Skip to content

Commit 6632c3e

Browse files
actions-useractions-user
committed
chore: update security scan results
 - Updated scan data from workflow run 7 - Scan mode: git-only - Total scanned: 42 - Total vulnerabilities: 260
1 parent f798f31 commit 6632c3e

37 files changed

+1268
-155
lines changed

‎data/release_v5.0-d9f9b7d8ed.json‎

Lines changed: 35 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,46 @@
11
{
22
"release_version": "release/v5.0-d9f9b7d8ed",
3-
"scan_date": "2025-07-17T00:29:07.646483Z",
3+
"scan_date": "2025-07-18T00:28:47.611912Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
6-
"vulnerabilities": [],
6+
"vulnerabilities": [
7+
{
8+
"cve_id": "CVE-2025-49600",
9+
"component": "mbed_tls",
10+
"component_version": "3.6.3",
11+
"severity": "MEDIUM",
12+
"score": "4.9",
13+
"vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
14+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault injection against the accelerator to bypass verification.",
15+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49600"
16+
},
17+
{
18+
"cve_id": "CVE-2025-49601",
19+
"component": "mbed_tls",
20+
"component_version": "3.6.3",
21+
"severity": "MEDIUM",
22+
"score": "4.8",
23+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
24+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls_lms_import_public_key allows context-dependent attackers to trigger a crash or limited adjacent-memory disclosure by supplying a truncated LMS (Leighton-Micali Signature) public-key buffer under four bytes. An LMS public key starts with a 4-byte type indicator. The function mbedtls_lms_import_public_key reads this type indicator before validating the size of its input.",
25+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49601"
26+
},
27+
{
28+
"cve_id": "CVE-2025-52497",
29+
"component": "mbed_tls",
30+
"component_version": "3.6.3",
31+
"severity": "MEDIUM",
32+
"score": "4.8",
33+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
34+
"description": "Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.",
35+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-52497"
36+
}
37+
],
738
"summary": {
8-
"total_vulnerabilities": 0,
39+
"total_vulnerabilities": 3,
940
"by_severity": {
1041
"CRITICAL": 0,
1142
"HIGH": 0,
12-
"MEDIUM": 0,
43+
"MEDIUM": 3,
1344
"LOW": 0
1445
}
1546
},

‎data/release_v5.1-700330da07.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "release/v5.1-700330da07",
3-
"scan_date": "2025-07-17T00:29:17.546214Z",
3+
"scan_date": "2025-07-18T00:29:17.434900Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [],

‎data/release_v5.2-1a4fd9b80b.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "release/v5.2-1a4fd9b80b",
3-
"scan_date": "2025-07-17T00:29:48.200845Z",
3+
"scan_date": "2025-07-18T00:29:08.797068Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [],

‎data/release_v5.3-bf79937908.json‎

Lines changed: 35 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,46 @@
11
{
22
"release_version": "release/v5.3-bf79937908",
3-
"scan_date": "2025-07-17T00:29:38.741084Z",
3+
"scan_date": "2025-07-18T00:28:27.675307Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
6-
"vulnerabilities": [],
6+
"vulnerabilities": [
7+
{
8+
"cve_id": "CVE-2025-49600",
9+
"component": "mbed_tls",
10+
"component_version": "3.6.3",
11+
"severity": "MEDIUM",
12+
"score": "4.9",
13+
"vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
14+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault injection against the accelerator to bypass verification.",
15+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49600"
16+
},
17+
{
18+
"cve_id": "CVE-2025-49601",
19+
"component": "mbed_tls",
20+
"component_version": "3.6.3",
21+
"severity": "MEDIUM",
22+
"score": "4.8",
23+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
24+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls_lms_import_public_key allows context-dependent attackers to trigger a crash or limited adjacent-memory disclosure by supplying a truncated LMS (Leighton-Micali Signature) public-key buffer under four bytes. An LMS public key starts with a 4-byte type indicator. The function mbedtls_lms_import_public_key reads this type indicator before validating the size of its input.",
25+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49601"
26+
},
27+
{
28+
"cve_id": "CVE-2025-52497",
29+
"component": "mbed_tls",
30+
"component_version": "3.6.3",
31+
"severity": "MEDIUM",
32+
"score": "4.8",
33+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
34+
"description": "Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.",
35+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-52497"
36+
}
37+
],
738
"summary": {
8-
"total_vulnerabilities": 0,
39+
"total_vulnerabilities": 3,
940
"by_severity": {
1041
"CRITICAL": 0,
1142
"HIGH": 0,
12-
"MEDIUM": 0,
43+
"MEDIUM": 3,
1344
"LOW": 0
1445
}
1546
},

