453249829e16923877c821823065f32a24e0eb2c66e7a12fd7b54b
digest	sha256:8c201df34c610be6d54a158ac62310c15b7370bfb3777508188c07513787caa0
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.7 (golang) pkg:golang/stdlib@1.24.7 Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.033% EPSS Percentile 9th percentile Description Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:b859d5348c54bb53bed65646fdd163c355c14aecb30a4113a961e8205f0a0f25
vulnerabilities
platform	linux/amd64
size	111 MB
packages	250

📦 Base Image oisupport/staging-amd64:6606cb4b38b35f3ab0f5bff3d8af63f5d9fcacdb852bcbbc0249786594f199cb

also known as	8-fpm-alpine 8-fpm-alpine3.22 8.4-fpm-alpine 8.4-fpm-alpine3.22 8.4.14-fpm-alpine 8.4.14-fpm-alpine3.22 fpm-alpine fpm-alpine3.22
digest	sha256:b9761938e7b22d04283840c8554b214e8d806297cc0c17aedf5285070071de32
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.8 (golang) pkg:golang/stdlib@1.24.8 Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-alpine

Name	8.2.29-alpine3.22
Digest	sha256:8c201df34c610be6d54a158ac62310c15b7370bfb3777508188c07513787caa0
Vulnerabilities
Pushed	3 months ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.2.29

The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.29-alpine, 8.2.29-alpine3.22, 8.2.29-cli-alpine, 8.2.29-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.14-cli-alpine 8.4.14-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.14-alpine 8.4.14-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 41 MB Flavor: alpine OS: 3.22 Runtime: 8.4.14	3 weeks ago
8.3-alpine Minor runtime version update Also known as: 8.3.27-cli-alpine 8.3.27-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.27-alpine 8.3.27-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.27	3 weeks ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-alpine

Name	8.4.14-alpine3.22
Digest	sha256:2c844e231b50b8f1b61669ca1406ab784ba1e8f48c4d6535576dfd588d3eabab
Vulnerabilities
Pushed	3 weeks ago
Size	41 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4.14

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.14-alpine, 8.4.14-alpine3.22, 8.4.14-cli-alpine, 8.4.14-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:5542a0a942e10d49bbf5337b45f1b47fe0eb014618602257d8b66341a977d3e1
vulnerabilities
platform	linux/amd64
size	128 MB
packages	265

📦 Base Image php:8.1-alpine

also known as	8.1-alpine3.21 8.1-cli-alpine 8.1-cli-alpine3.21 8.1.33-alpine 8.1.33-alpine3.21 8.1.33-cli-alpine 8.1.33-cli-alpine3.21 aeda52007687158f88915a60b395065c946a772587552d11e8e49511924585c9
digest	sha256:b2694ec936f57efe2633da0a83e055af8e7ccf4a08274fb299396c8a2fa12285
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.23.9 (golang) pkg:golang/stdlib@1.23.9 Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.033% EPSS Percentile 9th percentile Description Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

setuptools 70.3.0 (pypi) pkg:pypi/setuptools@70.3.0 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <78.1.1 Fixed version 78.1.1 CVSS Score 7.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P EPSS Score 0.090% EPSS Percentile 26th percentile Description Summary A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1 Details def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while '..' in name: name = name.replace('..', '.').replace('\\', '_') else: name = "__downloaded__" # default if URL has no path contents if name.endswith('.[egg.zip](http://egg.zip/)'): name = name[:-4] # strip the extra .zip before download --> filename = os.path.join(tmpdir, name) Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88 os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter. name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient. Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index. Impact An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context. References https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 pypa/setuptools#4946

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:cae09ff596d0b56db664b8d54c4ecda262d8a1efb52bad5fc7fc8a04fd781800
vulnerabilities
platform	linux/amd64
size	109 MB
packages	247

📦 Base Image php:8.1-alpine

also known as	8.1-alpine3.21 8.1-cli-alpine 8.1-cli-alpine3.21 8.1.33-alpine 8.1.33-alpine3.21 8.1.33-cli-alpine 8.1.33-cli-alpine3.21 aeda52007687158f88915a60b395065c946a772587552d11e8e49511924585c9
digest	sha256:b2694ec936f57efe2633da0a83e055af8e7ccf4a08274fb299396c8a2fa12285
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.23.9 (golang) pkg:golang/stdlib@1.23.9 Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.033% EPSS Percentile 9th percentile Description Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is :6606cb4b38b35f3ab0f5bff3d8af63f5d9fcacdb852bcbbc0249786594f199cb

