[security][CVE-2025-69720] ncurses in runtime base images #152
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Active newly untracked high CVE detected in the deployment/runtime surface used by this repo.
ncursesin runtime base images used bydeployment/docker/Dockerfile.service,deployment/docker/Dockerfile.web, anddeployment/docker/Dockerfile.ingest-options, plus theredis:7.2runtime indeployment/docker/docker-compose.ymloven/bun:1.3.11-> Debian 13.4 packageslibtinfo6 6.5+20250216-2,ncurses-base 6.5+20250216-2,ncurses-bin 6.5+20250216-2redis:7.2-> Debian 12.15 packageslibtinfo6 6.4-4,ncurses-base 6.4-4,ncurses-bin 6.4-4Project impact:
Islandflow ships the vulnerable ncurses tooling inside both Bun-based app containers and the Redis runtime image. The vulnerable path is the
infocmpcommand'sanalyze_string()handling rather than a network-facing daemon, so this is not directly exposed through normal request handling. It still matters because the vulnerable packages are present in shipped runtime images and could be exercised during debugging, maintenance, or any container-side workflow that invokes ncurses tooling on attacker-controlled input.Remediation guidance:
6.5-20251213; in practice that means waiting for or choosing base images that pick up patched distro packages.infocmpor related ncurses tooling on untrusted terminal-description input inside these containers.Counters from this run:
Sources: