update lpm to 0.2.7 to resolve CVE-2024-5535

[jnewton03]

lpm updated to 0.2.7. Checksums here: https://github.com/liquibase/liquibase-package-manager/actions/runs/9894708164

[github-actions]

🔍 Vulnerabilities of liquibase/liquibase:bd586663cdad5c4ce15eeffb88502c22b7da5537

📦 Image Reference liquibase/liquibase:bd586663cdad5c4ce15eeffb88502c22b7da5537

digest	sha256:85636c1b9276f7459ee938cdba387f8a317b5b35adc96aa27ad63f1d1c08cf8b
vulnerabilities
size	222 MB
packages	213

📦 Base Image eclipse-temurin:17-jre

also known as	17-jre-jammy 17.0.11_9-jre 17.0.11_9-jre-jammy
digest	sha256:c9e02d480ed00720b66c7af626404858c2435ea3ffa6f1b20a9bf8b45f255f8d
vulnerabilities

krb5 1.19.2-2ubuntu0.3 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 9th percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 9th percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 9th percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

libgcrypt20 1.9.4-3ubuntu3 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 16th percentile Description A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

xz-utils 5.2.5-2ubuntu1 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.05% EPSS Percentile 22nd percentile Description ** DISPUTED ** An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.

wget 1.21.2-2ubuntu1.1 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 0.08% EPSS Percentile 36th percentile Description GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

openssl 3.0.2-0ubuntu1.16 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed Description Use After Free with SSL_free_buffers Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 11th percentile Description Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (p parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the -check option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 11th percentile Description Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

ncurses 6.3-2ubuntu0.1 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.05% EPSS Percentile 21st percentile Description NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 9th percentile Description ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.

pcre3 2:8.39-13ubuntu0.22.04.1 (deb) pkg:deb/ubuntu/pcre3@2:8.39-13ubuntu0.22.04.1?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 7.5 CVSS Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.37% EPSS Percentile 73rd percentile Description In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

gcc-12 12.3.0-1ubuntu1~22.04 (deb) pkg:deb/ubuntu/[email protected]~22.04?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.07% EPSS Percentile 32nd percentile Description libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

glibc 2.35-0ubuntu3.8 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.15% EPSS Percentile 52nd percentile Description sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

libpng1.6 1.6.37-3build5 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.05% EPSS Percentile 19th percentile Description A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a segmentation fault and denial of service in png_setup_paeth_row() function.

shadow 1:4.8.1-2ubuntu2.2 (deb) pkg:deb/ubuntu/shadow@1:4.8.1-2ubuntu2.2?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 3.3 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N EPSS Score 0.04% EPSS Percentile 16th percentile Description In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

libzstd 1.4.8+dfsg-3build1 (deb) pkg:deb/ubuntu/[email protected]%2Bdfsg-3build1?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.15% EPSS Percentile 51st percentile Description A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

coreutils 8.32-4.1ubuntu1.2 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 6.5 CVSS Vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N EPSS Score 0.04% EPSS Percentile 5th percentile Description chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

systemd 249.11-0ubuntu3.12 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.10% EPSS Percentile 43rd percentile Description A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

gnupg2 2.2.27-3ubuntu2.1 (deb) pkg:deb/ubuntu/[email protected]?os_distro=jammy&os_name=ubuntu&os_version=22.04 Affected range >=0 Fixed version Not Fixed CVSS Score 3.3 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.05% EPSS Percentile 17th percentile Description GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.