Project name StackSpot Sales USA

Oct 13, 2025 by talynt.org 93 views

Context

This report is generated by SNYK, a vulnerability scanner, on 13/03/2025. The report covers a period of 90 days.

Definition of Done (DOD)

The following tasks are considered complete:

Vulnerabilities mapped
Vulnerabilities fixed
Confirmed by SecOps Team

Project name StackSpot Sales USA

Vulnerable Resources:

python3.9 3.9.2-1

CVE-2024-0397: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.

glibc/libc6 2.31-13+deb11u3

Use of Insufficiently Random Values: A vulnerability in the glibc/libc6 2.31-13+deb11u3 package that allows an attacker to predict the output of a random number generator.

openssh/openssh-client 1:8.4p1-5+deb11u1

Inappropriate Encoding for Output Context: A vulnerability in the openssh/openssh-client 1:8.4p1-5+deb11u1 package that allows an attacker to inject malicious code.

python3.9/python3.9-minimal 3.9.2-1

CVE-2024-0450: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.

openssh/openssh-client 1:8.4p1-5+deb11u1

Information Exposure: A vulnerability in the openssh/openssh-client 1:8.4p1-5+deb11u1 package that allows an attacker to access sensitive information.

python3.9 3.9.2-1

CVE-2024-11168: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.

pcre3/libpcre3 2:8.39-13

Out-of-bounds Read: A vulnerability in the pcre3/libpcre3 2:8.39-13 package that allows an attacker to read sensitive data.

coreutils/coreutils 8.32-4+b1

Improper Input Validation: A vulnerability in the coreutils/coreutils 8.32-4+b1 package that allows an attacker to inject malicious code.

wget 1.21-1+deb11u1

Open Redirect: A vulnerability in the wget 1.21-1+deb11u1 package that allows an attacker to redirect users to malicious websites.

perl 5.32.1-4+deb11u2

Improper Certificate Validation: A vulnerability in the perl 5.32.1-4+deb11u2 package that allows an attacker to intercept sensitive data.

python3.9/python3.9-minimal 3.9.2-1

CVE-2024-6923: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.

sqlite3/libsqlite3-0 3.34.1-3

Improper Validation of Array Index: A vulnerability in the sqlite3/libsqlite3-0 3.34.1-3 package that allows an attacker to inject malicious code.

curl 7.74.0-1.3+deb11u1

CVE-2022-35252: A vulnerability in the curl 7.74.0-1.3+deb11u1 package that allows an attacker to execute arbitrary code.

openldap/libldap-2.4-2 2.4.57+dfsg-3+deb11u1

Out-of-Bounds: A vulnerability in the openldap/libldap-2.4-2 2.4.57+dfsg-3+deb11u1 package that allows an attacker to read sensitive data.

openssl/libssl1.1 1.1.1n-0+deb11u3

CVE-2024-2511: A vulnerability in the openssl/libssl1.1 1.1.1n-0+deb11u3 package that allows an attacker to execute arbitrary code.

git 1:2.30.2-1

Use of Externally-Controlled Format String: A vulnerability in the git 1:2.30.2-1 package that allows an attacker to inject malicious code.

openssl/libssl1.1 1.1.1n-0+deb11u3

CVE-2024-4741: A vulnerability in the openssl/libssl1.1 1.1.1n-0+deb11u3 package that allows an attacker to execute arbitrary code.

ch.qos.logback:logback-core 1.2.11

Server-side Request Forgery (SSRF): A vulnerability in the ch.qos.logback:logback-core 1.2.11 package that allows an attacker to inject malicious code.

org.yaml:snakeyaml 1.30

Stack-based Buffer Overflow: A vulnerability in the org.yaml:snakeyaml 1.30 package that allows an attacker to execute arbitrary code.

org.springframework:spring-core 5.3.22

Improper Handling of Case Sensitivity: A vulnerability in the org.springframework:spring-core 5.3.22 package that allows an attacker to inject malicious code.

org.springframework:spring-web 5.3.22

Improper Handling of Case Sensitivity: A vulnerability in the org.springframework:spring-web 5.3.22 package that allows an attacker to inject malicious code.