Digest
Vulnerabilities
Size	0 B
Packages	0

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:e76bf664953f323964638f9c699f944bda7e13ce87c7a09ced65c05b18772418
vulnerabilities
platform	linux/amd64
size	136 MB
packages	284

📦 Base Image php:8-alpine

also known as	8-alpine3.22 8-cli-alpine 8-cli-alpine3.22 8.4-alpine 8.4-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8.4.14-alpine 8.4.14-alpine3.22 8.4.14-cli-alpine 8.4.14-cli-alpine3.22 aea9a2da6d41c26d48544950937d654f556bffe773f82fd3924823903f67b4f5 alpine alpine3.22 cli-alpine cli-alpine3.22
digest	sha256:2c844e231b50b8f1b61669ca1406ab784ba1e8f48c4d6535576dfd588d3eabab
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.8 (golang) pkg:golang/stdlib@1.24.8 Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:64070c14b9bb0c02804d845d45e2a725c2d019ec4728225b5b798411bdb518b0
vulnerabilities
platform	linux/amd64
size	108 MB
packages	250

📦 Base Image php:8.2-fpm-alpine

also known as	8.2-fpm-alpine3.22 8.2.29-fpm-alpine 8.2.29-fpm-alpine3.22 b4744cb64815673d45790b5eafa8eaf53ff99079651a94c25b9c42d388ece840
digest	sha256:f3f076fbd8eeaa1c1df6e657068d0a45df9584f4290d3e8442c04bc60bc5c36d
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.7 (golang) pkg:golang/stdlib@1.24.7 Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.033% EPSS Percentile 9th percentile Description Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:a530e3b0c14be47242415f88814bf5c99114df168344626167c6090dd20a09fe
vulnerabilities
platform	linux/amd64
size	112 MB
packages	249

📦 Base Image php:8.2-alpine

also known as	8.2-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 df7d2aca7d453249829e16923877c821823065f32a24e0eb2c66e7a12fd7b54b
digest	sha256:8c201df34c610be6d54a158ac62310c15b7370bfb3777508188c07513787caa0
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.7 (golang) pkg:golang/stdlib@1.24.7 Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.033% EPSS Percentile 9th percentile Description Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-alpine

Name	8.1.33-alpine3.21
Digest	sha256:b2694ec936f57efe2633da0a83e055af8e7ccf4a08274fb299396c8a2fa12285
Vulnerabilities
Pushed	3 months ago
Size	36 MB
Packages	59
Flavor	alpine
OS	3.21
Runtime	8.1.33

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.33-alpine, 8.1.33-alpine3.21, 8.1.33-cli-alpine, 8.1.33-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.1-alpine3.22 Patch runtime version update Also known as: 8.1.33-cli-alpine3.22 8.1-cli-alpine3.22 8.1.33-alpine3.22	Benefits: Patch runtime version update Same OS detected Image has similar size Image has same number of vulnerabilities Image contains similar number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.33	3 months ago
8.4-alpine Minor runtime version update Also known as: 8.4.14-cli-alpine 8.4.14-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.14-alpine 8.4.14-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains similar number of packages Image details: Size: 41 MB Flavor: alpine OS: 3.22 Runtime: 8.4.14	3 weeks ago
8.4-alpine3.21 Minor runtime version update Also known as: 8.4.14-cli-alpine3.21 8.4-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8.4.14-alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 41 MB Flavor: alpine OS: 3.21 Runtime: 8.4.14	3 weeks ago
8.3-alpine Minor runtime version update Also known as: 8.3.27-cli-alpine 8.3.27-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.27-alpine 8.3.27-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains similar number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.27	3 weeks ago
8.3-alpine3.21 Minor runtime version update Also known as: 8.3.27-cli-alpine3.21 8.3-cli-alpine3.21 8.3.27-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.27	3 weeks ago
8.2-alpine Minor runtime version update Also known as: 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains similar number of packages 8.2-alpine was pulled 1.8K times last month Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.2.29	3 months ago
8.2-alpine3.21 Minor runtime version update Also known as: 8.2.29-cli-alpine3.21 8.2-cli-alpine3.21 8.2.29-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.29	3 months ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.1-alpine

Name	8.1.33-alpine3.21
Digest	sha256:b2694ec936f57efe2633da0a83e055af8e7ccf4a08274fb299396c8a2fa12285
Vulnerabilities
Pushed	3 months ago
Size	36 MB
Packages	59
Flavor	alpine
OS	3.21
Runtime	8.1.33

