Skip to content

Commit 05c7cf5

Browse files
actions-useractions-user
committed
chore: update security scan results
 - Updated scan data from workflow run 15 - Scan mode: git-only - Total scanned: 46 - Total vulnerabilities: 275
1 parent 020e9b4 commit 05c7cf5

39 files changed

+189
-84
lines changed

‎data/master-bfe5caf58f.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "master-bfe5caf58f",
3-
"scan_date": "2025-07-21T00:31:14.804140Z",
3+
"scan_date": "2025-07-22T00:27:47.082727Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [

‎data/release_v5.0-d9f9b7d8ed.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "release/v5.0-d9f9b7d8ed",
3-
"scan_date": "2025-07-21T00:30:24.552397Z",
3+
"scan_date": "2025-07-22T00:26:59.794376Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [

‎data/release_v5.1-83f5d0eefc.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "release/v5.1-83f5d0eefc",
3-
"scan_date": "2025-07-21T00:30:43.728085Z",
3+
"scan_date": "2025-07-22T00:27:39.041259Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [],

‎data/release_v5.2-1a4fd9b80b.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "release/v5.2-1a4fd9b80b",
3-
"scan_date": "2025-07-21T00:30:34.614122Z",
3+
"scan_date": "2025-07-22T00:27:15.958304Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [],

‎data/release_v5.3-bf79937908.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "release/v5.3-bf79937908",
3-
"scan_date": "2025-07-21T00:31:04.490254Z",
3+
"scan_date": "2025-07-22T00:27:31.930641Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [

‎data/release_v5.4-f10ac3eec2.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "release/v5.4-f10ac3eec2",
3-
"scan_date": "2025-07-21T00:30:14.731518Z",
3+
"scan_date": "2025-07-22T00:27:08.446635Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [

‎data/release_v5.5-25c7c11970.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"release_version": "release/v5.5-25c7c11970",
3+
"scan_date": "2025-07-22T00:27:24.120953Z",
4+
"tool_version": "0.20.1",
5+
"total_components": 0,
6+
"vulnerabilities": [
7+
{
8+
"cve_id": "CVE-2025-49600",
9+
"component": "mbed_tls",
10+
"component_version": "3.6.3",
11+
"severity": "MEDIUM",
12+
"score": "4.9",
13+
"vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
14+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault injection against the accelerator to bypass verification.",
15+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49600"
16+
},
17+
{
18+
"cve_id": "CVE-2025-49601",
19+
"component": "mbed_tls",
20+
"component_version": "3.6.3",
21+
"severity": "MEDIUM",
22+
"score": "4.8",
23+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
24+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls_lms_import_public_key allows context-dependent attackers to trigger a crash or limited adjacent-memory disclosure by supplying a truncated LMS (Leighton-Micali Signature) public-key buffer under four bytes. An LMS public key starts with a 4-byte type indicator. The function mbedtls_lms_import_public_key reads this type indicator before validating the size of its input.",
25+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49601"
26+
},
27+
{
28+
"cve_id": "CVE-2025-52497",
29+
"component": "mbed_tls",
30+
"component_version": "3.6.3",
31+
"severity": "MEDIUM",
32+
"score": "4.8",
33+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
34+
"description": "Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.",
35+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-52497"
36+
}
37+
],
38+
"summary": {
39+
"total_vulnerabilities": 3,
40+
"by_severity": {
41+
"CRITICAL": 0,
42+
"HIGH": 0,
43+
"MEDIUM": 3,
44+
"LOW": 0
45+
}
46+
},
47+
"metadata": {
48+
"scanner": "esp-idf-security-dashboard",
49+
"scan_method": "git-release-branch",
50+
"docker_image": null
51+
}
52+
}

‎data/scan_summary.json‎

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,57 @@
11
{
2-
"last_updated": "2025-07-21T00:31:14.804582Z",
2+
"last_updated": "2025-07-22T00:27:47.083279Z",
33
"scanned_versions": [
4-
"v5.0.7",
5-
"v5.1",
6-
"v5.1.3",
4+
"v5.4",
5+
"v5.0.8",
76
"v5.2",
8-
"v5.1.2",
97
"v5.0.5",
10-
"v5.4.2",
11-
"v5.0.2",
12-
"v5.0.3",
13-
"v5.0.6",
8+
"v5.1.6",
9+
"v5.1.4",
10+
"v5.1.2",
1411
"v5.3.2",
15-
"v5.0.9",
16-
"v5.2.4",
12+
"v5.0.2",
13+
"v5.1",
1714
"v5.3",
15+
"v5.4.1",
16+
"v5.5",
1817
"v5.3.3",
19-
"v5.4",
20-
"v5.0.4",
21-
"v5.1.4",
18+
"v5.2.4",
19+
"v5.0.7",
20+
"v5.4.2",
2221
"v5.3.1",
23-
"v5.2.1",
2422
"v5.2.3",
25-
"v5.2.5",
26-
"v5.1.6",
27-
"v5.1.1",
23+
"v5.0.9",
24+
"v5.2.1",
25+
"v5.2.2",
26+
"v5.0.4",
27+
"v5.1.3",
2828
"v5.0.1",
2929
"v5.1.5",
30-
"v5.2.2",
31-
"v5.0.8",
30+
"v5.1.1",
31+
"v5.0.3",
3232
"v5.0",
33-
"v5.4.1",
34-
"release/v5.4-f10ac3eec2",
33+
"v5.0.6",
34+
"v5.2.5",
3535
"release/v5.0-d9f9b7d8ed",
36+
"release/v5.4-f10ac3eec2",
3637
"release/v5.2-1a4fd9b80b",
37-
"release/v5.1-83f5d0eefc",
38-
"release/v5.5-cf8dad0746",
38+
"release/v5.5-25c7c11970",
3939
"release/v5.3-bf79937908",
40+
"release/v5.1-83f5d0eefc",
4041
"master-bfe5caf58f"
4142
],
4243
"failed_versions": [
43-
"release/v5.4",
4444
"release/v5.0",
45+
"release/v5.4",
4546
"release/v5.2",
46-
"release/v5.1",
4747
"release/v5.5",
4848
"release/v5.3",
49+
"release/v5.1",
4950
"master"
5051
],
51-
"total_scanned": 37,
52+
"total_scanned": 38,
5253
"scan_method": "git-batch",
53-
"workflow_run": "14",
54+
"workflow_run": "15",
5455
"scanner_info": {
5556
"tool": "esp-idf-security-dashboard",
5657
"esp_idf_sbom_version": "0.20.1",

‎data/v5.0.1.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "v5.0.1",
3-
"scan_date": "2025-07-21T00:29:20.557244Z",
3+
"scan_date": "2025-07-22T00:26:18.813161Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [],

‎data/v5.0.2.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "v5.0.2",
3-
"scan_date": "2025-07-21T00:26:48.996075Z",
3+
"scan_date": "2025-07-22T00:24:25.424455Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [],

0 commit comments

Comments
 (0)