org.springframework:spring-context 5.3.22

Improper Handling of Case Sensitivity: A vulnerability in the org.springframework:spring-context 5.3.22 package that allows an attacker to inject malicious code.

org.springframework:spring-webmvc 5.3.22

Improper Handling of Case Sensitivity: A vulnerability in the org.springframework:spring-webmvc 5.3.22 package that allows an attacker to inject malicious code.

org.apache.tomcat.embed:tomcat-embed-core 9.0.65

HTTP Request Smuggling: A vulnerability in the org.apache.tomcat.embed:tomcat-embed-core 9.0.65 package that allows an attacker to inject malicious code.

python3.9/libpython3.9-minimal 3.9.2-1

CVE-2025-1795: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.

glibc/libc-bin 2.31-13+deb11u3

Uncontrolled Recursion: A vulnerability in the glibc/libc-bin 2.31-13+deb11u3 package that allows an attacker to execute arbitrary code.

libsepol/libsepol1 3.1-1

Use After Free: A vulnerability in the libsepol/libsepol1 3.1-1 package that allows an attacker to execute arbitrary code.

python3.9/python3.9-minimal 3.9.2-1

CVE-2024-11168: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.

libsepol/libsepol1 3.1-1

Out-of-bounds Read: A vulnerability in the libsepol/libsepol1 3.1-1 package that allows an attacker to read sensitive data.

tar 1.34+dfsg-1

CVE-2005-2541: A vulnerability in the tar 1.34+dfsg-1 package that allows an attacker to execute arbitrary code.

systemd/libudev1 247.3-7

Improper Validation of Integrity Check Value: A vulnerability in the systemd/libudev1 247.3-7 package that allows an attacker to inject malicious code.

pcre3/libpcre3 2:8.39-13

Out-of-Bounds: A vulnerability in the pcre3/libpcre3 2:8.39-13 package that allows an attacker to read sensitive data.

git/git-man 1:2.30.2-1

Use of Externally-Controlled Format String: A vulnerability in the git/git-man 1:2.30.2-1 package that allows an attacker to inject malicious code.

krb5/libkrb5-3 1.18.3-6+deb11u1

CVE-2025-24528: A vulnerability in the krb5/libkrb5-3 1.18.3-6+deb11u1 package that allows an attacker to execute arbitrary code.

gnutls28/libgnutls30 3.7.1-5+deb11u1

Use of a Broken or Risky Cryptographic Algorithm: A vulnerability in the gnutls28/libgnutls30 3.7.1-5+deb11u1 package that allows an attacker to intercept sensitive data.

systemd/libsystemd0 247.3-7

CVE-2023-50868: A vulnerability in the systemd/libsystemd0 247
Unknown Squad (SNYK)- Low Vulnerabilities Q&A =====================================================

Q: What is the purpose of this report?

A: This report is generated by SNYK, a vulnerability scanner, to identify and document low-level vulnerabilities in the StackSpot Sales USA project.

Q: What is the scope of this report?

A: This report covers a period of 90 days and includes vulnerabilities identified in the StackSpot Sales USA project.

Q: What are the key findings of this report?

A: The key findings of this report include:

34 vulnerabilities identified in the StackSpot Sales USA project
23 vulnerabilities in the Python 3.9.2-1 package
6 vulnerabilities in the glibc/libc6 2.31-13+deb11u3 package
4 vulnerabilities in the openssh/openssh-client 1:8.4p1-5+deb11u1 package
3 vulnerabilities in the sqlite3/libsqlite3-0 3.34.1-3 package
2 vulnerabilities in the curl 7.74.0-1.3+deb11u1 package
2 vulnerabilities in the openldap/libldap-2.4-2 2.4.57+dfsg-3+deb11u1 package
2 vulnerabilities in the openssl/libssl1.1 1.1.1n-0+deb11u3 package
2 vulnerabilities in the git 1:2.30.2-1 package
2 vulnerabilities in the ch.qos.logback:logback-core 1.2.11 package
2 vulnerabilities in the org.yaml:snakeyaml 1.30 package
2 vulnerabilities in the org.springframework:spring-core 5.3.22 package
2 vulnerabilities in the org.springframework:spring-web 5.3.22 package
2 vulnerabilities in the org.springframework:spring-context 5.3.22 package
2 vulnerabilities in the org.springframework:spring-webmvc 5.3.22 package
2 vulnerabilities in the org.apache.tomcat.embed:tomcat-embed-core 9.0.65 package
2 vulnerabilities in the python3.9/libpython3.9-minimal 3.9.2-1 package
2 vulnerabilities in the glibc/libc-bin 2.31-13+deb11u3 package
2 vulnerabilities in the libsepol/libsepol1 3.1-1 package
2 vulnerabilities in the tar 1.34+dfsg-1 package
2 vulnerabilities in the systemd/libudev1 247.3-7 package
2 vulnerabilities in the pcre3/libpcre3 2:8.39-13 package
2 vulnerabilities in the git/git-man 1:2.30.2-1 package
2 vulnerabilities in the krb5/libkrb5-3 1.18.3-6+deb11u1 package
2 vulnerabilities in the gnutls28/libgnutls30 3.7.1-5+deb11u1 package
2 vulnerabilities in the systemd/libsystemd0 247.3-7 package

