Skip to content

Conversation

@jlsec-bot
Copy link
Contributor

This action searched recent NVD/EUVD changes/publications, checking 420 (+0) advisories from NVD and 397 (+252) from EUVD for advisories that pertain here. It identified 2 advisories as being related to the Julia package(s): HDF5_jll, nghttp2_jll, and libnode_jll.

1 advisories apply to all registered versions of a package

These advisories had no obvious failures but computed a range without bounds.

  • CVE-2025-2915 for packages: HDF5_jll
    • HDF5_jll computed ["*"]. Its latest version (1.14.6+0) has components: {hdf5 = "*"}
      • hdfgroup:hdf5 at <= 1.14.6 includes all versions

1 advisories apply to the latest version of a package and do not have a patch

  • CVE-2023-44487 for packages: nghttp2_jll, and libnode_jll
    • nghttp2_jll computed ["< 1.58.0+0"]. Its latest version (1.68.0+1) has components: {nghttp2 = "1.68.0", nghttp2-libs = "*"}
    • libnode_jll computed [">= 18.12.1+0"]. Its latest version (18.12.1+0) has components: {node-v = "18.12.1", nodejs = "18.12.1"}
      • nodejs:node.js at >= 18.0.0, < 18.18.2 mapped to [>= 18.12.1+0], includes the latest version`

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants