Snyk test report

Scanned the following paths:

public.ecr.aws/docker/library/redis:7.2.11-alpine/docker/library/redis (apk)
public.ecr.aws/docker/library/redis:7.2.11-alpine/tianon/gosu//usr/local/bin/gosu (gomodules)

2 known vulnerabilities

10 vulnerable dependency paths

19 dependencies

CVE-2024-58251

low severity

Package Manager: alpine:3.21
Vulnerable module: busybox/busybox
Introduced through: docker-image|public.ecr.aws/docker/library/[email protected] and busybox/[email protected]

Detailed paths

Introduced through: docker-image|public.ecr.aws/docker/library/[email protected] › busybox/[email protected]
Introduced through: docker-image|public.ecr.aws/docker/library/[email protected] › alpine-baselayout/[email protected] › busybox/[email protected] › busybox/[email protected]
Introduced through: docker-image|public.ecr.aws/docker/library/[email protected] › busybox/[email protected]
Introduced through: docker-image|public.ecr.aws/docker/library/[email protected] › alpine-baselayout/[email protected] › busybox/[email protected]
Introduced through: docker-image|public.ecr.aws/docker/library/[email protected] › busybox/[email protected]

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.21 relevant fixed versions and status.

In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.

Remediation

Upgrade Alpine:3.21 busybox to version 1.37.0-r14 or higher.

References

More about this vulnerability

CVE-2025-46394