‎data/release_v5.4-f10ac3eec2.json‎

Lines changed: 35 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,46 @@
11
{
22
"release_version": "release/v5.4-f10ac3eec2",
3-
"scan_date": "2025-07-17T00:28:57.260804Z",
3+
"scan_date": "2025-07-18T00:28:37.827074Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
6-
"vulnerabilities": [],
6+
"vulnerabilities": [
7+
{
8+
"cve_id": "CVE-2025-49600",
9+
"component": "mbed_tls",
10+
"component_version": "3.6.3",
11+
"severity": "MEDIUM",
12+
"score": "4.9",
13+
"vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
14+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault injection against the accelerator to bypass verification.",
15+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49600"
16+
},
17+
{
18+
"cve_id": "CVE-2025-49601",
19+
"component": "mbed_tls",
20+
"component_version": "3.6.3",
21+
"severity": "MEDIUM",
22+
"score": "4.8",
23+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
24+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls_lms_import_public_key allows context-dependent attackers to trigger a crash or limited adjacent-memory disclosure by supplying a truncated LMS (Leighton-Micali Signature) public-key buffer under four bytes. An LMS public key starts with a 4-byte type indicator. The function mbedtls_lms_import_public_key reads this type indicator before validating the size of its input.",
25+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49601"
26+
},
27+
{
28+
"cve_id": "CVE-2025-52497",
29+
"component": "mbed_tls",
30+
"component_version": "3.6.3",
31+
"severity": "MEDIUM",
32+
"score": "4.8",
33+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
34+
"description": "Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.",
35+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-52497"
36+
}
37+
],
738
"summary": {
8-
"total_vulnerabilities": 0,
39+
"total_vulnerabilities": 3,
940
"by_severity": {
1041
"CRITICAL": 0,
1142
"HIGH": 0,
12-
"MEDIUM": 0,
43+
"MEDIUM": 3,
1344
"LOW": 0
1445
}
1546
},

‎data/release_v5.5-cf8dad0746.json‎

Lines changed: 35 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,46 @@
11
{
22
"release_version": "release/v5.5-cf8dad0746",
3-
"scan_date": "2025-07-17T00:29:28.718540Z",
3+
"scan_date": "2025-07-18T00:28:58.785403Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
6-
"vulnerabilities": [],
6+
"vulnerabilities": [
7+
{
8+
"cve_id": "CVE-2025-49600",
9+
"component": "mbed_tls",
10+
"component_version": "3.6.3",
11+
"severity": "MEDIUM",
12+
"score": "4.9",
13+
"vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
14+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault injection against the accelerator to bypass verification.",
15+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49600"
16+
},
17+
{
18+
"cve_id": "CVE-2025-49601",
19+
"component": "mbed_tls",
20+
"component_version": "3.6.3",
21+
"severity": "MEDIUM",
22+
"score": "4.8",
23+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
24+
"description": "In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls_lms_import_public_key allows context-dependent attackers to trigger a crash or limited adjacent-memory disclosure by supplying a truncated LMS (Leighton-Micali Signature) public-key buffer under four bytes. An LMS public key starts with a 4-byte type indicator. The function mbedtls_lms_import_public_key reads this type indicator before validating the size of its input.",
25+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49601"
26+
},
27+
{
28+
"cve_id": "CVE-2025-52497",
29+
"component": "mbed_tls",
30+
"component_version": "3.6.3",
31+
"severity": "MEDIUM",
32+
"score": "4.8",
33+
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
34+
"description": "Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.",
35+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-52497"
36+
}
37+
],
738
"summary": {
8-
"total_vulnerabilities": 0,
39+
"total_vulnerabilities": 3,
940
"by_severity": {
1041
"CRITICAL": 0,
1142
"HIGH": 0,
12-
"MEDIUM": 0,
43+
"MEDIUM": 3,
1344
"LOW": 0
1445
}
1546
},

‎data/scan_summary.json‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,54 @@
11
{
2-
"last_updated": "2025-07-17T00:29:48.201261Z",
2+
"last_updated": "2025-07-18T00:29:17.435362Z",
33
"scanned_versions": [
4+
"v5.4.2",
5+
"v5.1.2",
6+
"v5.4.1",
7+
"v5.2.2",
8+
"v5.0.8",
9+
"v5.2",
10+
"v5.2.3",
11+
"v5.1.6",
12+
"v5.0.3",
413
"v5.2.4",
5-
"v5.0.4",
14+
"v5.0.1",
615
"v5.1.1",
7-
"v5.1",
16+
"v5.1.4",
817
"v5.2.1",
9-
"v5.0.5",
1018
"v5.3",
11-
"v5.2.3",
12-
"v5.2",
13-
"v5.1.3",
14-
"v5.0.7",
15-
"v5.3.2",
19+
"v5.0.5",
1620
"v5.0.2",
17-
"v5.4.1",
18-
"v5.1.5",
19-
"v5.1.6",
21+
"v5.3.2",
22+
"v5.1.3",
23+
"v5.4",
2024
"v5.2.5",
2125
"v5.3.3",
22-
"v5.0.6",
23-
"v5.1.4",
24-
"v5.1.2",
2526
"v5.3.1",
26-
"v5.2.2",
27-
"v5.4",
2827
"v5.0.9",
29-
"v5.0.3",
30-
"v5.0.8",
31-
"v5.4.2",
32-
"v5.0.1",
28+
"v5.0.4",
29+
"v5.1",
30+
"v5.0.7",
31+
"v5.0.6",
32+
"v5.1.5",
3333
"v5.0",
34+
"release/v5.3-bf79937908",
3435
"release/v5.4-f10ac3eec2",
3536
"release/v5.0-d9f9b7d8ed",
36-
"release/v5.1-700330da07",
3737
"release/v5.5-cf8dad0746",
38-
"release/v5.3-bf79937908",
39-
"release/v5.2-1a4fd9b80b"
38+
"release/v5.2-1a4fd9b80b",
39+
"release/v5.1-700330da07"
4040
],
4141
"failed_versions": [
42+
"release/v5.3",
4243
"release/v5.4",
4344
"release/v5.0",
44-
"release/v5.1",
4545
"release/v5.5",
46-
"release/v5.3",
47-
"release/v5.2"
46+
"release/v5.2",
47+
"release/v5.1"
4848
],
4949
"total_scanned": 36,
5050
"scan_method": "git-batch",
51-
"workflow_run": "6",
51+
"workflow_run": "7",
5252
"scanner_info": {
5353
"tool": "esp-idf-security-dashboard",
5454
"esp_idf_sbom_version": "0.20.1",

‎data/v5.0.1.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "v5.0.1",
3-
"scan_date": "2025-07-17T00:28:43.982600Z",
3+
"scan_date": "2025-07-18T00:25:36.485902Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [],

‎data/v5.0.2.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "v5.0.2",
3-
"scan_date": "2025-07-17T00:26:18.832201Z",
3+
"scan_date": "2025-07-18T00:26:24.441821Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [],

‎data/v5.0.3.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"release_version": "v5.0.3",
3-
"scan_date": "2025-07-17T00:28:20.382414Z",
3+
"scan_date": "2025-07-18T00:25:22.739583Z",
44
"tool_version": "0.20.1",
55
"total_components": 0,
66
"vulnerabilities": [],

0 commit comments

Comments
 (0)