CVE-2019-1010025.toml

# glibc information disclosure of heap addresses of pthread_created threads.
# This is a local information-disclosure flaw: it requires an attacker
# already able to read process memory to extract heap addresses. The
# 5-Spot controller provides no such read primitive; its HTTP endpoints
# are /healthz and /metrics (Prometheus text output) only, neither of
# which expose raw process memory.
cve = "CVE-2019-1010025"
status = "not_affected"
justification = "vulnerable_code_cannot_be_controlled_by_adversary"
impact_statement = "5-Spot exposes no interface that leaks raw process memory; the pre-requisite local read primitive for this information-disclosure bug does not exist."
products = ["pkg:oci/5-spot"]
author = "erick.bourgeois@gmail.com"
timestamp = "2026-04-19T00:00:00Z"