Skip to content

Commit c609ec0

Browse files
zhuofuAMZzhuofuAMZ
authored
Allowlist libxml2 as no remidation provided (#4765)
1 parent 576b439 commit c609ec0

File tree

3 files changed

+60
-104
lines changed

3 files changed

+60
-104
lines changed

‎data/common-ecr-scan-allowlist.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -238,5 +238,65 @@
238238
"title": "CVE-2025-32434 - torch",
239239
"reason_to_ignore": "this container is specifically pytorch 2.5.x so we can’t upgrade to 2.6"
240240
}
241+
],
242+
"libxml2": [
243+
{
244+
"description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.",
245+
"vulnerability_id": "CVE-2025-32415",
246+
"name": "CVE-2025-32415",
247+
"package_name": "libxml2",
248+
"package_details": {
249+
"file_path": null,
250+
"name": "libxml2",
251+
"package_manager": "OS",
252+
"version": "2.9.13+dfsg",
253+
"release": "1ubuntu0.6"
254+
},
255+
"remediation": {
256+
"recommendation": {
257+
"text": "None Provided"
258+
}
259+
},
260+
"cvss_v3_score": 7.5,
261+
"cvss_v30_score": 0.0,
262+
"cvss_v31_score": 7.5,
263+
"cvss_v2_score": 0.0,
264+
"cvss_v3_severity": "HIGH",
265+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-32415.html",
266+
"source": "UBUNTU_CVE",
267+
"severity": "HIGH",
268+
"status": "ACTIVE",
269+
"title": "CVE-2025-32415 - libxml2",
270+
"reason_to_ignore": "N/A"
271+
},
272+
{
273+
"description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.",
274+
"vulnerability_id": "CVE-2025-32414",
275+
"name": "CVE-2025-32414",
276+
"package_name": "libxml2",
277+
"package_details": {
278+
"file_path": null,
279+
"name": "libxml2",
280+
"package_manager": "OS",
281+
"version": "2.9.13+dfsg",
282+
"release": "1ubuntu0.6"
283+
},
284+
"remediation": {
285+
"recommendation": {
286+
"text": "None Provided"
287+
}
288+
},
289+
"cvss_v3_score": 7.5,
290+
"cvss_v30_score": 0.0,
291+
"cvss_v31_score": 7.5,
292+
"cvss_v2_score": 0.0,
293+
"cvss_v3_severity": "HIGH",
294+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-32414.html",
295+
"source": "UBUNTU_CVE",
296+
"severity": "HIGH",
297+
"status": "ACTIVE",
298+
"title": "CVE-2025-32414 - libxml2",
299+
"reason_to_ignore": "N/A"
300+
}
241301
]
242302
}

‎pytorch/training/docker/2.5/py3/Dockerfile.sagemaker.cpu.os_scan_allowlist.json‎

Lines changed: 0 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -250,57 +250,5 @@
250250
"title": "CVE-2024-37059 - mlflow",
251251
"reason_to_ignore": "N/A"
252252
}
253-
],
254-
"libxml2": [
255-
{
256-
"description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.",
257-
"vulnerability_id": "CVE-2025-32415",
258-
"name": "CVE-2025-32415",
259-
"package_name": "libxml2",
260-
"package_details": {
261-
"file_path": null,
262-
"name": "libxml2",
263-
"package_manager": "OS",
264-
"version": "2.9.13+dfsg",
265-
"release": "1ubuntu0.6"
266-
},
267-
"remediation": { "recommendation": { "text": "None Provided" } },
268-
"cvss_v3_score": 7.5,
269-
"cvss_v30_score": 0.0,
270-
"cvss_v31_score": 7.5,
271-
"cvss_v2_score": 0.0,
272-
"cvss_v3_severity": "HIGH",
273-
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-32415.html",
274-
"source": "UBUNTU_CVE",
275-
"severity": "HIGH",
276-
"status": "ACTIVE",
277-
"title": "CVE-2025-32415 - libxml2",
278-
"reason_to_ignore": "N/A"
279-
},
280-
{
281-
"description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.",
282-
"vulnerability_id": "CVE-2025-32414",
283-
"name": "CVE-2025-32414",
284-
"package_name": "libxml2",
285-
"package_details": {
286-
"file_path": null,
287-
"name": "libxml2",
288-
"package_manager": "OS",
289-
"version": "2.9.13+dfsg",
290-
"release": "1ubuntu0.6"
291-
},
292-
"remediation": { "recommendation": { "text": "None Provided" } },
293-
"cvss_v3_score": 7.5,
294-
"cvss_v30_score": 0.0,
295-
"cvss_v31_score": 7.5,
296-
"cvss_v2_score": 0.0,
297-
"cvss_v3_severity": "HIGH",
298-
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-32414.html",
299-
"source": "UBUNTU_CVE",
300-
"severity": "HIGH",
301-
"status": "ACTIVE",
302-
"title": "CVE-2025-32414 - libxml2",
303-
"reason_to_ignore": "N/A"
304-
}
305253
]
306254
}

‎pytorch/training/docker/2.5/py3/cu124/Dockerfile.sagemaker.gpu.os_scan_allowlist.json‎

Lines changed: 0 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1139,57 +1139,5 @@
11391139
"title": "CVE-2024-45337 - golang.org/x/crypto",
11401140
"reason_to_ignore": "N/A"
11411141
}
1142-
],
1143-
"libxml2": [
1144-
{
1145-
"description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.",
1146-
"vulnerability_id": "CVE-2025-32415",
1147-
"name": "CVE-2025-32415",
1148-
"package_name": "libxml2",
1149-
"package_details": {
1150-
"file_path": null,
1151-
"name": "libxml2",
1152-
"package_manager": "OS",
1153-
"version": "2.9.13+dfsg",
1154-
"release": "1ubuntu0.6"
1155-
},
1156-
"remediation": { "recommendation": { "text": "None Provided" } },
1157-
"cvss_v3_score": 7.5,
1158-
"cvss_v30_score": 0.0,
1159-
"cvss_v31_score": 7.5,
1160-
"cvss_v2_score": 0.0,
1161-
"cvss_v3_severity": "HIGH",
1162-
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-32415.html",
1163-
"source": "UBUNTU_CVE",
1164-
"severity": "HIGH",
1165-
"status": "ACTIVE",
1166-
"title": "CVE-2025-32415 - libxml2",
1167-
"reason_to_ignore": "N/A"
1168-
},
1169-
{
1170-
"description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.",
1171-
"vulnerability_id": "CVE-2025-32414",
1172-
"name": "CVE-2025-32414",
1173-
"package_name": "libxml2",
1174-
"package_details": {
1175-
"file_path": null,
1176-
"name": "libxml2",
1177-
"package_manager": "OS",
1178-
"version": "2.9.13+dfsg",
1179-
"release": "1ubuntu0.6"
1180-
},
1181-
"remediation": { "recommendation": { "text": "None Provided" } },
1182-
"cvss_v3_score": 7.5,
1183-
"cvss_v30_score": 0.0,
1184-
"cvss_v31_score": 7.5,
1185-
"cvss_v2_score": 0.0,
1186-
"cvss_v3_severity": "HIGH",
1187-
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-32414.html",
1188-
"source": "UBUNTU_CVE",
1189-
"severity": "HIGH",
1190-
"status": "ACTIVE",
1191-
"title": "CVE-2025-32414 - libxml2",
1192-
"reason_to_ignore": "N/A"
1193-
}
11941142
]
11951143
}

0 commit comments

Comments
 (0)