[security][CVE-2025-69720] ncurses in runtime base images #152

Open
opened 2026-07-20 13:20:59 +00:00 by dirtydishes · 0 comments
Owner

Active newly untracked high CVE detected in the deployment/runtime surface used by this repo.

  • CVE: CVE-2025-69720
  • Affected component: ncurses in runtime base images used by deployment/docker/Dockerfile.service, deployment/docker/Dockerfile.web, and deployment/docker/Dockerfile.ingest-options, plus the redis:7.2 runtime in deployment/docker/docker-compose.yml
  • Affected in-image package/version:
    • oven/bun:1.3.11 -> Debian 13.4 packages libtinfo6 6.5+20250216-2, ncurses-base 6.5+20250216-2, ncurses-bin 6.5+20250216-2
    • redis:7.2 -> Debian 12.15 packages libtinfo6 6.4-4, ncurses-base 6.4-4, ncurses-bin 6.4-4
  • Severity: High
  • Score: CVSS 7.8
  • Published: 2026-03-19T15:16:21.293Z
  • Status: active, affected

Project impact:
Islandflow ships the vulnerable ncurses tooling inside both Bun-based app containers and the Redis runtime image. The vulnerable path is the infocmp command's analyze_string() handling rather than a network-facing daemon, so this is not directly exposed through normal request handling. It still matters because the vulnerable packages are present in shipped runtime images and could be exercised during debugging, maintenance, or any container-side workflow that invokes ncurses tooling on attacker-controlled input.

Remediation guidance:

  • Refresh to Bun/Redis image tags or digests only after verifying they no longer include vulnerable ncurses packages.
  • Upstream fixed ncurses before 6.5-20251213; in practice that means waiting for or choosing base images that pick up patched distro packages.
  • If an immediate image refresh is unavailable, avoid invoking infocmp or related ncurses tooling on untrusted terminal-description input inside these containers.

Counters from this run:

  • unaddressed critical CVEs: 3
  • unaddressed medium/low CVEs: 63
  • unaddressed total CVEs: 74

Sources:

Active newly untracked high CVE detected in the deployment/runtime surface used by this repo. - CVE: CVE-2025-69720 - Affected component: `ncurses` in runtime base images used by `deployment/docker/Dockerfile.service`, `deployment/docker/Dockerfile.web`, and `deployment/docker/Dockerfile.ingest-options`, plus the `redis:7.2` runtime in `deployment/docker/docker-compose.yml` - Affected in-image package/version: - `oven/bun:1.3.11` -> Debian 13.4 packages `libtinfo6 6.5+20250216-2`, `ncurses-base 6.5+20250216-2`, `ncurses-bin 6.5+20250216-2` - `redis:7.2` -> Debian 12.15 packages `libtinfo6 6.4-4`, `ncurses-base 6.4-4`, `ncurses-bin 6.4-4` - Severity: High - Score: CVSS 7.8 - Published: 2026-03-19T15:16:21.293Z - Status: active, affected Project impact: Islandflow ships the vulnerable ncurses tooling inside both Bun-based app containers and the Redis runtime image. The vulnerable path is the `infocmp` command's `analyze_string()` handling rather than a network-facing daemon, so this is not directly exposed through normal request handling. It still matters because the vulnerable packages are present in shipped runtime images and could be exercised during debugging, maintenance, or any container-side workflow that invokes ncurses tooling on attacker-controlled input. Remediation guidance: - Refresh to Bun/Redis image tags or digests only after verifying they no longer include vulnerable ncurses packages. - Upstream fixed ncurses before `6.5-20251213`; in practice that means waiting for or choosing base images that pick up patched distro packages. - If an immediate image refresh is unavailable, avoid invoking `infocmp` or related ncurses tooling on untrusted terminal-description input inside these containers. Counters from this run: - unaddressed critical CVEs: 3 - unaddressed medium/low CVEs: 63 - unaddressed total CVEs: 74 Sources: - https://nvd.nist.gov/vuln/detail/CVE-2025-69720 - https://security-tracker.debian.org/tracker/CVE-2025-69720 - https://github.com/advisories/GHSA-9952-mrqj-h4jh
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
dirtydishes/islandflow#152
No description provided.