The base image is also available under the supported tag(s): 8.1-alpine3.21, 8.1-cli-alpine, 8.1-cli-alpine3.21, 8.1.33-alpine, 8.1.33-alpine3.21, 8.1.33-cli-alpine, 8.1.33-cli-alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.1-alpine3.22 Patch runtime version update Also known as: 8.1.33-cli-alpine3.22 8.1-cli-alpine3.22 8.1.33-alpine3.22	Benefits: Patch runtime version update Same OS detected Image has similar size Image has same number of vulnerabilities Image contains similar number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.22 Runtime: 8.1.33	3 months ago
8.4-alpine Minor runtime version update Also known as: 8.4.14-cli-alpine 8.4.14-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.14-alpine 8.4.14-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains similar number of packages Image details: Size: 41 MB Flavor: alpine OS: 3.22 Runtime: 8.4.14	3 weeks ago
8.4-alpine3.21 Minor runtime version update Also known as: 8.4.14-cli-alpine3.21 8.4-cli-alpine3.21 8-cli-alpine3.21 cli-alpine3.21 alpine3.21 8.4.14-alpine3.21 8-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 41 MB Flavor: alpine OS: 3.21 Runtime: 8.4.14	3 weeks ago
8.3-alpine Minor runtime version update Also known as: 8.3.27-cli-alpine 8.3.27-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.27-alpine 8.3.27-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains similar number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.27	3 weeks ago
8.3-alpine3.21 Minor runtime version update Also known as: 8.3.27-cli-alpine3.21 8.3-cli-alpine3.21 8.3.27-alpine3.21	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.21 Runtime: 8.3.27	3 weeks ago
8.2-alpine Minor runtime version update Also known as: 8.2.29-cli-alpine 8.2.29-cli-alpine3.22 8.2-cli-alpine 8.2-cli-alpine3.22 8.2.29-alpine 8.2.29-alpine3.22 8.2-alpine3.22	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains similar number of packages 8.2-alpine was pulled 1.8K times last month Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.2.29	3 months ago
8.2-alpine3.21 Minor runtime version update Also known as: 8.2.29-cli-alpine3.21 8.2-cli-alpine3.21 8.2.29-alpine3.21	Benefits: Same OS detected Minor runtime version update Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.21 Runtime: 8.2.29	3 months ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-alpine

Name	8.2.29-alpine3.22
Digest	sha256:8c201df34c610be6d54a158ac62310c15b7370bfb3777508188c07513787caa0
Vulnerabilities
Pushed	3 months ago
Size	37 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.2.29

The base image is also available under the supported tag(s): 8.2-alpine3.22, 8.2-cli-alpine, 8.2-cli-alpine3.22, 8.2.29-alpine, 8.2.29-alpine3.22, 8.2.29-cli-alpine, 8.2.29-cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-alpine Minor runtime version update Also known as: 8.4.14-cli-alpine 8.4.14-cli-alpine3.22 8.4-cli-alpine 8.4-cli-alpine3.22 8-cli-alpine 8-cli-alpine3.22 cli-alpine cli-alpine3.22 alpine alpine3.22 8.4.14-alpine 8.4.14-alpine3.22 8.4-alpine3.22 8-alpine 8-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 41 MB Flavor: alpine OS: 3.22 Runtime: 8.4.14	3 weeks ago
8.3-alpine Minor runtime version update Also known as: 8.3.27-cli-alpine 8.3.27-cli-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.27-alpine 8.3.27-alpine3.22 8.3-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 37 MB Flavor: alpine OS: 3.22 Runtime: 8.3.27	3 weeks ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8-alpine

Name	8.4.14-alpine3.22
Digest	sha256:2c844e231b50b8f1b61669ca1406ab784ba1e8f48c4d6535576dfd588d3eabab
Vulnerabilities
Pushed	3 weeks ago
Size	41 MB
Packages	60
Flavor	alpine
OS	3.22
Runtime	8.4.14

The base image is also available under the supported tag(s): 8-alpine3.22, 8-cli-alpine, 8-cli-alpine3.22, 8.4-alpine, 8.4-alpine3.22, 8.4-cli-alpine, 8.4-cli-alpine3.22, 8.4.14-alpine, 8.4.14-alpine3.22, 8.4.14-cli-alpine, 8.4.14-cli-alpine3.22, alpine, alpine3.22, cli-alpine, cli-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.2-fpm-alpine

Name	8.2.29-fpm-alpine3.22
Digest	sha256:f3f076fbd8eeaa1c1df6e657068d0a45df9584f4290d3e8442c04bc60bc5c36d
Vulnerabilities
Pushed	3 months ago
Size	32 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.2.29

