Repository navigation
[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/agent:0.27.44 #51020
Description
Summary
Image: ghcr.io/github/gh-aw-firewall/agent:0.27.44
- Vulnerabilities: 0 Critical / 4 High / 285 Medium / 64 Low / 19 Negligible
- License policy violations: 211
Vulnerabilities
High
GHSA-rgw5-rvv9-x895:brace-expansion@5.0.7(fix: 5.0.9)GHSA-mh99-v99m-4gvg:brace-expansion@5.0.7(fix: 5.0.8)GHSA-mwp4-54f8-5fhr:ip-address@10.2.0(fix: 10.3.1)CVE-2026-58043:node@22.23.1(no fix version listed by Grype yet)
Medium (285), Low (64), Negligible (19) — full list
Predominantly base-layer (Ubuntu 22.04) packages: bind9-libs@1:9.18.39-0ubuntu0.22.04.4 (16 CVEs, e.g. CVE-2023-50387, CVE-2023-50868, CVE-2024-12705, CVE-2024-11187, CVE-2025-8677, CVE-2024-0760, CVE-2023-2828, CVE-2024-1975, CVE-2024-1737, CVE-2026-5946, CVE-2022-2795, CVE-2026-1519, CVE-2023-4408, CVE-2026-3039, CVE-2026-3104, CVE-2026-3119, CVE-2025-40778, CVE-2026-5950), libpython3.10*/python3.10*@3.10.12-1~22.04.16 (CVE-2026-7210, CVE-2026-11940, CVE-2026-15308, CVE-2020-10735), perl*@5.34.0-3ubuntu1.7 (CVE-2023-31486), libcurl*/curl@7.81.0-1ubuntu1.25 (CVE-2026-11856), php8.1-*@8.1.2-1ubuntu2.25 (CVE-2017-7189), libcairo2@1.16.0-5ubuntu2.1 (CVE-2017-7475, CVE-2018-18064), libtiff5@4.3.0-6ubuntu0.13 (CVE-2026-4775), git/git-man@1:2.34.1-1ubuntu1.17 (CVE-2018-1000021), libncurses6/libncursesw6/libtinfo6/ncurses-base/ncurses-bin@6.3-2ubuntu0.2 (CVE-2023-50495), libexpat1@2.4.7-1ubuntu0.7 (CVE-2025-59375), libzstd1@1.4.8+dfsg-3build1 (CVE-2022-4899), libjpeg-turbo8@2.1.2-0ubuntu1 (CVE-2018-10126), libpcre2-8-0@10.39-3ubuntu0.1 (CVE-2022-41409), libgcrypt20@1.9.4-3ubuntu3.2 (CVE-2024-2236), libpixman-1-0@0.40.0-1ubuntu0.22.04.1 (CVE-2023-37769), and many more inherited from the Ubuntu 22.04 base image. Full raw scan output available in the workflow run artifacts.
License Policy Violations
211 violations, dominated by standard OS base-layer GPL/LGPL-family packages (e.g. GPL-2.0-only, GPL-2.0-or-later: 12 packages; combined GPL-3.0/LGPL bundles: 11 packages) plus 14 packages with no licenses found, including:
Packages with no licenses found (14)
libcrypt1@1:4.4.27-1logsave@1.46.5-2ubuntu1.2libgmp10@2:6.2.1+dfsg-3ubuntu1e2fsprogs@1.46.5-2ubuntu1.2libnfnetlink0@1.0.1-3build3libpam-modules-bin@1.4.0-11ubuntu2.7libpam0g@1.4.0-11ubuntu2.7node@22.23.1netbase@6.3libpam-modules@1.4.0-11ubuntu2.7libpam-runtime@1.4.0-11ubuntu2.7debianutils@5.5-1ubuntu2libext2fs2@1.46.5-2ubuntu1.2usrmerge@25ubuntu2
Remediation
- Rebuild the image against a newer Ubuntu 22.04 base layer / apply
apt-get upgradeforbind9-libs,python3.10*,perl*,curl/libcurl*,php8.1-*to pick up the referenced Medium/Low fixes where available upstream. - Bump
nodebeyond 22.23.1 and upgradebrace-expansionandip-addressnpm dependencies to the fixed versions (5.0.9/5.0.8 and 10.3.1 respectively) to close the 4 High-severity findings. - Track
CVE-2026-58043innode@22.23.1— no fixed version currently published by Grype's feed; monitor Node.js security releases. - Review the license-policy allowlist for standard GPL/LGPL Ubuntu base packages (bind, perl, e2fsprogs, pam, etc.) — most are expected OS components; treat as policy-tuning rather than remediation.
- Investigate the 14 "no licenses found" packages individually; most are Debian/Ubuntu native packages whose license metadata Grant cannot detect (e.g.
libpam*,e2fsprogs), butnode@22.23.1should have its license explicitly recorded/allowlisted.
Generated by 🛡️ Daily Container Image Security Scan · auto · 229 AIC · ⌖ 2.79 AIC · ⊞ 6.4K · ◷
Activity
github-actions commentedon Aug 7, 2026
🍪 Issue Monster selected this for Copilot
I’ve identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