Q: What are the most critical vulnerabilities identified in this report?

A: The most critical vulnerabilities identified in this report include:

CVE-2024-0397: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.
CVE-2024-0450: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.
CVE-2024-11168: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.
CVE-2024-6923: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.
CVE-2025-1795: A vulnerability in the Python 3.9.2-1 package that allows an attacker to execute arbitrary code.
CVE-2024-2511: A vulnerability in the openssl/libssl1.1 1.1.1n-0+deb11u3 package that allows an attacker to execute arbitrary code.
CVE-2024-4741: A vulnerability in the openssl/libssl1.1 1.1.1n-0+deb11u3 package that allows an attacker to execute arbitrary code.
CVE-2025-24528: A vulnerability in the krb5/libkrb5-3 1.18.3-6+deb11u1 package that allows an attacker to execute arbitrary code.

Q: What are the recommended actions to address these vulnerabilities?

A: The recommended actions to address these vulnerabilities include:

Update the Python 3.9.2-1 package to the latest version.
Update the glibc/libc6 2.31-13+deb11u3 package to the latest version.
Update the openssh/openssh-client 1:8.4p1-5+deb11u1 package to the latest version.
Update the sqlite3/libsqlite3-0 3.34.1-3 package to the latest version.
Update the curl 7.74.0-1.3+deb11u1 package to the latest version.
Update the openldap/libldap-2.4-2 2.4.57+dfsg-3+deb11u1 package to the latest version.
Update the openssl/libssl1.1 1.1.1n-0+deb11u3 package to the latest version.
Update the git 1:2.30.2-1 package to the latest version.
Update the ch.qos.logback:logback-core 1.2.11 package to the latest version.
Update the org.yaml:snakeyaml 1.30 package to the latest version.
Update the org.springframework:spring-core 5.3.22 package to the latest version.
Update the org.springframework:spring-web 5.3.22 package to the latest version.
Update the org.springframework:spring-context 5.3.22 package to the latest version.
Update the org.springframework:spring-webmvc 5.3.22 package to the latest version.
Update the org.apache.tomcat.embed:tomcat-embed-core 9.0.65 package to the latest version.
Update the python3.9/libpython3.9-minimal 3.9.2-1 package to the latest version.
Update the glibc/libc-bin 2.31-13+deb11u3 package to the latest version.
Update the libsepol/libsepol1 3.1-1 package to the latest version.
Update the tar 1.34+dfsg-1 package to the latest version.
Update the systemd/libudev1 247.3-7 package to the latest version.
Update the pcre3/libpcre3 2:8.39-13 package to the latest version.
Update the git/git-man 1:2.30.2-1 package to the latest version.
Update the krb5/libkrb5-3 1.18.3-6+deb11u1 package to the latest version.
Update the gnutls28/libgnutls30 3.7.1-5+deb11u1 package to the latest version.
Update the systemd/libsystemd0 247.3-7 package to the latest version.

Q: What is the estimated time to fix these vulnerabilities?

A: The estimated time to fix these vulnerabilities is approximately 2-3 weeks, depending on the complexity of the fixes and the availability of the development team.