The base image is also available under the supported tag(s): 8.2-fpm-alpine3.22, 8.2.29-fpm-alpine, 8.2.29-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.3-fpm-alpine Minor runtime version update Also known as: 8.3.27-fpm-alpine 8.3.27-fpm-alpine3.22 8.3-fpm-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 33 MB Flavor: alpine OS: 3.22 Runtime: 8.3.27	3 weeks ago
8.4-fpm-alpine Image introduces no new vulnerability but removes 5 Also known as: 8.4.14-fpm-alpine 8.4.14-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 5 Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.22	3 weeks ago

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:0c41452e8a566ad44033de9dbf2eaeba04d53def0333ccd37e5720abc1c0f967
vulnerabilities
platform	linux/amd64
size	108 MB
packages	250

📦 Base Image php:8.3-fpm-alpine

also known as	8.3-fpm-alpine3.22 8.3.27-fpm-alpine 8.3.27-fpm-alpine3.22 c9d65da38e61a3c75204e5c878b1a583d9fee27b0530835df57168426aea09b9
digest	sha256:757dffdfc05493894b3e275577c7ddc369acfcca35e322da0209738b188afd89
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.8 (golang) pkg:golang/stdlib@1.24.8 Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:cf965fa429690f132c42a5b77caf9bb39f27abf29d0e6903782c77617c205270
vulnerabilities
platform	linux/amd64
size	113 MB
packages	249

📦 Base Image oisupport/staging-amd64:8.3-alpine

also known as	8.3-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.27-alpine 8.3.27-alpine3.22 8.3.27-cli-alpine 8.3.27-cli-alpine3.22 b43d5d66195522c0d44e0b039379c7f5683beb802cdb41b84cf184b00ec592fb
digest	sha256:3165264cd98fd5d3636a6338b7d22811b3f848d0f777f9180d00a6c015ac60fa
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.8 (golang) pkg:golang/stdlib@1.24.8 Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

🔍 Vulnerabilities of wayofdev/php-dev:latest

📦 Image Reference wayofdev/php-dev:latest

digest	sha256:d282f5a04c9ee0caca108bdc4817f9ccaa78c0eaf6c7e7f6a9bdcbfafedd5b8f
vulnerabilities
platform	linux/amd64
size	132 MB
packages	284

📦 Base Image oisupport/staging-amd64:8.3-alpine

also known as	8.3-alpine3.22 8.3-cli-alpine 8.3-cli-alpine3.22 8.3.27-alpine 8.3.27-alpine3.22 8.3.27-cli-alpine 8.3.27-cli-alpine3.22 b43d5d66195522c0d44e0b039379c7f5683beb802cdb41b84cf184b00ec592fb
digest	sha256:3165264cd98fd5d3636a6338b7d22811b3f848d0f777f9180d00a6c015ac60fa
vulnerabilities

golang.org/x/crypto 0.17.0 (golang) pkg:golang/golang.org/x/crypto@0.17.0 Improper Authorization Affected range <0.31.0 Fixed version 0.31.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 42.906% EPSS Percentile 97th percentile Description Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Affected range <0.43.0 Fixed version 0.43.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.259% EPSS Percentile 49th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

stdlib 1.24.8 (golang) pkg:golang/stdlib@1.24.8 Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is php:8.3-fpm-alpine

Name	8.3.27-fpm-alpine3.22
Digest	sha256:757dffdfc05493894b3e275577c7ddc369acfcca35e322da0209738b188afd89
Vulnerabilities
Pushed	3 weeks ago
Size	33 MB
Packages	61
Flavor	alpine
OS	3.22
Runtime	8.3.27

The base image is also available under the supported tag(s): 8.3-fpm-alpine3.22, 8.3.27-fpm-alpine, 8.3.27-fpm-alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
8.4-fpm-alpine Image has same number of vulnerabilities Also known as: 8.4.14-fpm-alpine 8.4.14-fpm-alpine3.22 8.4-fpm-alpine3.22 8-fpm-alpine 8-fpm-alpine3.22 fpm-alpine fpm-alpine3.22	Benefits: Same OS detected Image has similar size Image has same number of vulnerabilities Image contains equal number of packages Image details: Size: 36 MB Flavor: alpine OS: 3.22	3 weeks ago

[github-actions]

Outdated

Recommended fixes for image wayofdev/php-dev:latest

Base image is :8.3-alpine

Digest
Vulnerabilities
Size	0 B
Packages	0

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Recommended fixes for image wayofdev/php-dev:latest

Base image is :8.3-alpine

Digest
Vulnerabilities
Size	0 B
Packages	0

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.